Threat Research

Recent escalations between Iran, the U.S., and Israel have coincided with increased cyber threat activity across the Middle East. Destructive incidents, including kinetic attacks affecting AWS data centers in the UAE and Bahrain, have disrupted regional cloud services....

An active Linux-targeting campaign is deploying a Mirai-derived botnet called V3G4, now enhanced with a stealthy, fileless-configured XMRig Monero cryptominer....

DanaBot is a Malware-as-a-Service (MaaS) platform active since 2018, operating through an affiliate model where the developer provides the malware, C2 infrastructure, and support. Affiliates use DanaBot for credential theft, banking fraud, and other malicious activities....

On May 22, 2025, Our team revealed further actions tied to Operation Endgame, aimed at disrupting cybercriminal groups like those behind DanaBot. This follows the original 2024 effort that targeted malware such as SmokeLoader, IcedID, and Pikabot....