Detection
Detection logic for initial-access-broker footholds: web shells, anomalous VPN logons, dormant valid accounts and remote-access tooling staged for resale.
Detection
Detection logic for LSASS credential dumping before ransomware: comsvcs MiniDump, ProcDump, lsass.exe access masks and dump files, with Sigma and Splunk.
Detection
Detection logic for backup destruction ahead of encryption: service stops, catalog and repository deletion, shadow copy removal and backup database access.
Detection
Detection logic for ransomware deployed through Group Policy: new GPO creation, gPLink changes, startup scripts and immediate scheduled tasks pushed from SYSVOL.
Detection
Detection logic for one host pushing a payload to many: PsExec service installs, remote WMI process creation, SMB copies and one-to-many logon fan-out.
Detection
Detection logic for AV and EDR tampering before encryption: Defender preference changes, exclusions, tamper events, service stops and vulnerable drivers.
Detection
Detection logic for data staging ahead of exfiltration: large archive creation, password-protected archives, mass file reads on servers and staging directory growth.
Detection
Detection logic for RDP brute force and password spraying: 4625 bursts, distributed spray across accounts, failure-then-success sequences and exposed RDP discovery.
Detection
Detection logic for VPN and edge appliance compromise: anomalous VPN logons, appliance configuration changes and internal scanning from VPN address pools.
Detection
Detection logic for admin-share sweeps: one source touching C$, ADMIN$ and IPC$ on many hosts, share enumeration commands and SMB scanning before deployment.
Detection
How to detect fast ransomware intrusions by measuring intervals between recon, credential access and deployment, and alerting on stages that finish too fast.
Detection
How to stitch low-fidelity ransomware precursors into high-confidence alerts using Sigma temporal correlation, risk-based alerting and ordered stage sequences.
Detection
A look-back hunting playbook for footholds that predate encryption: dormant accounts, VPN history, new remote tools, scheduled tasks and early persistence.
Detection
Detection logic for recovery inhibition ahead of ransomware: bcdedit changes, Windows RE disablement, safe-mode boot forcing and shadow storage resizing.
Detection
Detection logic for SSH tunneling: local, remote and dynamic port forwarding flags, long-lived outbound SSH, and server-side forwarding configuration.
Detection
Detection logic for Chisel tunnels: client and server command lines, reverse SOCKS mode, WebSocket subprotocol fingerprints and Go binary artifacts.
Detection
Detection logic for ngrok abuse: agent process and config artifacts, ngrok control-plane and tunnel DNS egress, and exposed internal services such as RDP and SSH.
Detection
Detection logic for SOCKS proxy pivots: new SOCKS listeners on endpoints, Zeek socks.log handshakes, ssh -D dynamic forwarding and east-west proxy traffic.
Detection
Detection logic for HTTP CONNECT tunneling: CONNECT requests to non-standard ports and rare hosts, proxy tunnel logs and repeated long CONNECT sessions.
Detection
Detection logic for DNS as a general tunnel transport: unique subdomain volume per zone, query length and entropy, record-type mix and sustained throughput.
Detection
Detection logic for reverse SSH tunnels: ssh -R and autossh process patterns, cron and systemd persistence, and outbound sessions to attacker VPS hosts.
Detection
Detection logic for Windows port forwarding: netsh interface portproxy rules, the PortProxy registry key, plink forwards and related firewall changes.
Detection
Detection logic for cloudflared abuse: token-based tunnel runs, trycloudflare quick tunnels, port 7844 edge egress and agent artifacts.
Detection
Detection logic for FRP (fast reverse proxy): frpc and frps execution, ini and toml config artifacts, default control port 7000 and dashboard exposure.
Detection
Detection logic for iodine IP-over-DNS: iodine and iodined process artifacts, the dns0 tun interface, NULL and TXT-heavy query patterns and handshake traffic.
Detection
Detection logic for covert GRE and IP-in-IP tunnels: unexpected IP protocol 47 and 4 flows, Zeek tunnel.log records and host tunnel interface creation.
Detection
Detection logic for proxychains and multi-hop proxy pivots: proxychains4 execution, config files, LD_PRELOAD hooks and sequential internal SOCKS hops.
Detection
Detection logic for unauthorised WireGuard tunnels: UDP handshake message sizes, default port 51820, wg interfaces, wintun and tunnel services on endpoints.
Detection
Detection logic for browser credential theft: non-browser reads of Login Data, logins.json and key4.db, temp copies of the SQLite stores and Local State access.
Detection
Detection logic for session-cookie theft: Cookies database reads, remote-debugging browser launches, and replay of stolen sessions from new IPs in identity logs.
Detection
Detection logic for clipboard hijackers and crypto clippers: clipboard-listener behaviour, wallet-address patterns in binaries and a clipboard canary test.
Detection
Detection logic for Discord and chat-app token theft: leveldb Local Storage reads, non-Discord processes touching app profile paths, and token abuse follow-up.
Detection
Detection logic for RedLine stealer behaviours: .NET profiling, browser and wallet store access, VPN and FTP file theft, temp staging and self-deletion.
Detection
Detection logic for Lumma (LummaC2) stealer: ClickFix Run-dialog delivery, loader chains, browser and extension data theft, and dead-drop C2 resolution.
Detection
Detection logic for StealC stealer: library DLL staging from its server, browser and wallet theft, configurable file grabbing, and HTTP POST exfiltration.
Detection
Detection logic for infostealer exfiltration: archive creation in temp paths, large HTTP POSTs from unsigned processes, and first-seen destination analysis.
Detection
Detection logic for credential files at rest: KeePass .kdbx, SSH keys and AWS credentials, using auditd, Windows auditing and discovery command hunting.
Detection
Detection logic for crypto wallet theft: wallet.dat and desktop wallet directories, browser-extension wallet storage, and the grabber sweeps stealers use.
Detection
Detection logic for Telegram Bot API exfiltration: api.telegram.org lookups from non-Telegram processes, DNS hunting, proxy path matching and egress controls.
Detection
Detection logic for loaders that fetch or inject stealers: payload download, hollowing into .NET hosts like RegAsm and MSBuild, and their network connections.
Detection
Detection logic for infostealer and loader persistence: Run keys and scheduled tasks to user-writable paths, re-infection patterns and stolen-session persistence.
Detection
How to use stealer-log exposure data defensively: matching leaked accounts, devices and sessions to your estate, forcing resets and finding the infected host.
Detection
Detection logic for malicious email attachments: Office and PDF readers spawning shells, execution from the Outlook cache and gateway signals.
Detection
Detection logic for HTML smuggling: JavaScript Blob payload assembly, gateway content rules, blob-origin downloads and follow-on execution.
Detection
Detection logic for disk-image delivery: mounted ISO and IMG files, executables and shortcuts run from a new virtual drive, and mark-of-the-web gaps.
Detection
Detection logic for malicious Windows shortcuts: LNK files launching powershell, cmd or LOLBins from explorer, oversized or padded shortcuts, and delivery paths.
Detection
Detection logic for macro document abuse: Office spawning script hosts, TrustRecords writes after Enable Content and internet-macro policy checks.
Detection
Detection logic for OneNote attachment abuse: embedded scripts and executables, onenote.exe spawning interpreters, the OneNote export temp path and gateway rules.
Detection
Detection logic for QR-code phishing: image-only emails and PDFs carrying QR codes, URL extraction at the gateway, and mobile sign-in signals after delivery.
Detection
Detection logic for open-redirect and link-wrapping abuse: nested URL parameters, reputable-domain redirectors, double-wrapped security links and final-hop analysis.
Detection
Detection logic for ClickFix and fake CAPTCHA lures: RunMRU commands, explorer-spawned powershell or mshta, clipboard one-liners and hardening.
Detection
Detection logic for callback phishing: payload-free invoice lures with a phone number, message-shape hunting, and the remote-access tooling installed after the call.
Detection
Detection logic for ZIP concatenation and malformed archives: multiple end-of-central-directory records, parser disagreement, nested archives and gateway handling.
Detection
Detection logic for phishing through SVG attachments: embedded script, foreignObject HTML forms, redirects and browser-launched SVG files.
Detection
Detection logic for email spoofing: SPF, DKIM and DMARC results, header mismatches, lookalike domains and display-name impersonation.
Detection
Detection logic for credential-harvest pages: brand impersonation, newly registered domains, certificate-transparency watching and AiTM sign-in signals.
Detection
Detection logic for OAuth consent phishing: risky delegated scopes, first-seen apps consented by several users, admin-consent abuse and Entra audit log queries.
Detection
Detection logic for AiTM phishing and stolen session cookie reuse: session ID reuse across IPs, token anomaly risk events, post-compromise inbox rules and KQL.
Detection
Detection logic for MFA fatigue: bursts of denied or unanswered push prompts followed by an accept, Entra and Okta log queries, and user-reported fraud signals.
Detection
Detection logic for impossible travel: geo-velocity between successive sign-ins, new country and ASN baselines, VPN noise handling and Entra SigninLogs queries.
Detection
Detection logic for Golden SAML: AD FS token-signing key theft, DKM container access, cloud sign-ins without AD FS issuance and AD FS configuration changes.
Detection
Detection logic for leaked or stolen AWS access keys: new source IPs, regions and user agents per key, enumeration bursts, GuardDuty findings and Athena queries.
Detection
Detection logic for AWS log tampering: StopLogging, DeleteTrail, event selector changes, S3 and KMS tampering on log stores, and missing-log heartbeats.
Detection
Detection logic for cloud IAM privilege escalation: policy attachment, policy version abuse, AssumeRole chains and Entra privileged role assignments.
Detection
Detection logic for service principal abuse in Entra ID: added client secrets and certificates, new sign-ins from unfamiliar IPs and privileged app role grants.
Detection
Detection logic for Conditional Access tampering in Entra ID: policy disable or delete, new exclusions, named location expansion and authentication method changes.
Detection
Detection logic for federation backdoors: new federated domains, domain authentication changes, added identity providers, and cross-tenant access modifications.
Detection
Detection logic for Okta compromise: admin role grants, MFA factor resets, helpdesk social engineering, impersonation, API token creation and policy changes.
Detection
Detection logic for Google Cloud IAM abuse: SetIamPolicy changes, service account key creation and impersonation, with log filters and BigQuery SQL.
Detection
Detection logic for OAuth app persistence in Entra ID: attacker-registered apps, long-lived credentials, offline_access grants, Graph abuse and app inventory review.
Detection
Detection logic for large outbound volume: per-host bytes-out baselines, new-destination weighting and size-capped transfers across firewall and Zeek telemetry.
Detection
Detection logic for exfiltration to consumer cloud storage: uploads to Mega, Dropbox and Google Drive from non-browser processes, proxy telemetry and CASB signals.
Detection
Detection logic for rclone and MEGAcmd abuse: process command lines, renamed binaries, rclone.conf artifacts and the network pattern of bulk cloud sync.
Detection
Detection logic for bulk data egress over DNS: encoded payload volume per zone, label length and entropy, record-type mix and query-rate ceilings.
Detection
Detection logic for exfiltration over FTP, FTPS and SFTP: outbound sessions from non-service hosts, command-line clients, WinSCP scripting and Zeek ftp.log uploads.
Detection
Detection logic for email exfiltration: inbox forwarding and redirect rules, mailbox-level forwarding, large attachments to personal addresses, and delegate abuse.
Detection
Detection logic for data staging: 7-Zip, WinRAR and tar invocations with passwords or wildcards, large archives in unusual paths, and split volumes ahead of egress.
