Research reports

CNCMachineRMS C2 Protocol

This post describes the binary command-and-control (C2) protocol used by CNCMachineRMS, a recently identified remote access trojan (RAT). We cover how the protocol was discovered, how its infrastructure was identified, and how network defenders can detect it.…

Malware

Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea

The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases in which attackers targeted web servers in Korea to install SoftEther VPN. Attack cases involving the installation of SoftEther VPN, an open-source VPN, were previously discussed…

[[overtitle]] Accès illégitimes au système d’information de la Direction générale des Finances publiques[[cp_subtitle1]]

COMMUNIQUÉ DE PRESSE Paris, le 14 août 2026 N°953 Accès illégitimes au système d'information de la Direction générale des Finances publiques Mercredi 12 et jeudi 13 août 2026, un acteur malveillant a revendiqué des accès illégit

CERT-UA

Урядовою командою реагування на комп'ютерні надзвичайні події України CERT-UA у березні 2023 року отримано інформацію щодо виявлення ознак несанкціонованого доступу до інформаційно-комунікаційної системи (ІКС) одного з комунальних підприємств. Керуючись пп.1…

SilkParasite: Tracking a China-Nexus APT Across Central Asia

TL;DR: SilkParasite is a cyberespionage operation, assessed at medium confidence as China-nexus, that targeted government bodies across Central Asia. Bitdefender Labs found seven remote access tool (RAT) families in use, five of which were previously…

State-sponsored

French tax authority data breach affects 678,000 individuals

The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals. This incident was discovered after a threat actor…

C2Looper Backdoor Uses GitHub for C2

In the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands. String encryption and Windows API resolution All identified C2Looper variants use…

Malware

Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Jewelbug is a China-based hackers-for-hire group that runs parallel operations: espionage against governments and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency fraud business. Both missions are administered…

State-sponsored

Head Mare доставляет бэкдоры PhantomCore и PhantomGraph через необновленный сервер TrueConf

UPD 10.08.2026: добавлены правила для защиты компаний, использующих нашу SIEM-систему Kaspersky Unified Monitoring and Analysis Platform (KUMA), а также события для разработки собственных правил детектирования или проведения threat hunting. UPD 07.08.2026:…

Gunra Ransomware

Another ransomware actor operating under the name Gunra has recently surfaced, allegedly claiming several victims in the healthcare, electronics, and beverage manufacturing sectors, as listed on their onion website. In recent activity, the ransomware they…

Ransomware

TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

Elastic Security Labs is tracking an emerging threat named TELEPUZ, which we have discovered spreading widely via a CLICKFIX-VIDAR chain. This malware is in active development and has been operating since late April 2026, according to the infrastructure…

MalwareInfostealers

Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads

Sonatype Research Labs identified six npm packages delivering the same malicious payload: three hijacked legitimate packages and three additional malicious packages, tracked as sonatype-2026-005899 and sonatype-2026-005901. The malware uses the same Ethereum…

Supply chain

UNIT 42 PLAYBOOK VIEWER

No excerpt available.

Dark Web Profile: ExfilSquad

ExfilSquad is an emerging data-extortion group that surfaced with a rapid wave of public claims and a Tor-hosted Data Leak Site (DLS). The group is associated with an “only exfiltration” model, suggesting a focus on data theft rather than confirmed file…

Dark Web Profile: ShinyHunters

[Update] July 31, 2025: “ShinyHunters Behind CRM Attacks on Qantas, Adidas, and Others” Within the obscured world of the Deep/Dark Web, where cybercrime flourishes amidst databases, initial access brokers, and a plethora of illegal activities, there exists a…

orova Ransomware Group Profile

Orova is a newly emerged ransomware extortion group that has been active since mid-2026. They focus on compromising corporate networks and leveraging data exfiltration to enforce ransom payments, utilizing a dedicated data leak site on the dark web to publish…

Ransomware

gammax Ransomware Group Profile

Gammax is a newly emerged extortion and crypto-ransomware operation that began in July 2026, focusing on commercial enterprises and utilities. The group employs a double-extortion model by exfiltrating sensitive data before encrypting files, using a dedicated…

Ransomware

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

By By Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 29, 2026 By Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and…

Vulnerabilities

Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN

While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner. While the installation of CoinMiner is common in attack cases…

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)

AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and [1] In March 2026, Hauri disclosed an attack case in which the…

Malware