Research reports

Prompts as Code & Embedded Keys

This is an abridged version of the LABScon 2025 presentation “LLM-Enabled Malware In the Wild” by the authors. A LABScon Replay video of the full talk will be released in due course. As Large Language Models (LLMs) are increasingly incorporated into…

MalwareAI

WordlistLoader Delivering Amatera via ClearFake Campaigns

Gen Threat Labs has identified WordlistLoader, a new loader used to deliver Amatera Stealer via ClearFake campaigns. Amatera has been actively developed over the past few months and has gradually become one of the most prevalent infostealers in our user base.…

Infostealers

NCC Group Monthly Threat Pulse – Review of July 2026

Ransomware volume rose 22% month-on-month, with 894 cases recorded in July Industrials remain top target as sector takes over a quarter (28%) of attacks Western regions are still most targeted with North America experiencing 41%, and Europe 29%, of all…

Ransomware

Download Meccha Chameleon Cheats, Get Malware

Over the past month, I’ve been playing this game called Meccha Chameleon, which is a hybrid between hide-and-seek and prop hunt, except instead of transforming into a map prop, you paint yourself to blend in with the environment. A group of hunter players…

Malware

SmartApeSG ClickFix Campaign Delivers Unknown RAT

The SmartApeSG campaign uses the ClickFix technique to trick users into running malicious commands through fake CAPTCHA or human verification pages. This action launches an HTA file that downloads and extracts a malicious ZIP archive. The final payload is an…

Malware

Azure Data Exfiltration: TheHatman Campaign Exposes Millions of Records

The modern enterprise security perimeter has fundamentally collapsed, shifting away from fortified network firewalls and landing squarely on the fragile concept of digital identity. A sprawling and sophisticated data exfiltration campaign currently unfolding…

The QTFY Hunt: How Chinese Hackers Were Tracked and How the Internet Became the Sensor

QTFY is better understood as an infrastructure quartermaster than a conventional hacking group: its role appears to be providing reconnaissance, access and obfuscation capabilities as reusable services to multiple state customers. Much of its concealment…

Trapping a Mustang Panda

As of mid-2026, IBM X-Force continues to monitor cyber campaigns conducted by ITG27, a China-aligned state-sponsored espionage group whose victims align with China’s regional strategic interests. In collaboration with Deception.Pro, X-Force captured live…

State-sponsored

Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

The Group-IB Threat Intelligence team has identified BraZetsu, a sophisticated Python-based Windows malware framework that we attribute, with high confidence, to the Brazilian threat actor known as Exilware. Unlike the standard infostealer model, BraZetsu is…

Financially Motivated Threat Actor BREEZE COMET Targets Brazil

BREEZE COMET is a financially motivated threat actor that targets Brazilian financial services, retail, and eCommerce organizations by abusing compromised websites, custom malware, and stolen credentials to manipulate payment systems and fraudulent transfers.…

Malware

Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant

RedC2 extends its control layer with an AI-driven component called Red post-exploitation tasks, from network reconnaissance to credential dumping, using natu

MalwareSupply chain

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

By Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan, Parasharan Raghavan Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised…

public-research/cecbot/report.md at main · deepfield/public-research

No excerpt available.

Botnets and DDoSMobile

Reverse Engineering the Auto-Color Linux Backdoor

Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit. Auto-Color in a Nutshell Auto-Color is an emerging Linux backdoor first documented by Palo Alto Networks Unit 42 in February 2025. The earliest known samples…

Malware

Carry-On Compromise: TA4922 Packs PackClient

August 27, 2026 Kyle Cucci, Rob Kinner, Tony Robinson and the Proofpoint Threat Research Team Key Findings Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram. It is being used by at least one threat actor,…

Malware

North Korea’s Crypt: Hunting Ghosts

Here we are again. The Quetzal Team just returned from DEF CON Las Vegas after delivering talks and workshops about North Korean malware at the Adversary, Red Team, and Malware Villages, and having the honour of conquering the Main Stage. Nelson Colón from…

Malware

A ClickFix cluster: Observed activity from recent ClickFix campaigns

As ClickFix has become one of the most common infection techniques over the last few years, adversaries continue to refine and adapt their delivery mechanisms. Earlier this summer, the Field Effect team observed a ClickFix campaign employing three distinct…

shrun, apiwatcher, and argus: three malware analysis tools built with Claude

It has been a while since my last blog post. In this one I'll present my experiment with using build three Rust-based tools that ease my malware analysis workflow The Malware: Lorem Ipsum I'll present three tools I built with Claude to analyze the Lorem Ipsum…

Malware

Beyond the Batch File: Analysis of a Multi‑Stage DonutLoader Infection Chain

Persistence Mechanism 11 Secondary PowerShell Payload Recovery 13 Shellcode Recovery and Target Process Selection 13 Process

CNCMahineRMS

A ClickFix lure. A legitimately signed IBM SPSS IDE. Four side-loaded DLLs. A date formatting API used as a trampoline. And at the end of it all, a 1.14 MB implant that calls itself Most writeups of a BabaDeda intrusion stop at the loader and conclude with a…

Malware