Malware
Quasar/AsyncRAT-derived commodity .NET RAT bundled with hVNC, a stealer and a keylogger.
Malware
Highly evasive in-memory .NET RAT (2025) targeting healthcare and pharma via localized phishing.
Malware
China-nexus (UNC5221) Go backdoor targeting network appliances and VMware ESXi for long-dwell espionage.
Malware
Windows proxy botnet turning infected PCs into SOCKS5 exit nodes sold via the PROXY.AM service.
Malware
Residential-proxy botnet that enrols compromised routers and IoT devices to feed the NSOCKS proxy service.
Malware
Peer-to-peer Golang botnet that brute-forces SSH and mines Monero in memory; 2024 variant added Log4Shell spread.
Malware
Python cloud-credential botnet (MITRE S1092) that scrapes exposed .env files; subject of a CISA/FBI advisory.
Malware
Modular cross-platform botnet (MITRE S0458) that mines Monero and self-propagates via stolen creds and EternalBlue.
Malware
Modular self-updating botnet (MITRE S0457) that uses the Bitcoin blockchain as a takedown-resistant C2 fallback.
Malware
Long-running modular MaaS loader (MITRE S0226) with a plugin framework; disrupted in Operation Endgame 2024.
Malware
Shellcode downloader (MITRE S0561, aka CloudEyE) with aggressive anti-analysis; pulls encrypted payloads from cloud storage.
Malware
Modular loader (IDAT Loader / GHOSTPULSE) that hides payloads in PNGs and runs via DLL sideloading; favored by Lumma and ClickFix.
Malware
JavaScript loader (Gootkit lineage) spread by SEO poisoning of legal-document searches; a ransomware on-ramp.
Malware
Loader-as-a-service (EugenLoader / NUMOZYLOD) spread via malvertising and signed MSIX installers.
Malware
2025 loader with a GPU-executing packer (Armoury) and call-stack spoofing; distributed by SmokeLoader.
Malware
Highly evasive shellcode loader delivered by targeted phishing; near-zero AV detection, drops Cobalt Strike.
Malware
Long-running MaaS stealer and form-grabber (MITRE S1207); rebranded as the cross-platform XLoader with a macOS build.
Malware
macOS infostealer MaaS (2024) targeting browsers, wallets and the Keychain; source leaked in November 2024.
Malware
macOS stealer built on the Atomic (AMOS) codebase, spread via malvertising; later rebranded Odyssey.
Malware
Go-based macOS stealer MaaS (2024) that dumps the Keychain and MetaMask; collapsed after an affiliate exit scam.
Malware
MaaS stealer that hides its C2 behind dead-drop resolvers on trusted sites; rebranded as Amatera.
Malware
Rust stealer with multi-stage PowerShell delivery, a mock-trusted-directory UAC bypass and Telegram telemetry.
Malware
XFiles-derived MaaS stealer delivered via fake Google Authenticator ads and ClickFix + HijackLoader chains.
Malware
Open-source .NET stealer delivered by exploiting CVE-2023-36025, a Windows SmartScreen/Mark-of-the-Web bypass.
Malware
Subscription MaaS stealer with polymorphic strings and a custom TCP C2 that later moved to HTTP; also a loader.
Malware
2025 stealer seeded through fake AI video-generator sites on Facebook; Telegram C2, optional XWorm.
Malware
Fake-CAPTCHA copy-paste social engineering that makes users run attacker commands (MITRE T1204.004).
Malware
Prolific MaaS infostealer; StealC V2 reworked its C2 and defeats browser cookie encryption.
Malware
Outlook and Thunderbird email-credential stealer operated by Hive0145 via invoice phishing.
Malware
.NET keylogger and stealer (404 / Kraken) with SMTP, FTP and Telegram exfiltration.
Malware
Cross-platform Java RAT
Malware
Premium .NET keylogger and stealer
Malware
Open-source Android RAT
Malware
Lightweight loader and reconnaissance bot
Malware
Japanese-themed loader
Malware
Weaponized remote admin tool
Malware
Analysis of emerging Android threats
Malware
Open-source .NET RAT
Malware
macOS information stealer
Malware
Go-based information stealer
Malware
Backdoor malware
Malware
AutoIt-scripted malware family
Malware
Commercial .NET RAT
Malware
Information stealer targeting browser data and crypto wallets
Malware
Clipboard-hijacking banking malware
Malware
Brazilian banking trojan downloader
Malware
TrickBot successor loader
Malware
Brazilian banking trojan
Malware
Legacy RAT with modern revival
Malware
Low-cost MaaS RAT
Malware
Information stealer loader
Malware
Commercial adversary simulation framework
Malware
Cuba ransomware downloader
Malware
Go-based cross-platform RAT
Deep analysis of Cobalt Strike, the commercial red team framework exploited by APT29, APT41, Conti, and LockBit. Covers Beacon payloads, Malleable C2, Operation Morpheus, and defense strategies.
