Research reports

Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication

LevelBlue’s Security Services issues Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. In this Threat Analysis report, we…

MalwareInfostealers

CNCMahineRMS

A ClickFix lure. A legitimately signed IBM SPSS IDE. Four side-loaded DLLs. A date formatting API used as a trampoline. And at the end of it all, a 1.14 MB implant that calls itself Most writeups of a BabaDeda intrusion stop at the loader and conclude with a…

Malware

Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand

Trustwave SpiderLabs’ Cyber Threat Intelligence team is tracking the emergence and communication dynamics of the cybercriminal brand known as Scattered LAPSUS$ Hunters (SLH), consolidating observed activity across public platforms to provide updated insights…

SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp

November 19, 2025 10 Minute Read by Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi LevelBlue SpiderLabs researchers have recently identified a banking Trojan we dubbed Eternidade Stealer, which is distributed through WhatsApp hijacking and social…

Malware

LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese Organizations

LevelBlue Labs recently discovered a new highly evasive loader that is being delivered to specific targets through phishing attachments. A loader is a type of malware used to load second-stage payload malware onto a victim’s system. Due to the lack of…

Malware