Detection
Detection logic for exfiltration over webhooks and paste services: Discord, Slack and Telegram posts and paste endpoints called by non-browser clients.
Detection
Detection logic for per-user and per-host data-volume anomalies: UEBA-style egress baselining, peer-group comparison and seasonal series decomposition.
Detection
Detection logic for S3 exfiltration: GetObject bursts from CloudTrail data events, public-bucket changes, anomalous IAM principals and GuardDuty findings.
Detection
Detection logic for database dumping: mysqldump, pg_dump and bcp invocations, bulk SELECT row counts, sqlcmd exports and abnormal reads by application accounts.
Detection
Detection logic for removable-media exfiltration: USB mass-storage mounts, large file copies to removable drives, device-control events and insider-risk context.
Detection
Detection logic for steganographic exfiltration: image uploads with trailing data, size anomalies, stego tool execution and the limits of content analysis.
Detection
Detection logic for low-and-slow exfiltration: cumulative per-destination volume, small periodic uploads, rate-limited transfers and scheduled egress windows.
Detection
Detection logic for Kerberoasting: Event 4769 RC4 service-ticket bursts, one account requesting many SPNs, honeytoken service accounts and hardening checks.
Detection
Detection logic for AS-REP roasting: Event 4768 with pre-authentication type 0, accounts with the no-preauth flag, and the UAC change that sets it.
Detection
Detection logic for DCSync: Event 4662 with DS-Replication-Get-Changes GUIDs from non-DC accounts, DRSUAPI DRSGetNCChanges from unexpected IPs and permission grants.
Detection
Detection logic for DCShadow: temporary nTDSDSA registration in the Configuration partition, replication SPNs on non-DC computers, DRS RPC from unexpected hosts.
Detection
Detection logic for silver tickets: Kerberos logons with no matching 4769 on the DC, RC4 for AES accounts, odd 4624 fields and service-account hardening.
Detection
Detection logic for NTLM relay: 4624 type 3 NTLM logons where workstation and source IP disagree, machine accounts from odd hosts, coercion pipes, signing gaps.
Detection
Detection logic for AD CS ESC1: 4886 and 4887 certificate issuance, requester versus SAN mismatch, PKINIT logons on the DC and template misconfiguration changes.
Detection
Detection logic for AD CS ESC8: relayed NTLM POSTs to certsrv and CES endpoints, machine-account requests from the wrong IP, PKINIT follow-on and EPA hardening.
Detection
Detection logic for GPO abuse: 5136 and 5137 changes to groupPolicyContainer and gPLink, SYSVOL writes of tasks and scripts, and change-control correlation.
Detection
Detection logic for LAPS abuse: Event 4662 reads of ms-Mcs-AdmPwd and Windows LAPS attributes, over-broad read rights, and bulk password retrieval by one account.
Detection
Detection logic for SharpHound collection: Event 1644 expensive LDAP searches, SMB session and SAMR enumeration bursts, local-group queries and collector artifacts.
Detection
Detection logic for unconstrained delegation abuse: new TrustedForDelegation flags, DC logons to non-DC hosts, printer-bug coercion and TGT replay.
Detection
Detection logic for AD ACL abuse: 5136 nTSecurityDescriptor changes on sensitive objects, GenericAll and WriteDACL grants, AdminSDHolder edits, 4662 WRITE_DAC.
Detection
Detection logic for DPAPI backup key theft: MS-BKRP RPC to a DC, 4662 reads of BCKUPKEY secret objects, protected_storage pipe access and the response impact.
Detection
Detection logic for IIS web shells: w3wp.exe spawning cmd or PowerShell, new .aspx files in web roots, and anomalous request patterns in IIS logs.
Detection
Detection logic for Exchange web shells: aspnet_client and OWA/ECP auth drops, OAB virtual directory tampering, and w3wp.exe or UMWorkerProcess.exe children.
Detection
Detection logic for generic ASPX web shells: eval and Request item patterns, process and reflection APIs, base64 handling, and file creation in web paths.
Detection
Detection logic for PHP web shells: eval and base64_decode patterns, Apache or Nginx child processes, new .php files in upload paths, and auditd telemetry.
Detection
Detection logic for JSP and Java web shells: Tomcat spawning shells, .jsp drops under webapps, Runtime.exec patterns, and in-memory filter shells.
Detection
Detection logic for China Chopper: the one-line server stub, base64 POST parameters from the client, response markers, and file and log hunts.
Detection
Detection logic for Behinder and Godzilla web shells: default AES keys, default HTTP headers, cookie and response quirks, and host-side behaviour.
Detection
Detection logic for VPN and SSL-VPN appliance exploitation: anomalous admin sessions, configuration export, new accounts and session anomalies.
Detection
Detection logic for Citrix NetScaler exploitation: nsppe crashes, shell drops, session token reuse, and the CVE-2023-3519 and CVE-2023-4966 patterns.
Detection
Detection logic for FortiOS and FortiGate exploitation: crafted SSL-VPN requests, daemon crashes, config and admin changes, and outbound anomalies.
Detection
Detection logic for Ivanti Connect Secure: the CVE-2023-46805 and CVE-2024-21887 chain, traversal requests, integrity checker results and process anomalies.
Detection
Detection logic for abnormal web server behaviour: web processes spawning LOLBins, rare child processes, unexpected network and file activity, baselines.
Detection
Detection logic for unexpected DMZ and edge egress: servers beaconing out, reverse shells, tool downloads, non-standard ports and policy violations.
Detection
How to hunt web shells at scale: scheduled YARA scans of web roots, entropy and line-length heuristics, provenance checks and a triage workflow.
Detection
Detection logic for UAC bypass: fodhelper, computerdefaults, eventvwr and sdclt hijacks of HKCU registry keys, auto-elevate lineage and integrity-level jumps.
Detection
Detection logic for access token manipulation: Event 4624 logon type 9, 4672 and 4703 privilege events, SYSTEM process token access and impersonated children.
Detection
Detection logic for the Potato family: PrintSpoofer spoolss pipe impersonation, DCOM and OXID abuse, SYSTEM children of service accounts and SeImpersonate abuse.
Detection
Detection logic for unquoted service path privilege escalation: osquery inventory, executables planted at intermediate path segments and services.exe launching them.
Detection
Detection logic for AlwaysInstallElevated MSI abuse: HKLM and HKCU policy keys, quiet msiexec installs from user paths and SYSTEM shells spawned by the installer.
Detection
Detection logic for weak service permission abuse: sc config binPath, ImagePath edits, Event 7045 and 4697 service installs and writable service binaries.
Detection
Detection logic for sudo misconfiguration abuse on Linux: sudo -l enumeration, GTFOBins shell escapes, NOPASSWD rules, sudoers edits and auth.log patterns.
Detection
Detection logic for SUID and SGID abuse on Linux: find -perm enumeration, chmod setuid creation, GTFOBins SUID execution and auditd euid transitions.
Detection
Detection logic for kernel exploit privesc: oops logs, module and driver loads, temp-path staging and unexplained SYSTEM or root transitions.
Detection
Detection logic for PrintNightmare and spooler abuse: spoolsv.exe child processes, DLLs in spool driver paths, Point and Print settings and PrintService events.
Detection
Detection logic for DLL hijacking privilege escalation: elevated processes loading unsigned DLLs from writable directories, phantom DLL plants and Sysmon 7.
Detection
Detection logic for scheduled task privilege escalation: SYSTEM tasks with user-writable actions, Event 4698 and 4702, and inventory audits.
Detection
Detection logic for PATH interception and writable service-directory privilege escalation: ACL audits, PATH changes and planted binaries.
Detection
Detection logic for Linux capabilities abuse: getcap enumeration, setcap changes, cap_setuid on interpreters and setuid(0) calls from user sessions.
Detection
Detection logic for ransomware encryption: high-rate file writes and renames from one process, new-extension bursts and entropy rise.
Detection
Detection logic for volume shadow copy deletion: vssadmin, wmic, diskshadow, PowerShell and shadow storage resizing, with Sigma rules and tuning advice.
Detection
How to deploy and monitor canary and decoy files for ransomware: placement, Windows file auditing, FSRM file screens, SIEM alerting and active response.
Detection
Detection logic for ransom note drops: one process writing the same small text or HTML file into hundreds of directories, plus wallpaper and printer-spam indicators.
Detection
Detection logic for ransomware boot configuration tampering: bcdedit recoveryenabled, bootstatuspolicy, safe mode boot and recovery environment changes.
Detection
Detection logic for pre-encryption service and process kills: net stop, sc config, taskkill and Stop-Service against databases, backup, mail and security tools.
Detection
Detection logic for affiliates who disable EDR before encrypting: vulnerable driver loads, kernel service creation and security process kills.
Detection
Detection logic for exfil-before-encrypt: bulk archiving, rclone and cloud-sync uploads, large egress to storage services and staging directories.
Detection
Detection logic for ESXi ransomware: SSH and shell enablement, esxcli VM process kill, vim-cmd enumeration, VMDK encryption and the host logs to forward.
Detection
Detection logic for Linux ransomware: auditd rules for bulk file writes and renames in /home and /var, cron persistence, chmod sweeps and process behaviour.
Detection
Detection logic for inhibiting recovery: wbadmin catalog and backup deletion, restore point disabling, backup agent targeting and a combined pre-encryption chain.
Detection
Detection logic for LockBit ransomware: affiliate tradecraft, StealBit exfiltration, GPO and SMB spread, shadow copy and service stops.
Detection
Detection logic for Akira ransomware: VPN entry, remote tooling, credential theft, exfiltration, PowerShell shadow deletion and ESXi encryptors.
Detection
Detection logic for BlackCat/ALPHV ransomware: Rust cross-platform encryptor, fsutil and SMB setting changes, PsExec spread and exfiltration.
Detection
Detection logic for AMSI bypass: AmsiScanBuffer patching, amsiInitFailed reflection, provider registry tampering and PowerShell downgrade.
Detection
Detection logic for ETW tampering: EtwEventWrite patching, provider and autologger disable, audit policy changes and telemetry silence.
Detection
Detection logic for Windows event log clearing: Security 1102, System 104, wevtutil cl, Clear-EventLog and log forwarding that preserves evidence.
Detection
Detection logic for process hollowing: suspended starts, NtUnmapViewOfSection, remote WriteProcessMemory, SetThreadContext and lineage anomalies.
Detection
Detection logic for herpaderping, doppelganging and ghosting: Sysmon 25, delete-pending files and image-versus-disk hash comparisons.
Detection
Detection logic for parent PID spoofing: real-creator versus reported-parent mismatch in kernel ETW and PROCESS_CREATE_PROCESS handle access.
Detection
Detection logic for EDR unhooking and syscall evasion: fresh ntdll copies, syscall stubs outside ntdll, KnownDlls abuse and call-stack anomalies.
Detection
Detection logic for living-off-the-land binaries: certutil, mshta, bitsadmin and msiexec abuse, argument patterns and rarity hunting with LOLBAS.
Detection
Detection logic for BYOVD: Sysmon 6, service installs 7045 and 4697, LOLDrivers hash matching, blocklist enforcement and security-tool termination.
Detection
Detection logic for timestomping: Sysmon Event 2, $STANDARD_INFORMATION versus $FILE_NAME mismatches, zeroed sub-seconds and USN journal evidence.
Detection
Detection logic for disabling Microsoft Defender: Set-MpPreference, exclusions, registry and service changes, Events 5001 and 5007, tamper alerts.
Detection
Detection logic for rundll32 and regsvr32 proxy execution: squiblydoo, scrobj.dll, javascript: handlers, ordinal calls and comsvcs MiniDump.
