Research reports

Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs

The DOUBLECUP panel provides multiple utilities to load an operator’s final payload. The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage. This second stage decrypts the final…

Malware

Dark Web Profile: ExfilSquad

ExfilSquad is an emerging data-extortion group that surfaced with a rapid wave of public claims and a Tor-hosted Data Leak Site (DLS). The group is associated with an “only exfiltration” model, suggesting a focus on data theft rather than confirmed file…

Dark Web Profile: ShinyHunters

[Update] July 31, 2025: “ShinyHunters Behind CRM Attacks on Qantas, Adidas, and Others” Within the obscured world of the Deep/Dark Web, where cybercrime flourishes amidst databases, initial access brokers, and a plethora of illegal activities, there exists a…

orova Ransomware Group Profile

Orova is a newly emerged ransomware extortion group that has been active since mid-2026. They focus on compromising corporate networks and leveraging data exfiltration to enforce ransom payments, utilizing a dedicated data leak site on the dark web to publish…

Ransomware

gammax Ransomware Group Profile

Gammax is a newly emerged extortion and crypto-ransomware operation that began in July 2026, focusing on commercial enterprises and utilities. The group employs a double-extortion model by exfiltrating sensitive data before encrypting files, using a dedicated…

Ransomware