Research reports

msupdater-trojan-and-link-targeted-attacks

No excerpt available.

Malware

APT37 Ruby Jumper: Air-Gap Attack via Removable Media

ThreatLabz details the Ruby Jumper campaign in the following sections, focusing on the specific malware employed, the deployment methods, and how the final payload is delivered to achieve the ultimate objective. Attack flow The figure below illustrates the…

State-sponsored

Technical Analysis of 2CLoader

Important strings in 2CLoader are decrypted at runtime using an inlined bitwise XOR operation applied to global values. The key in the analyzed sample is 0x37 . Indirect system calls For the Nt* APIs listed below, 2CLoader prefers indirect system calls to…

Malware

Vidar Virtual Machine-Based String Obfuscation

The following sections examine Vidar’s string deobfuscation process, including a lightweight virtual machine and custom stream cipher. Virtual machine deobfuscation In order to obfuscate the malware’s strings in versions 2.x and 3.x, the Vidar developer…

Infostealers

C2Looper Backdoor Uses GitHub for C2

In the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands. String encryption and Windows API resolution All identified C2Looper variants use…

Malware

ClaudeFix: Shared Claude Chats Meet ClickFix

Guarda Crypto Wallet bhhhlbepdkbapadjdnnojkbgioiodbic Solflare Wallet

Anthropic Claude Code Leak

By Manisha Ramcharan Prajapati, Jithin Prajeev Nair, Avinash Kumar, Mallikarjun Piddannavar ThreatLabz discovers “Claude Code leak” lure that distributes Vidar and GhostSocks While monitoring GitHub for threats, ThreatLabz came across a “Claude Code leak”…