Research reports

Warlock Ransomware Attackers Hit Water and Telecom Operators

Warlock first came to prominence via the exploitation of a Microsoft SharePoint “ToolShell” exploit chain. Warlock is developed by a China-nexus threat actor Symantec calls Longlegs (aka Storm-2603). Symantec has previously tied this group to older activity…

RansomwareVulnerabilities

Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side

Jewelbug is a China-based hackers-for-hire group that runs parallel operations: espionage against governments and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency fraud business. Both missions are administered…

State-sponsored

GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

Analysis of a recent GodDamn ransomware attack indicates that this seemingly new ransomware is in fact the latest rebrand of the Beast ransomware, which in itself was a rebrand of the Monster ransomware, which was first seen in 2022. The Symantec Threat…

Ransomware

Fast16: Pre-Stuxnet Sabotage Tool Was Built to Subvert Nuclear Weapons Simulations

Fast16’s hook engine is selectively interested in high-explosive simulations inside LS-DYNA and AUTODYN. All evidence suggests that attackers were specifically targeting simulations of nuclear detonations. The malware checks for the density of the material…

Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor

Backdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational. It was found running on a compromised host in Taiwan in 2026, more than four years after it was first uncovered. On the same machine,…

Malware