Research reports

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Insikt Group identified Russian state- BlueDelta delivered HOOKEDGE, a sponsored group BlueDelta (APT28) lightweight batch-script successor targeting government, diplomatic, and to HEADLACE, via macro-enabled defense organizations in Romania, Spain, Word…

Latin America and the Caribbean Cybercrime Landscape

This report provides an overview of trends and developments in the cybercriminal ecosystem of Latin America and the Caribbean (LAC) in 2025. Insikt Group found that threat actors operating in or targeting the LAC region predominantly use client-server…

GrayCharlie Hijacks Law Firm Sites in Suspected Supply-Chain Attack

Insikt Group has been monitoring GrayCharlie, a threat actor overlapping with SmartApeSG and active since mid-2023, for some time, and is now publishing its first report on the group. GrayCharlie compromises WordPress sites and injects them with links to…

MalwareSupply chain

DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal

DRAT V2 updates its C2 obfuscation by adding junk strings before Base64- encoding IPs, likely to impede basic decoding and evade detection by automated tools. TAG-140 continues to favor simplicity over stealth by using ClickFix-style social engineering…

Anatomy of DDoSia: NoName057(16)'s DDoS Infrastructure and Targeting

NoName057(16) uses a resilient, multi-tiered infrastructure featuring rapidly rotated Tier 1 command-and- control (C2) servers and access- controlled Tier 2 servers to enhance operational security. NoName057(16) maintains a high operational tempo, averaging…

Botnets and DDoS

Full Spectrum Detections for 5 Popular Web Shells: Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE

Alfa, Krypton, SharPyShell, ASPXSpy, and TWOFACE. It contains details on the capabilities of the web shells and host-based and network-based detections. This report is intended for security operations audiences who focus on detection engineering. Sources…

GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT

Insikt Group identified three GrayAlpha infection vectors: fake browser updates, fake 7-Zip sites, and the use of the TDS TAG-124 network, which had not been publicly linked to GrayAlpha until now. Insikt Group discovered PowerNet, a new PowerShell loader,…

Malware

Russia-Aligned TAG-110 Targets Tajikistan with Macro-Enabled Word Templates

TAG-110 continues to focus on Tajikistan’s public sector entities, aligning with Russia’s broader strategic interest in Central Asia through intelligence-gathering operations. TAG-110’s reuse of C2 infrastructure, consistent use of lure themes, and technical…

TerraStealerV2 and TerraLogger: Golden Chickens’ New Malware Families Discovered

CYBER THREAT ANALYSIS TerraLogger represents the first observed use of a keylogging capability in malware developed by Golden Chickens. Insikt Group observed ten distinct TerraStealerV2 distribution samples between January and March 2025, delivered in varied…

Malware

TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base

The operators behind TAG-124 show high levels of activity, frequently updating compromised WordPress sites, setting up new servers, and refining TDS-related conditional logic and infection techniques. Numerous threat actors have relied on or continue to use…

Ransomware

RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers

Insikt group observed RedMike exploiting privilege escalation vulnerabilities CVE-2023-20198 and CVE-2023-20273 to compromise unpatched Cisco network devices running Cisco IOS XE software. RedMike compromised devices of a US-based affiliate of a UK…

State-sponsoredVulnerabilities

Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain

The group has used LNK files and MSC files as the first-stage components and ultimately loaded PlugX via search order hijacking. The group consistently used Cloudflare's CDN to proxy C2 traffic to threat actor-controlled C2 servers. This enables RedDelta to…

State-sponsored

BlueAlpha Abuses Cloudflare Tunneling Service for GammaDrop Staging Infrastructure

BlueAlpha continues to target Ukrainian entities with spearphishing campaigns, leveraging HTML smuggling attachments to deliver Visual Basic Script (VBScript)-based malware. BlueAlpha continues to use domain name system (DNS) fast-fluxing of GammaLoad…

Malware

Rusia-Aligned TAG-110 Targets Asia and Europe with HATVIBE and CHERRYSPY

Since July 2024, 62 victims of custom malware HATVIBE and CHERRYSPY have been found across eleven countries, mostly in Central Asia, targeting government, human rights, and education sectors. Similar to other recent Russian APT campaigns, the group likely…

State-sponsored

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

This campaign’s malicious infrastructure used Cloudflare for name servers, hiding the threat actor’s IP and complicating attribution — a technique increasingly observed among APT groups. TAG-112 overlaps with TAG-102 (Evasive Panda), a Chinese APT group…

State-sponsored

Outmaneuvering Rhysida: How Advanced Threat Intelligence Shields Critical Infrastructure from Ransomware

Insikt Group identified Rhysida’s multi-tiered infrastructure, including typosquatted domains for SEO poisoning, payload servers, CleanUpLoader C2 servers, and higher-tier admin and Zabbix servers. This research builds on previous findings showing that…

Ransomware

GreenCharlie Infrastructure Linked to US Political Campaign Targeting

GreenCharlie’s victimology includes research and policy analysts, government officials, diplomats, and high-value strategic targets. GreenCharlie highly likely operates at the behest of the Islamic Revolutionary Guard Corps’ Intelligence Organization…

Rhadamanthys Stealer Adds

Detections and preventative measures unveiled for Rhadamanthys Stealer v0.7.0 provide an effective defense against this evolving threat, offering organizations strategies to prevent data theft and strengthen security. Rhadamanthys Stealer v0.7.0 is a global…

MalwareInfostealers

Chinese State-Sponsored RedJuliett Intensifies Taiwanese Government, Academic, and Technology Sector Cyber Espionage via Network Perimeter Exploitation

States, Rwanda, Kenya, and Djibouti. Internet-facing devices such as firewalls, load balancers, and enterprise VPNs were targeted for initial access. SQL injection and directory traversal was attempted against web and SQL applications. RedJuliett likely…

State-sponsoredVulnerabilities

TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies

The group employs open-source remote access capabilities and exploits a wide range of internet-facing appliances for initial access, including enterprise VPN, firewall, and email appliances. TAG-100 compromised two major Asia-Pacific intergovernmental…

State-sponsored