Threat Research

This report examines a recent ransomware attack by the BlackSuit group, a successor to the Royal ransomware family. Known for its hybrid tactics, BlackSuit combines data exfiltration with encryption, using advanced tools like PsExec, Cobalt Strike, RDP, and rclone to execute commands, move laterally, and extract data....

In March 2025, the PebbleDash backdoor malware, previously linked to the Lazarus group, was observed being distributed in new campaigns targeting individuals. The latest activity includes the use of additional malware and modules alongside PebbleDash to enhance its capabilities....

Earth Koshchei executed a sophisticated attack campaign using rogue Remote Desktop Protocol (RDP) tactics. The group employed red team tools for espionage and data exfiltration, utilizing spear-phishing emails to trick victims into connecting to malicious RDP servers via a compromised configuration file....

The report "Midnight Blizzard Conducts Large-Scale Spear-Phishing Campaign Using RDP Files" highlights a sophisticated phishing operation conducted by the threat actor group known as Midnight Blizzard. The campaign involves sending malicious Remote Desktop Protocol (RDP) files to targeted individuals to gain unauthorized access to their systems....