exatrack.com · Published 5 Nov
SectopRat's GPULoader and VMLoader
Excerpt
Likely related to GPUGate
Two other tools, probably AI-generated were identified
One of the operators most likely made an operational-security mistake
We identified a crimeware-style compromise chain whose distinctive feature is that it decrypts itself using D3D11 shaders executed on the GPU. The chain has two stages built around two different loaders, relying on a proprietary virtual machine, G…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by exatrack.com on exatrack.com.
More from exatrack.com2
exatrack.com · Web page · Published 1 Jun
Tracking APT28 PixyNetLoader: Evolutions from 2024 to 2026
Analysis of ~90 PixyNetLoader samples and grouping them into 4 sub-families using code similarities sharing Enabling unified detection through a single YARA rule Exposing the latest steganography mechanisms used in the 2026 March-April versions Provinding PNG…
exatrack.com · Web page · Published 9 Jun
Under the Hood - LotusLite: Believe me I am MustangPanda
Under the Hood - The new series where We share stories from our daily life as a malware hunter 🔎 We’re kicking things off with a recent implant featuring “BelievemeIamMustang-Panda” and “Hi,Mustang_Panda” hardcoded in its .data section! A C2 over…
On the same topics
Group-IB · Web page · Published 14 Oct
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
Group-IB researchers have identified and analyzed KGB RAT, a Windows-targeting Remote Access Trojan (RAT) that has been actively promoted across underground hacking forums since at least late-2025. Marketed under the guise of a legitimate Remote…
polyswarm.io · Web page · Added 14 Nov
ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure
An evolving Linux malware campaign was observed deploying ClingSTUN, a back-connect proxy backdoor that exploits known vulnerabilities in Internet-facing IoT and embedded/network devices to establish persistent access and convert compromised systems into…
ThreatFabric · Web page · Published 1 Oct
Hirudo: From Fake Updates to Patched Banking Apps
ThreatFabric's Mobile Threat Intelligence team has identified a new Android banking remote access trojan we track as Hirudo. Hirudo combines on-device credential theft with live remote control of the same phone, and it is delivered by shopping and…
helpnetsecurity.com · Web page · Published 12 Nov
Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters
EfficientIP Research Labs traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors’ Windows computers. Each page showed what looked like a routine verification check. Behind it, the page quietly copied a…