Detection
Detection logic for MSBuild and InstallUtil abuse: inline task project files, uninstall handlers, csc.exe child compilations and unexpected parents.
Detection
Detection logic for NTFS alternate data streams: Sysmon Event 15, non-Zone.Identifier streams, execution from streams and dir /r enumeration.
Detection
Detection logic for Run/RunOnce registry persistence and Startup folder drops: Sysmon 13 value sets, user-writable payload paths, script hosts and unusual writers.
Detection
Detection logic for scheduled task persistence: Event 4698, Task Scheduler Operational events, suspicious actions, SYSTEM tasks and hidden tasks.
Detection
Detection logic for Windows service persistence: Events 7045 and 4697, auto-start services with odd ImagePaths, driver installs, PsExec-style services.
Detection
Detection logic for WMI permanent event subscriptions: Sysmon 19/20/21, WMI-Activity Event 5861, consumer types and scrcons.exe or WmiPrvSE child processes.
Detection
Detection logic for DLL sideloading persistence: unsigned DLLs loaded by signed executables from user-writable folders, phantom DLLs and relocated binaries.
Detection
Detection logic for COM hijacking persistence: HKCU CLSID overrides shadowing HKLM entries, InprocServer32 and TreatAs writes, and unsigned DLL loads.
Detection
Detection logic for pre-OS persistence: bcdedit tampering, Event 4826, raw disk access (Sysmon 9), ESP bootloader changes, Secure Boot state and UEFI implants.
Detection
Detection logic for Kerberos golden tickets: 4769 without a matching 4768, RC4 downgrade, abnormal ticket lifetimes, nonexistent accounts and krbtgt remediation.
Detection
Detection logic for DC persistence: DsrmAdminLogonBehavior changes, Event 4794, DSRM account logons, LSASS patching, mimidrv driver loads and RC4 downgrade.
Detection
Detection logic for sethc/utilman replacement, IFEO Debugger values, SilentProcessExit, application shim databases (sdbinst) and AppInit_DLLs persistence.
Detection
Detection logic for Linux persistence: crontab and cron.d changes, systemd units and timers, rc.local, shell profile edits, with auditd rules and fleet hunts.
Detection
Detection logic for SSH key persistence: writes to ~/.ssh/authorized_keys, unknown key fingerprints in sshd logs, sshd_config changes and osquery key inventory.
Detection
Detection logic for Office persistence: Normal.dotm and STARTUP templates, add-in registry keys, XLL and WLL files, and Outlook rules, forms and home page.
Detection
Detection logic for malicious browser extensions: force-install policies, unpacked extensions, --load-extension launches, risky permissions and sideloaded manifests.
Detection
Detection logic for PsExec and clones: remote service installs (Event 7045/4697), binary drops to ADMIN$, PSEXESVC pipes and renamed variants.
Detection
Detection logic for WMI lateral movement: WmiPrvSE child processes, Win32_Process Create, WMI-Activity events 5857/5861 and ADMIN$ output files.
Detection
Detection logic for smbexec: services whose ImagePath runs cmd.exe /Q /c through %COMSPEC%, temporary .bat files and command output staged on a share.
Detection
Detection logic for pass-the-hash: type 3 NTLM logons (4624, NtLmSsp), 4776 validations, Kerberos-expected accounts using NTLM and fan-out to many hosts.
Detection
Detection logic for pass-the-ticket and overpass-the-hash: 4768/4769 anomalies, RC4 encryption downgrade, tickets used from the wrong host and Kerberos type 3 logons.
Detection
Detection logic for RDP lateral movement: type 10 logons (4624), TerminalServices 1149 and 21/25, internal RDP from non-admin hosts and tscon session hijack.
Detection
Detection logic for WinRM and PowerShell Remoting: wsmprovhost.exe children, type 3 logons to 5985/5986, WinRM/Operational events and script block logging.
Detection
Detection logic for DCOM lateral movement: mmc.exe and explorer.exe spawning children after a remote activation, RPC to port 135 and process-tree anomalies.
Detection
Detection logic for remote scheduled tasks: Event 4698 from a network logon, schtasks /s, Task Scheduler Operational 106 and 200, and atsvc pipe access.
Detection
Detection logic for admin share abuse: Event 5140/5145, executable writes to ADMIN$ and C$ from remote sessions, IPC$ named pipe access and SMB telemetry.
Detection
Detection logic for SSH lateral movement: auth.log accepted logins from internal hosts, new authorized_keys entries, key reuse across hosts and agent hijacking.
Detection
Detection logic for remote service creation: Event 7045 and 4697 with suspicious ImagePaths, rare service names, shell-based binary paths and source correlation.
Detection
Detection logic for remote registry abuse: RemoteRegistry service starts, winreg pipe access over IPC$, remote reg.exe usage and SAM, SYSTEM and SECURITY hive saves.
Detection
How to build source-to-destination logon graphs from Event 4624 and Kerberos data, baseline edges, flag first-time admin pairs and score fan-out and paths to tier 0.
Detection
Detection logic for Cobalt Strike Beacon: default and malleable profile artifacts, named pipes, process injection, sleep-mask memory and known JA3/JARM fingerprints.
Detection
Detection logic for BishopFox Sliver: default mTLS/JARM fingerprints, HTTP C2 URIs, large Go implant binaries, named pipes and process behaviour.
Detection
Detection logic for the Havoc framework and its Demon implant: default HTTP headers/URIs, sleep obfuscation, indirect syscalls and known JARM fingerprints.
Detection
Detection logic for the Mythic framework and agents (Apollo, Medusa, Poseidon): HTTP/websocket profiles, default URIs, and host artifacts across Windows, Linux and macOS.
Detection
Detection logic for DNS-based command and control: high-entropy subdomains, record-type anomalies, query volume per zone, and NXDOMAIN patterns.
Detection
Detection logic for domain fronting: SNI vs Host header mismatch, high-reputation CDN edges hiding C2, and TLS/HTTP inspection strategies.
Detection
How to use JA3/JA3S and the newer JA4+ TLS fingerprints to detect C2 clients and servers, their strengths, and why they must be combined with other signals.
Detection
How to use JARM active TLS-server fingerprinting with Shodan/Censys and certificate pivots to proactively hunt Cobalt Strike, Sliver and other C2 infrastructure.
Detection
How to detect C2 beacons by statistical timing analysis: inter-arrival variance, jitter modelling, data-size consistency, and FFT/autocorrelation approaches with Zeek and RITA.
Detection
How malleable C2 profiles shape Cobalt Strike traffic, which default and public profiles leave detectable URIs/headers, and how to hunt profile artifacts on the wire.
Detection
Detection logic for SMB/named-pipe peer-to-peer C2 links used by Cobalt Strike and others: Sysmon 17/18 pipe events, default pipe names and lateral beacon chains.
Detection
Detection logic for C2 that rides trusted SaaS: Telegram, Slack, Discord, GitHub/Gists, Google/Dropbox, and Pastebin, using behaviour and API-usage anomalies.
Detection
Detection logic for covert C2 over ICMP, raw TCP/UDP and other non-HTTP protocols: payload size/entropy, echo-reply anomalies and protocol-mismatch hunting.
Detection
How to proactively find and pre-emptively block C2 infrastructure using newly-registered domains, certificate transparency, passive DNS, Shodan/Censys and hosting patterns.
Threat Brief
MTAC brief: multiple critical RCE/privilege-escalation/auth-bypass flaws in HPE ClearPass Policy Manager (NAC); CVSS ~9.8, patches released 12 Oct 2026.
Threat Brief
MTAC brief: destructive ransomware on IDCF Cloud (Japan) causing permanent data loss for 495 client organizations; supply-chain and cloud-resilience implications.
Threat Brief
MTAC brief: CVE-2026-21589 (CVSS 9.8) unauthenticated arbitrary file read in Atlassian Jira/Confluence/Bitbucket Data Center; 89 IPs exploiting in the wild since 7 Oct 2026 (CrowdSec).
Threat Brief
MTAC brief: CVE-2026-97229 (CVSS 10.0) integer overflow in GitLab CE/EE CI/CD Regular Expression Compiler enables remote code execution; patched in 19.4.2. Vendor and CERT-EU advisories issued.
Threat Brief
MTAC brief: a critical (CVSS 9.8+) authentication-bypass and RCE vulnerability across eight Atlassian products is being actively exploited in the wild since early October 2026. Patches released 7 Oct 2026.
Detection
Detection logic for C2 beaconing: periodicity/jitter analysis, JA3 fingerprints, named-pipe and default-profile artifacts across Cobalt Strike, Sliver, Havoc and Empire.
Detection
Detection logic for lateral movement: remote service creation, WMI process spawns, RDP, admin-share writes and pass-the-hash/ticket across Impacket and PsExec.
Detection
Detection logic for persistence mechanisms: run keys, scheduled tasks, services, WMI event subscriptions, startup folders and BITS jobs.
Detection
Detection logic for data exfiltration: rclone/MEGA uploads, staging archives, large outbound transfers and DNS tunneling before ransomware or extortion.
Detection
Detection logic for tunneling and proxying: Chisel banners, ngrok/cloudflared signatures, SOCKS pivoting and fast-flux DNS.
Detection
Detection logic for infostealers: browser credential/cookie store access, LSASS reads, macOS Keychain theft and crypto-wallet file access.
Detection
Detection logic for the moves that precede encryption: shadow-copy deletion, backup tampering, recovery disabling and mass file operations.
Detection
Detection logic for phishing payload execution: Office spawning interpreters, ISO/IMG mounts, LNK/HTA abuse and ClickFix clipboard-to-run chains.
Detection
Detection logic for local privilege escalation: UAC-bypass registry patterns, token manipulation, vulnerable-driver loads and SeDebug abuse.
Detection
Detection logic for defense evasion: event-log clearing, AMSI/ETW bypass, EDR tampering, obfuscated PowerShell and timestomping.
Detection
How to turn threat intel into detections with Sigma, YARA and KQL; the pyramid of pain, telemetry you need, and where to get vetted rules.
Detection
Detection logic for the core AD attacks: Kerberoasting (4769 RC4), DCSync (4662 replication), NTLM relay/coercion, and AD CS abuse.
Detection
Detection logic for identity-first attacks: AiTM/token replay, OAuth consent grants, and cloud IAM abuse (IMDS, role changes, S3 SSE-C).
Detection
Detection logic for the ransomware kill chain: living-off-the-land, BYOVD/EDR-kill, ESXi lockers and macOS stealer activity.
Detection
Detection logic for edge-device intrusions: web shells on VPNs/firewalls, config tampering, and lateral-movement artifacts (ADMIN$, Chisel).
Breach
Case study of Cl0p's 2023 mass exploitation of a MOVEit Transfer zero-day (CVE-2023-34362) to steal data from hundreds of organisations.
Breach
Case study of the 2024 campaign against Snowflake customer tenants: stolen infostealer credentials, no MFA, and bulk data theft by UNC5537.
Breach
Case study of CVE-2024-3094: a multi-year maintainer takeover planted an sshd backdoor in the xz/liblzma library, caught by luck before it hit stable Linux.
Breach
Case study of the September 2023 MGM and Caesars breaches: Scattered Spider help-desk vishing, the ALPHV/BlackCat link and ~$100M impact.
Breach
Case study of the March 2023 3CX softphone trojanization (SmoothOperator), the first supply-chain attack shown to stem from another supply-chain attack (X_TRADER).
Platform-Specific
Android banking trojan (aka TeaBot/Toddler) delivered via Play Store dropper apps; overlay, accessibility abuse and on-device fraud.
Platform-Specific
Cloud-native attacks against AWS/Azure/GCP and SaaS: leaked access keys, IMDS SSRF, IAM privilege escalation and S3 ransomware; Scattered Spider, EMERALDWHALE, Codefinger.
Platform-Specific
The dominant macOS infostealer, sold as malware-as-a-service; steals the Keychain, browser data and crypto wallets via fake password prompts and ClickFix lures.
Platform-Specific
Ransomware targeting VMware ESXi and Linux servers: ESXiArgs, CVE-2024-37085, and the ESXi lockers of Akira, Black Basta, LockBit, RansomHub and Play.
Threat Brief
Why hospitals are prime ransomware targets, the Change Healthcare and Ascension incidents, the groups hitting the sector, and defensive priorities.
Threat Brief
Threats to operational technology and ICS: Volt Typhoon pre-positioning, CyberAv3ngers PLC attacks, FrostyGoop and Fuxnet, and insecure-by-design exposure.
Threat Brief
The multi-vector threat to banks, insurers and fintech: ransomware, hacktivist DDoS, help-desk social engineering, third-party risk and DPRK crypto theft.
Threat Brief
Key judgments from the Canadian Centre for Cyber Security's National Cyber Threat Assessment 2025-2026: ransomware, state adversaries and critical-infrastructure risk.
Threat Brief
The dominant themes going into 2026: identity and session attacks, infostealers, edge-device exploitation, ransomware-as-login, AI-enabled threats and state espionage.
Vulnerability
Exploitation of Citrix NetScaler ADC/Gateway: CVE-2023-3519 RCE, the Citrix Bleed session-token theft (CVE-2023-4966), and Citrix Bleed 2 (CVE-2025-5777).
Vulnerability
Exploitation of the Cisco IOS XE Web UI (CVE-2023-20198 + CVE-2023-20273) to create privileged accounts and deploy Lua webshell implants at scale.
Vulnerability
Exploitation of SonicWall firewalls (CVE-2024-40766) by Akira and Fog ransomware, and the UNC6148 campaign against end-of-life SMA 100 appliances with the OVERSTEP rootkit.
Vulnerability
Successive Ivanti Connect Secure zero-days (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282, CVE-2025-22457) exploited by UNC5221 with the SPAWN and BRICKSTORM implants.
Vulnerability
Exploited FortiOS SSL-VPN flaws (CVE-2024-21762, XORtigate) and the FortiManager FortiJump bug (CVE-2024-47575); Volt Typhoon and the Belsen Group config leak.
Vulnerability
Exploitation of PAN-OS: the CVE-2024-3400 GlobalProtect unauth RCE (Operation MidnightEclipse) and the CVE-2025-0108 management-interface auth bypass.
AI Threat
How attackers use AI-generated video and cloned voices to impersonate executives and authorise fraudulent transfers; the Arup ~US$25.6M case.
AI Threat
How LLMs write clean, localised, personalised phishing and BEC lures at scale, erasing the spelling and grammar tells defenders relied on.
AI Threat
How direct and indirect prompt injection makes LLM copilots and agents follow attacker instructions hidden in data; OWASP LLM01, ATLAS AML.T0051.
AI Threat
The criminal 'dark LLM' market (WormGPT, FraudGPT) and documented nation-state abuse of mainstream models; what is real versus hype.
AI Threat
How adversaries actually use AI in 2024-2026, what is hype versus real, and the frameworks (ATLAS, OWASP, NIST, CISA/NCSC) that structure the defence.
Technique
How SIM-swap fraud ports a victim's number to an attacker SIM to intercept SMS OTPs and defeat MFA; used by LAPSUS$ and Scattered Spider.
Technique
How NTLM relay plus coercion (PetitPotam, PrinterBug, Coercer) forwards authentication to SMB, LDAP or AD CS for privilege escalation; ntlmrelayx.
Technique
How attackers steal and replay session cookies, OAuth tokens and Primary Refresh Tokens to inherit authenticated sessions and bypass MFA.
Technique
How Bring Your Own Vulnerable Driver abuses signed-but-vulnerable kernel drivers to disable EDR before ransomware; AuKill, EDRKillShifter, POORTRY.
Technique
How Kerberoasting requests Kerberos service tickets for SPN accounts and cracks them offline; RC4 downgrade; Rubeus, GetUserSPNs.
Technique
How DCSync abuses directory-replication rights to pull password hashes (including KRBTGT) from a DC remotely, without touching LSASS; Mimikatz, secretsdump.
Technique
How living-off-the-land (LOTL) attacks abuse legitimate built-in binaries (PowerShell, certutil, WMI, PsExec) to evade detection; Volt Typhoon's playbook.
Technique
How illicit OAuth consent grants trick users into authorising a malicious app for durable, password-reset-proof access to M365/Google; APT29's playbook.
Technique
How attackers rig search rankings and buy malicious ads to push trojanised installers; Gootloader, BATLOADER, fake-installer stealer campaigns.
Technique
How AiTM phishing kits like Evilginx, Tycoon 2FA and EvilProxy reverse-proxy the real login to steal session cookies and bypass MFA.
Technique
How push-bombing / MFA fatigue attacks spam approval prompts until a user accepts; used by Lapsus$ and Scattered Spider. Number matching is the key defence.
Technique
How QR-code phishing (quishing) moves the malicious link out of email body text and onto a personal mobile device beyond corporate controls.
Technique
How telephone-oriented attack delivery (TOAD) / callback phishing uses fake invoices and a phone number to talk victims into installing remote-access tools; BazarCall, Luna Moth.
Technique
How misconfigured Active Directory Certificate Services (the ESC escalation paths from Certified Pre-Owned) let low-privilege users mint certificates and become domain admin.
Technique
How fast-flux DNS (single and double flux) rapidly rotates the IPs behind a domain to make botnet and C2 infrastructure resilient to takedown; flagged by a 2025 government advisory.
APT
China-aligned espionage group (G1054, aka Earth Kasha) hitting Japanese and Taiwanese government and defence targets with LODEINFO, ANEL and NOOPDOOR.
APT
Long-running China-aligned espionage group (G0141) behind the Gelsevirine backdoor, now operating the WolfsBane and FireWood Linux implants.
APT
PRC state-sponsored espionage cluster (Trend Micro) overlapping Salt Typhoon/GhostEmperor/FamousSparrow; telecom targeting with GHOSTSPIDER and the Demodex rootkit.
APT
Suspected China-nexus actor (CrowdStrike) targeting telecom providers with CordScan and GSM-emulating C2 to collect subscriber metadata.
APT
DPRK-nexus operation (CrowdStrike) running fraudulent remote-IT-worker schemes and the Contagious Interview malware lures (BeaverTail, InvisibleFerret).
APT
DPRK RGB-linked crypto-theft cluster (US-gov codename; overlaps Jade Sleet/UNC4899) behind the DMM Bitcoin and other exchange heists via job-lure social engineering.
APT
China-nexus espionage cluster (Mandiant) exploiting Ivanti zero-days and deploying the SPAWN ecosystem and BRICKSTORM backdoor on appliances that cannot run EDR.
APT
Suspected India-nexus espionage group (G0129, aka APT-C-35) targeting South Asian governments and militaries with the yty framework, Firebird backdoor and Android spyware.
APT
Russian FSB Center 16 cluster (Cisco Talos) exploiting Cisco Smart Install and SNMP on end-of-life network devices for long-term espionage.
Tools & Frameworks
Open-source reverse-shell C2 framework (t3l3machus) packaged in Kali; HTTP-beacon shells via HoaxShell.
Tools & Frameworks
Open-source Go post-exploitation C2 using HTTP/2 and HTTP/3; abused by UAC-0154 against Ukrainian agencies.
Tools & Frameworks
Abuse of cloudflared / TryCloudflare tunnels for malware delivery (AsyncRAT/XWorm) and persistent stealthy access.
Tools & Frameworks
Open-source PowerShell/Python post-exploitation C2 (MITRE S0363); BC Security fork with Starkiller GUI, used by Turla, APT33, APT41 and MuddyWater.
Tools & Frameworks
Open-source Python protocol toolkit (MITRE S0357, Fortra); secretsdump/wmiexec/psexec/ntlmrelayx abused in AD intrusions and CISA advisory AA22-277A.
Tools & Frameworks
Open-source Go TCP/UDP tunnel over HTTP+SSH (jpillora); abused to pivot through edge devices (Talos UAT-9686, PYSA). Not the same as Infamous Chisel.
Malware
Quasar/AsyncRAT-derived commodity .NET RAT bundled with hVNC, a stealer and a keylogger.
Malware
Highly evasive in-memory .NET RAT (2025) targeting healthcare and pharma via localized phishing.
Malware
China-nexus (UNC5221) Go backdoor targeting network appliances and VMware ESXi for long-dwell espionage.
Malware
Windows proxy botnet turning infected PCs into SOCKS5 exit nodes sold via the PROXY.AM service.
Malware
Residential-proxy botnet that enrols compromised routers and IoT devices to feed the NSOCKS proxy service.
Malware
Peer-to-peer Golang botnet that brute-forces SSH and mines Monero in memory; 2024 variant added Log4Shell spread.
Malware
Python cloud-credential botnet (MITRE S1092) that scrapes exposed .env files; subject of a CISA/FBI advisory.
Malware
Modular cross-platform botnet (MITRE S0458) that mines Monero and self-propagates via stolen creds and EternalBlue.
Malware
Modular self-updating botnet (MITRE S0457) that uses the Bitcoin blockchain as a takedown-resistant C2 fallback.
Malware
Long-running modular MaaS loader (MITRE S0226) with a plugin framework; disrupted in Operation Endgame 2024.
Malware
Shellcode downloader (MITRE S0561, aka CloudEyE) with aggressive anti-analysis; pulls encrypted payloads from cloud storage.
Malware
Modular loader (IDAT Loader / GHOSTPULSE) that hides payloads in PNGs and runs via DLL sideloading; favored by Lumma and ClickFix.
Malware
JavaScript loader (Gootkit lineage) spread by SEO poisoning of legal-document searches; a ransomware on-ramp.
Malware
Loader-as-a-service (EugenLoader / NUMOZYLOD) spread via malvertising and signed MSIX installers.
Malware
2025 loader with a GPU-executing packer (Armoury) and call-stack spoofing; distributed by SmokeLoader.
Malware
Highly evasive shellcode loader delivered by targeted phishing; near-zero AV detection, drops Cobalt Strike.
Malware
Long-running MaaS stealer and form-grabber (MITRE S1207); rebranded as the cross-platform XLoader with a macOS build.
Malware
macOS infostealer MaaS (2024) targeting browsers, wallets and the Keychain; source leaked in November 2024.
Malware
macOS stealer built on the Atomic (AMOS) codebase, spread via malvertising; later rebranded Odyssey.
Malware
Go-based macOS stealer MaaS (2024) that dumps the Keychain and MetaMask; collapsed after an affiliate exit scam.
Malware
MaaS stealer that hides its C2 behind dead-drop resolvers on trusted sites; rebranded as Amatera.
Malware
Rust stealer with multi-stage PowerShell delivery, a mock-trusted-directory UAC bypass and Telegram telemetry.
Malware
XFiles-derived MaaS stealer delivered via fake Google Authenticator ads and ClickFix + HijackLoader chains.
Malware
Open-source .NET stealer delivered by exploiting CVE-2023-36025, a Windows SmartScreen/Mark-of-the-Web bypass.
Malware
Subscription MaaS stealer with polymorphic strings and a custom TCP C2 that later moved to HTTP; also a loader.
Malware
2025 stealer seeded through fake AI video-generator sites on Facebook; Telegram C2, optional XWorm.
Malware
Fake-CAPTCHA copy-paste social engineering that makes users run attacker commands (MITRE T1204.004).
APT
Russia-nexus device-code phishing that abuses the OAuth device flow to bypass MFA; a Midnight Blizzard sub-cluster.
APT
High-volume Russia-affiliated cloud espionage using stolen credentials, Evilginx AitM and Microsoft Graph.
Tools & Frameworks
RansomHub's BYOVD EDR-killer that drops a vulnerable signed driver to disable endpoint security.
Ransomware
Ransomware using compromised VPN access to encrypt virtualized infrastructure and destroy backups.
Malware
Prolific MaaS infostealer; StealC V2 reworked its C2 and defeats browser cookie encryption.
Malware
Outlook and Thunderbird email-credential stealer operated by Hive0145 via invoice phishing.
Malware
.NET keylogger and stealer (404 / Kraken) with SMTP, FTP and Telegram exfiltration.
Ransomware
Hive-descended RaaS that pivoted to the data-extortion brand World Leaks.
Ransomware
Emerging ransomware variant targeting enterprise environments
Tools & Frameworks
Modern open-source C2 framework
Malware
Cross-platform Java RAT
Malware
Premium .NET keylogger and stealer
Executive briefing on Akira ransomware, a Conti syndicate successor responsible for over $42 million in damages across 250+ organizations in its first year.
Malware
Lightweight loader and reconnaissance bot
Malware
Japanese-themed loader
Malware
Weaponized remote admin tool
Malware
Open-source Android RAT
Platform-Specific
Android banking trojan
Platform-Specific
Android banking trojan
Platform-Specific
Android banking trojan
Malware
Analysis of emerging Android threats
Platform-Specific
Android banking trojan
Platform-Specific
Android remote code execution malware
Platform-Specific
Android surveillance RAT
Chinese state-linked group conducting dual espionage and financial cybercrime operations, notorious for supply chain compromises and the ShadowPad backdoor.
Long-running Chinese APT using the custom Bisonal RAT to target military and government organizations across East Asia and Eastern Europe.
South Asian APT targeting government and military organizations in Pakistan, Bangladesh, and China with custom downloaders and RATs via spearphishing.
Iranian IRGC-affiliated APT conducting sophisticated social engineering and credential harvesting campaigns against academics, journalists, and government officials worldwide.
APT
Advanced APT targeting Southeast Asian governments with rootkit-level persistence, kernel-mode implants, and cloud-based exfiltration via Dropbox and OneDrive.
Russian FSB-linked APT from occupied Crimea conducting high-volume, persistent espionage operations against Ukrainian government and military organizations.
APT
Highly sophisticated Chinese APT deploying kernel-level rootkits and advanced anti-forensic techniques to maintain persistent access in telecom and government networks.
Financially motivated APT targeting fintech and cryptocurrency companies using the Golden Chickens MaaS suite and custom JavaScript malware.
North Korean intelligence-gathering APT specializing in social engineering against South Korean policy experts, defectors, and academics with credential harvesting and custom backdoors.
North Korea's most prolific APT group, responsible for the Sony hack, WannaCry, Bangladesh Bank heist, and billions in cryptocurrency theft to fund the DPRK weapons program.
Chinese APT targeting Southeast Asian government and military organizations with custom backdoors, leveraging diplomatic-themed lures and strategic watering hole attacks.
APT
Chinese-linked APT conducting targeted espionage campaigns against Tibetan activists, Japanese aerospace entities, and Indian military organizations.
China MSS-affiliated APT targeting managed service providers to pivot into client networks, conducting massive intellectual property theft across defense, healthcare, and aerospace sectors.
Iranian MOIS-subordinate APT conducting espionage across the Middle East using custom C2 frameworks, heavy PowerShell usage, and living-off-the-land techniques.
Chinese APT targeting European and Asian government organizations and NGOs with PlugX variants and custom backdoors via USB propagation and spearphishing.
North Korean APT conducting dual espionage and ransomware operations against defense, energy, and healthcare sectors using custom implants and opportunistic vulnerability exploitation.
Indian-linked APT targeting Pakistan and China with copy-paste code from multiple sources, known for occasionally infecting their own systems with their own malware.
APT
Lebanon-based, Iran-backed APT exclusively targeting Israeli organizations using OneDrive for C2 and a suite of custom 'Creepy' implants.
APT
Chinese APT targeting ASEAN government ministries using the RoyalRoad RTF weaponizer and custom Soul framework for long-term espionage operations.
APT
Central Asian APT targeting government entities and embassies in the region with PowerShell-based implants and Telegram bot infrastructure for C2.
Russia GRU military intelligence APT responsible for DNC hack, WADA breach, NotPetya, and persistent targeting of NATO governments and elections infrastructure worldwide.
APT
Chinese APT closely related to Mustang Panda, targeting European diplomatic missions and the Vatican with PlugX and custom malware via carefully crafted spearphishing campaigns.
Pakistan-linked APT persistently targeting Indian military and government with CrimsonRAT, fake romance apps, and Android malware for espionage operations.
Threat cluster operating Cuba ransomware with custom loaders and kernel driver exploits, targeting critical infrastructure and government organizations for double extortion.
Chinese-nexus APT exploiting CVE-2023-2868 in Barracuda Email Security Gateway appliances to deploy custom backdoors across government and critical infrastructure globally.
Chinese threat actor blending espionage with cybercrime, exploiting Ivanti, F5, and Atlassian vulnerabilities using open-source C2 frameworks to target defense and research institutions.
Analysis of unattributed advanced persistent threat clusters that don't match known APT groups, featuring novel TTPs and infrastructure that defy conventional classification.
Operator of the Golden Chickens MaaS suite providing more_eggs backdoor to FIN6, Cobalt Group, and Evilnum, targeting corporate HR departments via fake job applications.
Chinese state-sponsored APT conducting espionage against defense, aerospace, and government sectors worldwide using custom backdoors and supply chain attacks.
Breach & Campaigns
Cisco ASA/FTD zero-day exploitation
Malware
Open-source .NET RAT
Malware
Go-based information stealer
Malware
Backdoor malware
Malware
AutoIt-scripted malware family
Malware
Commercial .NET RAT
Malware
Information stealer targeting browser data and crypto wallets
Analysis of Bad Rabbit ransomware, a modified variant of Not Petya targeting Ukraine and Russia via drive-by downloads and SMB propagation.
Malware
Clipboard-hijacking banking malware
Malware
Brazilian banking trojan downloader
Malware
TrickBot successor loader
Malware
Brazilian banking trojan
Ransomware
Go-based ransomware turned data extortion group
Malware
Legacy RAT with modern revival
Malware
Low-cost MaaS RAT
Ransomware
Ransomware group exploiting Exchange/ESXi vulnerabilities
Ransomware
BlackSuit ransomware group analysis: a rebranded Royal ransomware from the Conti gang targeting healthcare, education, and critical infrastructure.
Malware
Information stealer loader
Malware
Commercial adversary simulation framework
Malware
Cuba ransomware downloader
Malware
Go-based cross-platform RAT
MTAC threat intelligence report analyzing 22,705 hostile activities from 3,321 Chinese source IPs targeting 4 countries, with attribution to APT10, APT27, Mustang Panda, APT41, and Volt Typhoon.
Exploit Kits
Fake browser update framework
Deep analysis of Cobalt Strike, the commercial red team framework exploited by APT29, APT41, Conti, and LockBit. Covers Beacon payloads, Malleable C2, Operation Morpheus, and defense strategies.
How Lapsus$, ShinyHunters, and Scattered Spider merged into one of the most brazen cybercrime collectives, and what it means for enterprise security.
How APT groups like Imperial Kitten, APT33, and MuddyWater execute sustained cyberattacks, and Mjolnir Security's approach to countering them.
Tools & Frameworks
Open-source .NET C2 framework
Malware
Unauthorized cryptocurrency mining
Breach & Campaigns
Analysis of CVE-2025-10035, a critical CVSS 10.0 vulnerability in Fortra GoAnywhere MFT, and its strategic implications for Canadian businesses.
Malware
Modular banking trojan
Malware
Emerging downloader malware
Malware
Premium MaaS loader
Analysis of DcRAT (Dark Crystal RAT), the $5-7 .NET MaaS RAT with 34 plugins, dedicated IDE, and usage by threat actors targeting Ukrainian defense. Covers YouTube distribution, plugin ecosystem, and
Tools & Frameworks
Lightweight Go-based C2
Malware
Custom APT backdoor
Malware
Dual-payload loader
Malware
Prolific banking trojan
Malware
Classic file infector
Platform-Specific
Linux cryptocurrency mining malware
Platform-Specific
Linux IoT botnet
Malware
Emerging Linux threats analysis
Malware
Infamous IoT DDoS botnet
Platform-Specific
Linux reverse SSH backdoor
Platform-Specific
Linux backdoor malware
Malware
Script-based loader chain
Malware
Modular botnet and loader
Tools & Frameworks
Adversary-in-the-middle phishing framework
Malware
Fake application malware
Malware
Classic credential stealer and downloader
APT
Financially motivated threat group specializing in payment card theft from POS systems and e-commerce platforms, responsible for millions of stolen card numbers across retail and hospitality.
Prolific eCrime group responsible for over $1 billion in theft, evolving from POS malware to ransomware affiliate operations while operating a fake pentesting company (Combi Security, Bastion Secure).
Malware
File infector trojan
Malware
Delphi-based RAT
Malware
Chinese-origin RAT with decades of use
Malware
Go-based brute force tool
Tools & Frameworks
Open-source phishing framework
Malware
LATAM banking trojan
Breach & Campaigns
SAP NetWeaver exploitation campaign
Breach & Campaigns
SolarWinds supply chain compromise
Tools & Frameworks
Hak5 device management platform
Tools & Frameworks
Modern open-source C2 framework
Ransomware
Ransomware-as-a-Service disrupted by FBI infiltration
Malware
VBS-based worm RAT
Malware
Banking trojan turned loader
Tools & Frameworks
OOB interaction testing tool
Ransomware
Ransomware targeting FreeBSD and critical infrastructure
Malware
Emerging loader malware
Intelligence update on Iranian cyber threats post-Operation Epic Fury. Expect destructive wipers, ICS/SCADA attacks, and AI-enabled influence operations.
An anthropological and geopolitical analysis of Iranian state-sponsored APT groups weaponizing cyberspace against North American critical infrastructure.
Exploit Kits
Traffic distribution system abused by threat actors
Malware
Banking trojan
Malware
Modular financial trojan
Analysis of Latrodectus, the Windows malware loader succeeding IcedID with advanced sandbox evasion, AES-256 encryption, and ClickFix social engineering. Covers TA577/TA578, Operation Endgame survival
Tools & Frameworks
Tunneling/pivoting tool
Malware
Open-source .NET RAT
Ransomware
Most prolific RaaS operation before Operation Cronos
Malware
AutoIt-based RAT
Malware
Widely distributed information stealer
Tools & Frameworks
Rising MaaS stealer replacing RedLine
Malware
E-commerce card skimmer
Ransomware
Emerging ransomware targeting Latin American organizations
Malware
Backdoor trojan
Malware
MaaS loader
Ransomware
Persistent RaaS targeting healthcare and education
Malware
RedLine fork with shared infrastructure
Tools & Frameworks
Premier penetration testing framework
Tools & Frameworks
Windows credential extraction tool
Malware
LATAM banking trojan and stealer
Chinese threat group targeting defense and high-tech organizations using spear-phishing and custom backdoors since at least 2008.
Iranian threat actor conducting destructive wiper attacks and ransomware operations primarily against Israeli targets, masking espionage with sabotage.
Iranian threat group active since 2010, targeting defense industrial base and Iranian dissidents using social engineering and custom malware.
Russian threat group targeting electric utility organizations in the US and UK, focused on ICS reconnaissance and maintaining persistent access.
Chinese-speaking APT active since 2013 targeting government, education, and telecom organizations across Southeast Asia and Australia.
North Korean sub-group of Lazarus focused on cryptocurrency theft through trojanized trading applications and supply chain attacks.
Middle Eastern threat group conducting surveillance and espionage against military and government targets across the region since 2012.
Spanish-speaking threat group targeting Colombian and Ecuadorian government, financial, and energy organizations with commodity RATs.
PLA Unit 61398 threat group that systematically stole hundreds of terabytes of data from at least 141 organizations across 20 industries since 2006.
Chinese threat group targeting media organizations, high-tech companies, and government entities since at least 2009.
China-based group targeting Japanese and Taiwanese organizations, particularly media and government entities.
Chinese threat group exploiting zero-day vulnerabilities and using legitimate websites for C2 to target US government and defense organizations.
Chinese group responsible for the massive 2015 healthcare breach stealing 78.8 million patient records, also targeting aerospace and defense.
Chinese group targeting law firms and investment companies, known for using strategic web compromises and zero-day exploits.
Russian SVR intelligence group responsible for the SolarWinds supply chain attack affecting 18,000+ organizations. One of the most sophisticated APTs globally.
Chinese MSS-affiliated group (Boyusec) conducting espionage through zero-day exploits and strategic web compromises, indicted by US DOJ in 2017.
Chinese APT conducting long-running espionage operations since 2005 targeting ASEAN member states and India with air-gapped network infiltration capabilities.
Vietnamese state-sponsored group targeting private sector, foreign governments, and journalists with sophisticated custom malware and social engineering.
Iranian group targeting aerospace and energy sectors globally, linked to destructive attacks using Shamoon wiper and password spraying campaigns.
North Korean group primarily targeting South Korean organizations using zero-day exploits, strategic web compromises, and mobile malware.
North Korean group focused on financial theft, responsible for the $81M Bangladesh Bank heist and attacks on banks across 11+ countries via SWIFT.
Iranian MOIS-affiliated group focused on surveillance of individuals through telecom and travel industry compromise since 2014.
Iranian IRGC-IO group conducting credential harvesting and surveillance against journalists, activists, and Western government officials.
Chinese APT targeting telecommunications and technology organizations, known for exploiting Pulse Secure VPN and Citrix vulnerabilities.
Chinese threat group conducting intelligence collection and industrial espionage using Log4Shell and other vulnerabilities since 2020.
Chinese state-sponsored group conducting large-scale cyber espionage against government and critical infrastructure worldwide since 2008.
Chinese APT targeting ministries of foreign affairs and telecoms in Africa, Middle East, and Central Asia with custom backdoors.
Middle Eastern threat actor using zero-day exploits (particularly Flash) for surveillance against UN officials, journalists, and activists.
Chinese state-sponsored group targeting Japan and Taiwan, known for modifying router firmware to maintain persistent access to networks.
Financially motivated group exploiting web application vulnerabilities to deploy Monero cryptocurrency miners on Windows systems.
Threat group deploying Android surveillance malware targeting military personnel in Middle Eastern countries.
Chinese espionage group conducting intellectual property theft from Japanese defense and technology organizations since 2006.
Financially motivated group that stole over $1 billion from banks worldwide by compromising internal banking systems and manipulating ATMs.
Chinese threat group targeting semiconductor and airline industries for intellectual property theft, using Cobalt Strike and custom DLL loaders.
Chinese group deploying ransomware (HUI Loader, Cobalt Strike) potentially as cover for espionage, cycling through multiple ransomware families.
Iranian group conducting Operation Cleaver targeting critical infrastructure across 16 countries including military, energy, and aviation.
Financially motivated group targeting banks worldwide through ATM jackpotting and SWIFT transaction manipulation using Cobalt Strike.
Indian-origin APT conducting espionage against Pakistani military and government targets using mobile and desktop malware.
North Korean campaign targeting software developers through fake job interviews to deliver malware that steals cryptocurrency and credentials.
Iranian group targeting Israeli and German government and academic organizations using custom malware and strategic web compromises.
Iranian group building elaborate fake social media personas to establish trust with targets before delivering malware over months-long engagements.
IRGC-affiliated group targeting water treatment facilities and industrial control systems, notably hacking Unitronics PLCs in the US.
Chinese APT active since 2012 targeting telecoms and government in Africa and Asia, known for MgBot malware and macOS capabilities.
Lebanese intelligence-linked group conducting global mobile surveillance campaign stealing data from Android devices across 21+ countries.
APT targeting business executives and government officials through hotel Wi-Fi networks, using zero-days and stolen certificates since 2007.
Threat group targeting Middle Eastern government and education with custom tools leveraging open-source offensive frameworks.
Financially motivated group physically planting rogue devices (Raspberry Pi, Bash Bunny) inside bank offices for network penetration.
Chinese group responsible for the 2015 Anthem healthcare breach (80M records) and targeting US government personnel databases.
Russian FSB group targeting Western energy and nuclear facilities since 2011, gaining operational access to ICS/SCADA systems.
Chinese group targeting Japanese and Taiwanese high-tech and manufacturing organizations with commodity and custom malware.
Chinese group blending espionage with financially motivated attacks, targeting government and tech sectors through web-facing server exploitation.
Chinese group behind 2009 Operation Aurora targeting Google and 20+ companies, pioneering zero-day supply chain attacks.
Russian GRU group conducting destructive operations against Ukraine using WhisperGate wiper and defacing government websites before the 2022 invasion.
Highly sophisticated group (attributed to NSA TAO) active since 2001, using HDD firmware implants and air-gap jumping capabilities.
Financially motivated group targeting fintech and cryptocurrency companies with JavaScript-based malware and social engineering.
Initial access broker using elaborate business proposal phishing with custom file-sharing services to deliver BazarLoader and ransomware.
Iranian group targeting domestic dissidents and Persian-speaking individuals with MarkiRAT surveillance malware since 2015.
Financially motivated group extorting Canadian organizations with threats to leak stolen data, active 2013-2016.
Financially motivated group conducting slow, stealthy intrusions in Latin American banks to manipulate financial transactions over months.
Group targeting healthcare and M&A advisory firms to steal insider trading information from corporate email accounts.
Financially motivated group stealing payment card data from hospitality and restaurant point-of-sale systems since 2008.
Financially motivated group conducting POS malware campaigns against retail and hospitality organizations since 2016.
Iranian group acting as initial access broker, exploiting VPN vulnerabilities (Pulse Secure, Fortinet, F5) and selling access to ransomware operators.
Chinese group targeting global telecommunications providers to conduct surveillance, exploiting public-facing web servers for initial access.
Espionage group using living-off-the-land techniques exclusively, avoiding custom malware to target government and military organizations.
Financially motivated group using legitimate penetration testing tools to transfer money from banks, capping at amounts below alert thresholds.
Ransomware group operating the REvil/Sodinokibi Ransomware-as-a-Service, responsible for Kaseya supply chain attack affecting 1,500+ businesses.
Pakistani threat group conducting both espionage and criminal operations using commodity RATs distributed through spear-phishing.
Threat group targeting the Syrian opposition using commercial RATs and social engineering over social media platforms.
Chinese state-sponsored group exploiting Microsoft Exchange ProxyLogon zero-days (CVE-2021-26855) to compromise 30,000+ organizations globally.
Iranian group targeting Middle Eastern and African telecoms and oil companies using DNS tunneling and custom .NET backdoors.
Group targeting North Korean government interests and Chinese organizations using LNK file-based attacks and DLL side-loading.
Ransomware group active since 2023 targeting healthcare and education with double extortion, known for publishing stolen data on leak sites.
Sophisticated group using cloud services for C2 and targeting government organizations in Russia and Central Asia since 2012.
Chinese group targeting Central Asian government entities using Dropbox and other cloud services as C2 infrastructure.
Russian cybercrime group behind Dridex, BitPaymer, WastedLocker, and Hades ransomware. Leader Maksim Yakubets has $5M FBI bounty.
Chinese group targeting diplomatic missions and government organizations worldwide since 2010, known for Ketrican and Okrum backdoors.
Threat group targeting airline industry and IATA members using KOCTOPUS loader and Empire framework since 2018.
Iranian group targeting Middle Eastern government and business organizations using publicly available tools and vulnerability scanning.
Chinese MSS-directed (Hainan province) group targeting maritime, defense, and aviation. Indicted by US DOJ in 2021 for global espionage campaign.
Chinese-speaking group targeting Southeast Asian government entities with USB spreading malware and Zoom installer hijacking.
Spanish-speaking group conducting espionage against Latin American military and government institutions since 2010.
Brazilian threat group distributing banking trojans targeting Latin American financial institutions through malspam campaigns.
Ransomware group operating Medusa RaaS since 2022, using double extortion and a public Tor-based leak site for victim data.
Highly sophisticated group targeting telecoms and ISPs using multi-layered malware platforms with years-long persistence.
Chinese group associated with military interests targeting US defense organizations with custom malware.
Chinese espionage group targeting government and critical infrastructure in Myanmar and other countries using ShimRat malware.
Palestinian group conducting espionage against Israeli and Middle Eastern targets using social engineering and commodity RATs since 2012.
North Korean group using fake companies, trojanized software, and custom ransomware (FakePenny) to fund DPRK operations.
Iranian group conducting destructive attacks against Israeli organizations, encrypting systems without providing decryption capability.
Belarusian group targeting foreign embassies in Belarus using ISP-level adversary-in-the-middle attacks for malware delivery.
Initial access broker distributing SocGholish fake browser updates to deliver ransomware and other payloads to compromised websites.
Chinese PLA-linked group conducting espionage against Southeast Asian government and military targets since 2005.
Group using zero-day exploits and FinFisher surveillance software to target individuals in Turkey.
Group targeting Central Asian diplomatic and government entities using custom Android and Windows malware.
Iranian MOIS group conducting espionage across the Middle East since 2014 using DNS tunneling, custom tools, and social engineering.
Group targeting healthcare organizations and their supply chain to access patient data and medical device information.
Chinese group targeting defense and telecom sectors using Gh0st RAT and Troj/Reader-AJ since 2011.
Sophisticated group using hotpatching for fileless execution and targeting South Asian government and ISP organizations.
Ransomware group active since 2022 using double extortion, known for exploiting FortiOS and Microsoft Exchange vulnerabilities.
Brazilian group conducting targeted attacks to steal proprietary information and blackmail victims into hiring them as security consultants.
Turkish-linked group targeting Kurdish and opposition groups by trojanizing legitimate software installers with surveillance capabilities.
Chinese PLA Unit 61486 group targeting US defense and space sectors to steal satellite and aerospace technology.
Chinese group targeting Southeast Asian government entities using PLAINTEE and DDKONG malware families.
Group conducting stealthy corporate espionage targeting HR and legal departments to steal internal documents and business intelligence.
Chinese group targeting Indian power grid infrastructure with ShadowPad malware, potentially pre-positioning for disruptive operations.
Chinese group deploying cryptocurrency miners at scale on compromised Linux and cloud servers, evading detection by killing competing miners.
Russian cybercrime group targeting Russian banking organizations to steal funds through manipulated accounting software transactions.
Russian group targeting Ukrainian and Georgian government organizations with destructive payloads during the Russia-Ukraine conflict.
Russian GRU Unit 74455 responsible for NotPetya ($10B damage), BlackEnergy grid attacks, Olympic Destroyer, and ongoing Ukraine cyber operations.
Chinese group targeting Uyghur and Tibetan minority activists using mobile and desktop surveillance malware.
Group conducting DNS hijacking campaigns targeting government and telecom organizations across the Middle East and North Africa.
Pakistani group mimicking Sidewinder TTPs to target Indian military and defense organizations with custom RATs.
Indian APT targeting Pakistan and China military and government since 2012, one of the most active APTs by volume of operations.
Russian-speaking group targeting financial organizations and ATM systems primarily in CIS countries, stealing millions via ATM jackpotting.
Iranian group conducting credential harvesting campaigns against 300+ universities in 30+ countries to steal academic research and IP.
Nigerian cybercrime group conducting business email compromise (BEC) campaigns responsible for billions in global losses.
Espionage group targeting South American and Southeast Asian foreign affairs ministries using Felismus backdoor.
Russian FSB group conducting credential phishing against academics, defense officials, and NGOs to collect intelligence since 2017.
UAE-linked group conducting surveillance against dissidents, journalists, and activists using sophisticated spyware.
Financially motivated group pivoting from on-premises to cloud, deploying Embargo ransomware against US organizations.
Financially motivated group abusing Microsoft Quick Assist remote support tool for social engineering to deploy Black Basta ransomware.
Highly sophisticated group using air-gap-defeating modular malware platform active since 2011, discovered by Kaspersky in 2016.
Chinese group using stolen code signing certificates to attack Indian government and commercial organizations.
Persistent threat group targeting aviation and defense industries since 2017 using commodity RATs via large-scale phishing campaigns.
Chinese group targeting Central Asian military and government using exploits for Microsoft Office vulnerabilities.
Major cybercrime group distributing Dridex, Locky, Clop ransomware, and FlawedAmmyy at massive scale via Necurs botnet.
Malware distribution group using thread-hijacked email campaigns to deliver IcedID, QakBot, and Ursnif banking trojans.
Prolific initial access broker distributing QakBot and Pikabot via thread-hijacked email campaigns at high volume.
Initial access broker using contact form and callback phishing to deliver BazarLoader, Bumblebee, and Latrodectus.
Cloud-focused group targeting misconfigured Docker and Kubernetes environments to deploy cryptocurrency miners and steal credentials.
Russian group behind TRITON/TRISIS malware targeting Schneider Electric Triconex safety systems, capable of causing physical destruction.
Sophisticated group targeting Pakistani military and nuclear program with malware designed to evade 8+ antivirus products.
Threat group targeting financial organizations using SWIFT manipulation techniques to conduct fraudulent transactions.
Chinese group targeting satellite operators, telecoms, and defense organizations in Southeast Asia and the US.
Sophisticated Chinese APT targeting government and military in Asia and Europe since 2020, using custom loaders and passive backdoors.
Chinese group targeting military and government organizations in Russia, South Korea, and Japan using Bisonal and ShadowPad.
Chinese group targeting Taiwanese and Philippine government and military organizations with custom USB-spreading malware since 2011.
Russian FSB group active since 1996, one of the most sophisticated APTs using satellite-based C2 and hijacking other APT infrastructure.
Chinese group exploiting zero-days in VMware and Fortinet appliances to maintain persistent access to hypervisors and network edge devices.
Iranian group conducting espionage operations against Middle Eastern government and telecommunications organizations.
Chinese group maintaining years-long persistence in F5 BIG-IP and other network appliances, demonstrating exceptional operational stealth.
Lebanese group targeting military and telecom organizations across the Middle East and beyond using Explosive RAT since 2012.
Chinese state-sponsored group pre-positioning in US critical infrastructure (energy, water, telecom, ports) for potential disruption during geopolitical crisis.
Group targeting Philippine government organizations using spear-phishing and custom malware since 2022.
Group responsible for the 2018 SingHealth breach stealing 1.5 million patient records including the Singapore Prime Minister's data.
Operation Windigo compromised 25,000+ Linux servers for spam distribution, click fraud, and malware delivery since 2011.
Group conducting surveillance against specific individuals in the Middle East using macOS and mobile malware.
Russia-aligned group exploiting Zimbra and Roundcube zero-days to target European government and NATO-aligned diplomatic entities.
Middle Eastern group linked to Gaza Cybergang conducting espionage against government and diplomatic entities in the region.
Russian cybercrime group behind TrickBot, Conti, Ryuk, and BazarLoader - one of the most prolific ransomware operations generating $200M+ in revenue.
Chinese MSS-affiliated group (Wuhan Xiaoruizhi) targeting government and technology organizations worldwide, indicted by US DOJ in 2024.
Tools & Frameworks
Extensible multi-platform C2 framework
Malware
Widely-used .NET RAT
Tools & Frameworks
Weaponized remote admin tool
Malware
Cross-platform commercial RAT
Tools & Frameworks
Commercial advanced C2 platform
Tools & Frameworks
Emerging C2 framework
Analysis of NjRAT (Bladabindi), the leaked-source .NET RAT active since 2012 with keylogging, MBR wiping, USB worm, and DDoS capabilities. Covers Group5, SideCopy, Dev Tunnels abuse, and defense strat
Malware
Excessive failed DNS resolution abuse
Malware
Information-gathering RAT
Malware
Surveillance-focused RAT
Ransomware
TOR-based ransomware
Malware
Commercial RAT disguised as admin tool
Malware
JavaScript-based loader
Malware
macOS information stealer
Platform-Specific
Rust-based macOS backdoor
Malware
Emerging backdoor
Malware
Emerging MaaS RAT
Malware
IRC-based Perl backdoor
Tools & Frameworks
MuddyWater custom C2
Malware
Chinese APT backdoor
Malware
Classic Chinese APT RAT
Malware
PowerShell-based malware delivery
Malware
Open-source Python RAT
Malware
Budget information stealer
Tools & Frameworks
Evasion-focused C2 framework
Malware
Python-based malware delivery
Malware
Long-running banking botnet
Malware
Proxy backdoor
Deep dive into Qilin ransomware: a Russian-origin RaaS operation targeting healthcare, manufacturing, and critical infrastructure with double extortion.
Malware
Open-source .NET RAT
Malware
MaaS information stealer
Ransomware
Threat analysis of RansomHub, from ALPHV's exit scam to the most prolific RaaS operation of 2024, and its hostile takeover by DragonForce.
Breach & Campaigns
Mass exploitation campaign
Malware
Java-based open-source RAT
Analysis of RedLine Stealer, the MaaS infostealer responsible for 51% of all infostealer infections, its Operation Magnus takedown, and defense strategies.
Malware
Commercial surveillance RAT
Tools & Frameworks
LLMNR/NBT-NS/mDNS poisoner
Tools & Frameworks
Retro-themed C2 RAT
Malware
Free .NET RAT
Malware
Advanced C++ information stealer
Ransomware
Ransomware group targeting healthcare and government
Malware
PrivateLoader-distributed stealer
Malware
Weaponized Remote Utilities
Malware
DNS hijacking and manipulation
Ransomware
0Apt is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
0Mega is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
8Base is a prolific double extortion group active since 2022 with a Tor-based leak site. This profile covers the group's operations, tactics, known campaigns, a
Ransomware
Abrahams Ax is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Abyss is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Adminlocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Againstthewest is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics,
Ransomware
Agl0Bgvycg is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Ailock is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Ako is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known campa
Ransomware
Alphalocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Alphv is a also known as BlackCat, first Rust-based RaaS, FBI seized infrastructure in Dec 2023. This profile covers the group's operations, tactics, known camp
Ransomware
Anubis is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Apos is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Apt73 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Arcusmedia is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Argonauts is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Arkana is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Arvinclub is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Atomsilo is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Avaddon is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Avos is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Avoslocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Aware is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Aztroteam is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Babuk is a leaked source code spawned dozens of variants, targeted DC Metropolitan Police. This profile covers the group's operations, tactics, known campaigns,
Ransomware
Babuk2 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Babyduck is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Beast is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Benzona is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Black Basta is a emerged from Conti dissolution, over 500 victims worldwide since Apr 2022. This profile covers the group's operations, tactics, known campaigns
Ransomware
BlackCat is a also known as ALPHV, Rust-based RaaS with triple extortion, FBI disrupted Dec 2023. This profile covers the group's operations, tactics, known cam
Ransomware
Blacklock is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Blackmatter is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Blacknevas is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Blackout is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Blackshadow is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Blackshrantac is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, k
Ransomware
Blacktor is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Bluebox is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Bluelocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Bluesky is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Bonacigroup is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Bqtlock is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Braincipher is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Bravox is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Brotherhood is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Cactus is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Cephalus is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Cheers is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Chilelocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Chort is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Cicada3301 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Ciphbit is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Cipherforce is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Cl0p is a exploited MOVEit, GoAnywhere, Accellion for mass data theft affecting 2,500+ orgs. This profile covers the group's operations, tactics, known campaign
Ransomware
Cloak is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Coinbasecartel is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics,
Ransomware
Contfr is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Conti is a Russian-linked RaaS generating $180M+ before dissolution in 2022, leaked internal chats. This profile covers the group's operations, tactics, known c
Ransomware
Cooming is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Crazyhunter is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Crosslock is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Cry0 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Crylock is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Cryp70N1C0D3 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Cryptbb is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Cryptnet is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Crypto24 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Cuba is a exploited Veeam and Microsoft Exchange, linked to COLDDRAW threat actor. This profile covers the group's operations, tactics, known campaigns, and def
Ransomware
Cyclops is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
D4Rk4Rmy is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Dagonlocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Daixin is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Dan0N is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Darkangels is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Darkbit is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Darkleakmarket is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics,
Ransomware
Darkpower is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Darkrace is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Darkside is a responsible for Colonial Pipeline attack, caused US fuel supply disruption. This profile covers the group's operations, tactics, known campaigns,
Ransomware
Darkvault is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Datacarry is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Datakeeper is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Dataleak is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Desolator is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Devman is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Diavol is a linked to Wizard Spider/TrickBot operators. This profile covers the group's operations, tactics, known campaigns, and defensive recommendations.
Ransomware
Direwolf is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Dispossessor is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Donex is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Donutleaks is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Doppelpaymer is a evolved from BitPaymer, targeted critical infrastructure. This profile covers the group's operations, tactics, known campaigns, and defensive
Ransomware
Dragonforce is a Malaysian hacktivist-turned-ransomware group. This profile covers the group's operations, tactics, known campaigns, and defensive recommendatio
Ransomware
Dragonransomware is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics
Ransomware
Dread is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Dunghill is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Ech0Raix is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Eldorado is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Embargo is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Entropy is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Ep918 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Everest is a data extortion group that also sells initial access. This profile covers the group's operations, tactics, known campaigns, and defensive recommenda
Ransomware
Exorcist is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Fletchen is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Flocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Fog is a targets education and recreation sectors via compromised VPN credentials. This profile covers the group's operations, tactics, known campaigns, and def
Ransomware
Frag is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Freecivilian is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Fsteam is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Funksec is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Gdlockersec is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Genesis is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Grief is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Groove is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Gunra is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Hades is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Handala is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Haron is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Hellcat is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Helldown is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Hellogookie is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Hellokitty is a cross-platform ransomware that targeted CD Projekt Red and others. This profile covers the group's operations, tactics, known campaigns, and def
Ransomware
Holyghost is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Hotarus is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Hunters is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Icefire is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Imncrew is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Insane is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Insomnia is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Kairos is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Karakurt is a data extortion without encryption, linked to Conti. This profile covers the group's operations, tactics, known campaigns, and defensive recommenda
Ransomware
Karma is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Kawa4096 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Kazu is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Kelvinsecurity is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics,
Ransomware
Killsec is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Kittykatkrew is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Knight is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Kraken is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Kryptos is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Kyber is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
La Piovra is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Lapsus$ is a teenage extortion group that breached Microsoft, Nvidia, Samsung, Uber. This profile covers the group's operations, tactics, known campaigns, and d
Ransomware
Leaktheanalyst is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics,
Ransomware
Lilith is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Linkc is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Lockdata is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Lolnek is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Lorenz is a exploits Mitel VoIP vulnerabilities for initial access. This profile covers the group's operations, tactics, known campaigns, and defensive recommen
Ransomware
Losttrust is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Lunalock is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Madcat is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Madliberator is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Malas is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Malekteam is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Mallox is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Marketo is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Maze is a pioneered double extortion model in 2019. This profile covers the group's operations, tactics, known campaigns, and defensive recommendations.
Ransomware
Meow is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Metaencryptor is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, k
Ransomware
Midas is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Mindware is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Minteye is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Mogilevich is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Moneymessage is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Monti is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Morpheus is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Mountlocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Ms13089 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Mydecryptor is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
N3Tworm is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Nasirsecurity is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, k
Ransomware
Nefilim is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Nemty is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Netwalker is a RaaS disrupted by FBI in Jan 2021, operator sentenced. This profile covers the group's operations, tactics, known campaigns, and defensive recomm
Ransomware
Nevada is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Nightsky is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Nightspire is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Nitrogen is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Noescape is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Nokoyawa is a exploited Windows CLFS zero-day CVE-2023-28252. This profile covers the group's operations, tactics, known campaigns, and defensive recommendation
Ransomware
Noname is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Nova is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Obscura is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Onepercent is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Orion is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Osiris is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Pandora is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Pay2Key is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Payload is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Payloadbin is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Payoutsking is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Pear is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Projectrelic is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Prolock is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Prometheus is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Promptlock is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Pysa is a also known as Mespinoza, targets education and healthcare. This profile covers the group's operations, tactics, known campaigns, and defensive recomme
Ransomware
Qiulong is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Qlocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Quantum is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Rabbithole is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Radar is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Radiant is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Ragnarlocker is a law enforcement seized infrastructure Oct 2023. This profile covers the group's operations, tactics, known campaigns, and defensive recommenda
Ransomware
Ragnarok is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Ralord is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Ramp is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Rancoz is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Ranion is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Ransombay is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Ransomcartel is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Ransomcortex is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Ransomed is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Ransomexx is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Ransomhouse is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Ranstreet is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Ranzy is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Raworld is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Raznatovic is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Rebornvc is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Redalert is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Redransomware is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, k
Ransomware
Revil is a also known as Sodinokibi, attacked Kaseya and JBS, multiple arrests. This profile covers the group's operations, tactics, known campaigns, and defens
Ransomware
Reynolds is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Robinhood is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Rook is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Royal is a evolved into BlackSuit, linked to former Conti members. This profile covers the group's operations, tactics, known campaigns, and defensive recommend
Ransomware
Runsomewares is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Sabbath is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Safepay is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Sarcoma is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Satanlockv2 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Secp0 is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Securotrop is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Sensayq is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Shadow is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Shadowbyt3$ is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Shaoleaks is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Shinyhunters is a data breach and extortion group that hit AT&T, Ticketmaster via Snowflake. This profile covers the group's operations, tactics, known campaign
Ransomware
Shinysp1D3R is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Sicarii is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Siegedsec is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Silentransomgroup is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactic
Ransomware
Sinobi is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Slug is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Solidbit is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Spacebears is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Sparta is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Spook is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Stormous is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Sugar is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Suncrypt is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Synack is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Teamxxx is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Tengu is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Termite is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Thegentlemen is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kn
Ransomware
Thegreenbloodgroup is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tacti
Ransomware
Threeam is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Toufan is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Tridentlocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, k
Ransomware
Trigona is a exploited MSSQL servers for initial access. This profile covers the group's operations, tactics, known campaigns, and defensive recommendations.
Ransomware
Trinity is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Trisec is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
U-Bomb is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Underground is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, kno
Ransomware
Unknown is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Unsafe is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Valencialeaks is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, k
Ransomware
Vanhelsing is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Vanirgroup is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Vect is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Vendetta is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Vfokx is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Vicesociety is a heavily targeted education sector. This profile covers the group's operations, tactics, known campaigns, and defensive recommendations.
Ransomware
Walocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known
Ransomware
Wannacry is a North Korean-linked worm that infected 230,000+ systems in 150 countries in 2017. This profile covers the group's operations, tactics, known campa
Ransomware
Warlock is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known c
Ransomware
Werewolves is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Weyhro is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Worldleaks is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
X001Xs is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known ca
Ransomware
Xinglocker is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, know
Ransomware
Xinof is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Yanluowang is a targeted Cisco in 2022, member data later leaked. This profile covers the group's operations, tactics, known campaigns, and defensive recommenda
Ransomware
Yurei is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known cam
Ransomware
Zeon is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, known camp
Ransomware
Zerolockersec is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, k
Ransomware
Zerotolerance is a ransomware/extortion group operating a dark web leak site for victim data publication. This profile covers the group's operations, tactics, k
Ransomware
Big game hunting ransomware from Wizard Spider
Malware
Small downloader
APT
Deconstructing Salt Typhoon, one of China's most sophisticated state-sponsored APT groups targeting telecommunications and critical infrastructure worldwide.
Analysis of SANDWORM_MODE, the first documented cross-modal supply chain worm designed to subvert AI coding assistants and MCP servers via malicious npm packages.
Malware
Legacy IRC-based botnet
Malware
Information stealer RAT
Tools & Frameworks
BishopFox open-source C2
Ransomware
Ransomware using Safe Mode reboot to evade detection
Malware
JavaScript-based fake update framework
Malware
Multi-component malware suite
Malware
Adware and crypto-mining botnet
Malware
Stealthy cross-platform malware
Malware
Java-based RAT with fake ransomware
Tools & Frameworks
Chinese-origin web-based C2
Malware
Lightweight information stealer
Malware
Cryptomining botnet
Analysis of SystemBC, the SOCKS5 proxy backdoor with TOR integration used by Ryuk, Conti, DarkSide, and Black Basta ransomware operations. Covers RC4 encryption, DroxiDat variant, and detection strate
Malware
Emerging loader malware
Threat actor distributing platform-specific payloads via web injects and fake browser updates, delivering FrigidStealer on macOS, Marcher on Android, and Lumma on Windows.
MITRE ATT&CK
The adversary is trying to get into your network.
MITRE ATT&CK
The adversary is trying to run malicious code.
MITRE ATT&CK
The adversary is trying to maintain their foothold.
MITRE ATT&CK
The adversary is trying to gain higher-level permissions.
MITRE ATT&CK
The adversary is trying to avoid being detected.
MITRE ATT&CK
The adversary is trying to steal account names and passwords.
MITRE ATT&CK
The adversary is trying to figure out your environment.
MITRE ATT&CK
The adversary is trying to move through your environment.
MITRE ATT&CK
The adversary is trying to gather data of interest to their goal.
MITRE ATT&CK
The adversary is trying to steal data.
MITRE ATT&CK
The adversary is trying to communicate with compromised systems to control them.
MITRE ATT&CK
The adversary is trying to get into your device.
MITRE ATT&CK
The adversary is trying to maintain their foothold.
MITRE ATT&CK
The adversary is trying to gain higher-level permissions.
MITRE ATT&CK
The adversary is trying to avoid being detected.
MITRE ATT&CK
The adversary is trying to steal account names, passwords, or other secrets.
MITRE ATT&CK
The adversary is trying to figure out your environment.
MITRE ATT&CK
The adversary is trying to move through your environment.
MITRE ATT&CK
The adversary is trying to manipulate, interrupt, or destroy your devices and data.
MITRE ATT&CK
The adversary is trying to gather data of interest to their goal.
MITRE ATT&CK
The adversary is trying to steal data.
MITRE ATT&CK
The adversary is trying to communicate with compromised devices to control them.
MITRE ATT&CK
The adversary is trying to intercept or manipulate network traffic to or from a device.
MITRE ATT&CK
The adversary is trying to control or monitor the device using remote services.
MITRE ATT&CK
The adversary is trying to manipulate, interrupt, or destroy your systems and data.
MITRE ATT&CK
The adversary is trying to run malicious code.
MITRE ATT&CK
The adversary is trying to establish resources they can use to support operations.
MITRE ATT&CK
The adversary is trying to gather information they can use to plan future operations.
MITRE ATT&CK
The adversary is trying to gather data of interest and domain knowledge on your ICS environment.
MITRE ATT&CK
The adversary is trying to communicate with and control compromised systems, controllers, and platforms.
MITRE ATT&CK
The adversary is locating information to assess and identify their targets in your environment.
MITRE ATT&CK
The adversary is trying to avoid security defenses.
MITRE ATT&CK
The adversary is trying to run code or manipulate system functions, parameters, and data in an unauthorized way.
MITRE ATT&CK
The adversary is trying to manipulate, interrupt, or destroy your ICS systems, data, and their surrounding environment.
MITRE ATT&CK
The adversary is trying to manipulate, disable, or damage physical control processes.
MITRE ATT&CK
The adversary is trying to prevent your safety, protection, quality assurance, and operator intervention functions from responding.
MITRE ATT&CK
The adversary is trying to get into your ICS environment.
MITRE ATT&CK
The adversary is trying to move through your ICS environment.
MITRE ATT&CK
The adversary is trying to maintain their foothold in your ICS environment.
MITRE ATT&CK
The adversary is trying to gain higher-level permissions.
Malware
Point-of-sale malware
Analysis of Tofsee (Gheg), the modular spam botnet active since 2013 with crypto mining, DDoS, social media spreading, and proxy modules. Covers DGA cracking, PrivateLoader distribution, and defense s
Malware
Modular banking trojan turned loader
Malware
Emerging malware family
Malware
Analysis of emerging unclassified RATs
Malware
Classic small downloader
Malware
Long-running banking trojan
Malware
Chinese-origin RAT targeting Chinese speakers
Malware
Arkei-derived information stealer
Tools & Frameworks
Chinese-language C2 platform
Malware
JavaScript worm/RAT hybrid
Malware
USB propagation worm
Breach & Campaigns
SonicWall VPN zero-day vulnerability enables threat actors to sell unauthorized corporate network access on dark web forums across North America.
Tools & Frameworks
Go-based cross-platform C2
Malware
MaaS information stealer
Malware
Modular backdoor framework used by multiple Chinese APT groups for persistent access and supply chain compromises across gaming, technology, and telecom sectors.
Malware
Open-source C# RAT
Breach & Campaigns
Kuwait-focused espionage campaign
Tools & Frameworks
Chinese C2 framework
Malware
Legacy RAT still in use
Malware
Rising MaaS RAT
Exploit Kits
PHP-based exploit kit