Malware
Unauthorized cryptocurrency mining
Malware
Modular banking trojan
Malware
Emerging downloader malware
Malware
Premium MaaS loader
Analysis of DcRAT (Dark Crystal RAT), the $5-7 .NET MaaS RAT with 34 plugins, dedicated IDE, and usage by threat actors targeting Ukrainian defense. Covers YouTube distribution, plugin ecosystem, and
Malware
Custom APT backdoor
Malware
Dual-payload loader
Malware
Prolific banking trojan
Malware
Classic file infector
Malware
Emerging Linux threats analysis
Malware
Script-based loader chain
Malware
Modular botnet and loader
Malware
Fake application malware
Malware
Classic credential stealer and downloader
Malware
File infector trojan
Malware
Delphi-based RAT
Malware
Chinese-origin RAT with decades of use
Malware
Go-based brute force tool
Malware
LATAM banking trojan
Malware
VBS-based worm RAT
Malware
Banking trojan turned loader
Malware
Emerging loader malware
Malware
Banking trojan
Malware
Modular financial trojan
Analysis of Latrodectus, the Windows malware loader succeeding IcedID with advanced sandbox evasion, AES-256 encryption, and ClickFix social engineering. Covers TA577/TA578, Operation Endgame survival
Malware
Open-source .NET RAT
Malware
AutoIt-based RAT
Malware
Widely distributed information stealer
Malware
E-commerce card skimmer
Malware
Backdoor trojan
Malware
MaaS loader
Malware
RedLine fork with shared infrastructure
Malware
Infamous IoT DDoS botnet
Malware
LATAM banking trojan and stealer
Malware
Widely-used .NET RAT
Malware
Cross-platform commercial RAT
Analysis of NjRAT (Bladabindi), the leaked-source .NET RAT active since 2012 with keylogging, MBR wiping, USB worm, and DDoS capabilities. Covers Group5, SideCopy, Dev Tunnels abuse, and defense strat
Malware
Excessive failed DNS resolution abuse
Malware
Information-gathering RAT
Malware
Surveillance-focused RAT
Malware
Commercial RAT disguised as admin tool
Malware
JavaScript-based loader
Malware
Emerging backdoor
Malware
Emerging MaaS RAT
Malware
IRC-based Perl backdoor
Malware
Chinese APT backdoor
Malware
Classic Chinese APT RAT
Malware
PowerShell-based malware delivery
Malware
Open-source Python RAT
Malware
Budget information stealer
Malware
Python-based malware delivery
Malware
Long-running banking botnet
Malware
Proxy backdoor
Malware
Open-source .NET RAT
Malware
MaaS information stealer
Malware
Java-based open-source RAT
Analysis of RedLine Stealer, the MaaS infostealer responsible for 51% of all infostealer infections, its Operation Magnus takedown, and defense strategies.
Malware
Commercial surveillance RAT
Analysis of Bad Rabbit ransomware, a modified variant of Not Petya targeting Ukraine and Russia via drive-by downloads and SMB propagation.
Malware
Free .NET RAT
Malware
Advanced C++ information stealer
Malware
PrivateLoader-distributed stealer
Malware
Weaponized Remote Utilities
Malware
DNS hijacking and manipulation
Malware
Small downloader
Malware
Legacy IRC-based botnet
Malware
Information stealer RAT
Malware
JavaScript-based fake update framework
Malware
Multi-component malware suite
Malware
Adware and crypto-mining botnet
Malware
Stealthy cross-platform malware
Malware
Java-based RAT with fake ransomware
Malware
Lightweight information stealer
Malware
Cryptomining botnet
Analysis of SystemBC, the SOCKS5 proxy backdoor with TOR integration used by Ryuk, Conti, DarkSide, and Black Basta ransomware operations. Covers RC4 encryption, DroxiDat variant, and detection strate
Malware
Emerging loader malware
How Lapsus$, ShinyHunters, and Scattered Spider merged into one of the most brazen cybercrime collectives, and what it means for enterprise security.
Analysis of SANDWORM_MODE, the first documented cross-modal supply chain worm designed to subvert AI coding assistants and MCP servers via malicious npm packages.
Malware
Point-of-sale malware
Analysis of Tofsee (Gheg), the modular spam botnet active since 2013 with crypto mining, DDoS, social media spreading, and proxy modules. Covers DGA cracking, PrivateLoader distribution, and defense s
Malware
Modular banking trojan turned loader
Malware
Emerging malware family
Malware
Analysis of emerging unclassified RATs
Malware
Classic small downloader
Malware
Long-running banking trojan
Malware
Chinese-origin RAT targeting Chinese speakers
Malware
Arkei-derived information stealer
Malware
JavaScript worm/RAT hybrid
Malware
USB propagation worm
Malware
MaaS information stealer
Malware
Modular backdoor framework used by multiple Chinese APT groups for persistent access and supply chain compromises across gaming, technology, and telecom sectors.
Malware
Open-source C# RAT
Malware
Legacy RAT still in use
Malware
Rising MaaS RAT