Research reports

From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain

We had an opportunity to analyse a system with frequent detection-alerts over powershell execution. Our analysis revealed a multi-stage infection that relied heavily on obfuscation, Registry-based payload storage, covert data delivery, persistence mechanisms,…

Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL Sideloading

We came across fake Microsoft Teams distribution sites, shared on X platform back in mid April. The websites closely mimic the legitimate Microsoft Teams download page, using lookalike domains to trick users into downloading a trojanized installer packaged as…

Threat actors target recent Election Results

Recently, we saw a tweet about a document claiming to be reporting about the recent “Indian Election Results”. On analysis, we found that it was dropping a “Crimson RAT” payload. This RAT, mostly used by the Transparent Tribe APT, is capable of stealing…

State-sponsoredMalware