Everything we've published.
Every report, in one place methodology and indicators included, not just findings.
Inside REVSTEALER's Growing Distribution Ecosystem
REVSTEALER has rapidly matured into one of the most operationally sophisticated infostealers observed in the current threat landscape. An industrial-scale, financially motivated campaign that weaponizes the gaming-cheat and fake-AI-tool economy to deliver a multi-stage, VMProtect-packed payload through more than 100 interconnected domains, trojanized Electron applications masquerading as Anthropic's Claude Opus 5, and hijacked YouTube distribution channels. Once executed, the malware performs a ten-point weighted sandbox-evasion scoring routine, decrypts an AES-256-CBC in-memory payload, and leverages fourteen indirect syscall wrappers and FNV-1a API hashing to bypass user-mode hooks before systematically harvesting credentials from browsers, password managers, cryptocurrency wallets, Steam, Roblox, Battle.net, EA Desktop, and Minecraft; then exfiltrating the loot as streamed, encrypted typed records over HTTPS, with a resilient Polygon blockchain dead-drop resolver standing by as a fallback command-and-control channel. With no persistence by design, self-deletion as a closing act, and a CIS-region language exclusion built into its host-validation gate, REVSTEALER represents a deliberate, high-tempo smash-and-grab operation that prioritizes volume over dwell time—and its combination of consumer-grade lures with nation-state-grade tradecraft makes it a formidable and fast-moving threat that defenders can no longer afford to treat as commodity malware.
PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational Infrastructure
PHP2shell Critical Vulnerabilities Affecting 70% Of The Internet. The rapid weaponization of PHP2Shell demonstrates how fundamental engine vulnerabilities bypass traditional perimeter defenses. Within days of disclosure, diverse UNC actors integrated automated exploitation scripts into their campaigns, targeting a massive attack surface.
Disect Netscaler Citrix Vulnerability CVE 2026-88771/72 - Uncovering the exploit & it's infrastructure
In September 2026, Citrix disclosed two critical vulnerabilities: CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway. Both carry a 9.5 CVSS score and affect default configurations. Approximately 50,000 internet-exposed NetScaler instances were reachable at the time of disclosure. This research analyzes a captured operations console at `66.154.127.156` (AS35916 MULTACOM CORPORATION, Leesburg, Virginia).
Suspected Sidewinder Campaign Against South Asian Governments and Finance Targets
While threat hunting, we identified an exposed VPS at 66.179.31[.]191 hosted on BL Networks (AS399629) in Singapore. The host ran a Python SimpleHTTP server on port 8898 with directory listing enabled. AttackCapture archived the directory and flagged it as a potential malicious open directory. What it exposed was a working attack server: 395 files across 9 subdirectories, roughly 182 MB, containing exploit code for GeoServer, GeoTools, Laravel Ignition, Tomcat, and a Redis module loader, along with phpMyAdmin weak-credential scripts, target lists, session cookies, C2 configuration, and operational logs.
Inside PlayCrypt: Deconstructing the Amadey → Cobalt Strike → Play Multi-Stage Ransomware Chain
One file hash. A few pivots. That's all it took to walk straight into Play ransomware's back office: a Cobalt Strike server on Tencent loaded with exploit and credential-theft scripts, a live Sliver C2 host, and a team server actively churning out evasive Windows payloads, all sitting in open directories, no victim network required. A misconfigured leak site handed over Play's negotiation timelines for free. And one intrusion traced back to a single binary carrying Amadey, Cobalt Strike, Elex, and the Play encryptor together, proof that if you're only watching the network, you're already too late.
Scattered Spider: Many Names, One Syndicate
A financially motivated collective that weaponises social engineering over malware, mapped through domain impersonation, JARM pivoting and IOC clustering.
Operation Black Mirror: ClickFix Campaign Analysis
Multi-campaign analysis of ClickFix operations run by both APT actors and crimeware crews, focused on Win+R lures and infrastructure-level hunting.
When the Bazaar Burned From Within: The Silent Breach of Nobitex
How a cryptocurrency exchange was taken apart from the inside, and what its internal architecture revealed once the attackers published it.
No reports match your search.