Threat Research

This campaign demonstrates how modern stealers increasingly combine social engineering, browser fingerprinting, fileless execution, and steganography to evade traditional detection....

Between June 17 and July 22, 2026, a single operator compromised more than 14,000 Dahua IP cameras worldwide. The campaign began with masscan sweeps targeting Russian IP ranges before expanding across the entire IPv4 address space....

Token jacking is an emerging AI-focused threat where cybercriminals steal developers’ AI API keys or tokens and use them to access AI platforms without authorization. Attackers can consume large amounts of expensive LLM processing resources or resell the stolen access, potentially causing significant financial losses before the victim notices....

The StubMaker campaign is a RubyGems supply chain attack that distributed typosquatted Ruby packages containing malicious extconf.rb installer hooks to compromise Windows developer systems. During installation, the packages fingerprint the host, download a Rust-based loader from GitHub Releases, and decrypt an embedded Go infostealer entirely in memory for fileless execution....

ENIbot (also known as HuntBot) is an actively spreading IoT botnet that self-propagates across the internet and conducts Layer 7 DDoS attacks through its C2 infrastructure. Since March 2026, honeypots have recorded millions of exploitation attempts and 3,505 distinct malware samples linked to the campaign....

C2Looper is a newly identified Rust-based backdoor likely used by a ransomware-related threat actor to establish footholds for lateral movement. It supports remote command execution, system reconnaissance, and deployment of additional payloads, while using encrypted strings and dynamically resolved Windows APIs for evasion....

Lucid Stealer is an information-stealing malware designed to harvest sensitive personal and financial data from compromised systems. It uses a legitimate Node.js-based execution framework to hide malicious components and evade traditional static analysis....

This DCRat campaign combines phishing with SVG attachment, DLL sideloading, and process hollowing to establish stealthy remote access while evading endpoint defenses. By abusing trusted Windows utilities and requiring user interaction, the malware blends into legitimate activity and enables in-memory execution....

On July 31, Threat Intelligence reported an ongoing credential theft campaign tracked as CaptiveCrunch, attributed to Storm-2945, a sub-group of Russia-linked Midnight Blizzard (APT29). The campaign abuses captive portal networks at hotels, conference centers, and similar venues to redirect victims to attacker-controlled infrastructure....

The APT36 (Transparent Tribe)-linked PATCHCORD campaign is an evolving cyber espionage operation targeting telecommunications, government, defense, and critical infrastructure organizations across South Asia....

Recent weeks have seen a rise in ClickFix social engineering campaigns delivering the KongTuke malware through DLL sideloading. The campaign abuses legitimate, digitally signed Mozilla Firefox binaries, while attackers rotate lure domains but reuse the same payload infrastructure and tools. The malicious DLLs are written in Rust and disguised as legitimate Firefox components....

ClickFix campaign that used compromised WordPress websites and Cloudflare-themed social engineering lures to trick users into executing a malicious PowerShell command. The attack abused the legitimate Deno JavaScript runtime and winget to install Deno, execute remote JavaScript, and deliver a Python-based infostealer through an MSI staging chain....

Head Mare, now assessed as an APT group, exploited two vulnerabilities in unpatched TrueConf video conferencing servers to achieve SYSTEM-level code execution and deploy a web shell. The attackers used the compromised server to collect infrastructure data, access the TrueConf database, and replace legitimate TrueConf Client installers with trojanized versions....

A new Kimwolf v7 Android/IoT botnet variant has been identified with enhanced DDoS capabilities and stronger C2 resilience. The botnet mainly targets Android TV boxes and set-top boxes, adding an HTTP/2-based flood that mimics complete browser fingerprints....

Lazarus Group / DPRK-linked Operation Dream Job campaign targeting the defense, aerospace, and aviation sectors through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers....