Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
Amazon Links NPM Supply-Chain Attacks to North Korean Group
Amazon has attributed multiple npm supply-chain attacks, including the compromise of debug, chalk, and axios, to the North Korean threat actor Sapphir
Flying Eagle Malware-as-a-Service Platform Targets Mobile
The Flying Eagle platform provides threat actors with a full-service mobile RAT builder to create infostealers capable of draining victim bank account
Flying Eagle Android RAT Source Code Circulates, Linked to
The source code for the Flying Eagle Android RAT is circulating on Telegram, with researchers identifying 170 servers hosting its control panels.
Two @joyfill npm Packages Compromised to Deliver RAT Malware
Two beta versions of @joyfill npm packages were found to contain a malicious JavaScript implant that executes a remote access trojan (RAT) upon import
Tengu Botnet Uses Hardware Watchdog to Maintain Persistence
The Mirai-derived Tengu botnet leverages Linux hardware watchdogs to force device reboots when its process is terminated, ensuring persistence.
Nimbus Manticore Deploys NightLedger Backdoor in Middle
The Iranian state-backed group Nimbus Manticore is using a new Windows backdoor called NightLedger and custom WebSocket tunnelers to turn victim syste
Dysphoria IoT Botnet Adopts Blockchain C2 and Relay Nodes
The Dysphoria IoT botnet has integrated blockchain-based name services and infected-device relays to improve resilience following a March law-enforcem
Dysphoria Botnet Compromises 200,000 IoT Devices for DDoS
The Dysphoria botnet has infected 200,000 IoT devices, utilizing blockchain-based command-and-control infrastructure to facilitate DDoS attacks and tr
China-linked Cruciferra crypter uses BYOVD and process
Proofpoint researchers identified the Cruciferra crypter, a tool used by multiple threat actors to deploy remote access trojans via BYOVD and process
New TELESHIM Malware Targets Middle East Government Entities
Zscaler ThreatLabz identified a new cyber campaign targeting Middle East governments using the TELESHIM, MIXEDKEY, and BINDCLOAK malware families.
MedusaHVNC Malware Uses Hidden Windows Desktops to Evade
The MedusaHVNC malware-as-a-service operation utilizes invisible Windows desktops to launch legitimate browsers, allowing attackers to maintain covert
SourTrade Malvertising Campaign Uses Browser-Based Assembly
The SourTrade malvertising campaign, active since late 2024, forces victims' browsers to assemble malicious Windows executables using the Bun runtime,