Intelligence Feed

6d ago · security-com

Jewelbug, a China-based APT group also known as Earth Alux or REF7707, conducts parallel espionage and cryptocurrency fraud operations using shared infrastructure and a unified control panel called XG-Web. The group targets government ministries in the Middle East, Southeast Asia, and South Asia through browser-based attacks and watering-hole compromises, while simultaneously running a for-profit crypto fraud scheme targeting Chinese-speaking users. Their primary malware includes the Antino Windows backdoor and a malicious 'PDF Viewer' browser extension, both deployed via fake software installers and HTA downloaders. The group leverages compromised hosting providers to scale attacks, stealing over 580,000 browser cookies and more than one million implant check-ins in under three months.

2mo ago · security-com

The DragonForce ransomware group, tracked by Symantec as Hackledorb, conducted a sophisticated attack against a U.S. services firm, leveraging custom malware and novel techniques to evade detection. The attackers used a Go-based backdoor named Backdoor.Turn, which abuses Microsoft Teams' TURN relay infrastructure to hide command-and-control (C2) traffic behind legitimate Microsoft domains. They also employed DLL sideloading, BYOVD techniques exploiting vulnerable signed drivers—including Huawei’s HWAuidoOs2Ec.sys—and modified system configurations for persistence and lateral movement before deploying the DragonForce ransomware payload.

3mo ago · security-com

Trigona ransomware affiliates have deployed a custom exfiltration tool, uploader_client.exe, in attacks observed in March 2026, marking a shift from using common tools like Rclone to proprietary malware for greater control and stealth. The custom tool enables parallel data streams, connection rotation to evade detection, granular file filtering, and uses a shared key for authentication with the attacker-controlled server. Prior to data exfiltration, attackers disable security software using kernel-level tools such as HRSword, PCHunter, Gmer, and others, often leveraging vulnerable drivers (BYOVD technique), and gain remote access via AnyDesk. Credential theft is conducted using Mimikatz and Nirsoft tools.

3mo ago · security-com

Iran-linked threat actor Seedworm (also known as MuddyWater, Temp Zagros, Static Kitten) conducted a global espionage campaign in early 2026, breaching at least nine organizations across four continents, including a major South Korean electronics manufacturer. The attackers used DLL sideloading with legitimately signed binaries from Fortemedia and SentinelOne to execute malicious payloads, leveraging Node.js scripts to orchestrate PowerShell-based reconnaissance, credential theft, privilege escalation, and SOCKS5 reverse-proxy tunneling. Data exfiltration was performed via the public file-transfer service sendit[.]sh, blending malicious traffic with legitimate cloud services to evade detection. The campaign reflects an evolution in Seedworm’s tradecraft toward more disciplined and stealthy operations.

1mo ago · security-com

Backdoor.Mistic is a newly identified stealthy memory-resident backdoor used in cybercrime intrusions since April 2026. It has been deployed alongside ModeloRAT, a Python-based RAT linked to the financially motivated threat actor Woodgnat (aka KongTuke), known for selling initial access to ransomware affiliates including Qilin, Black Basta, and Rhysida. Mistic is sideloaded via legitimate binaries like MpExtMs.exe and loads malicious DLLs such as EndpointDlp.dll, enabling fileless execution, in-memory payload loading, and self-deletion via a kill switch. The actor uses social engineering lures (ClickFix, FileFix, CrashFix) and Microsoft Teams for initial access, with opportunistic targeting across insurance, education, IT, and professional services sectors.

3mo ago · security-com

Fast16 is a sophisticated sabotage framework discovered in April 2026, with components dating back to 2005, designed to subvert nuclear weapons simulations by tampering with high-explosive modeling in LS-DYNA and AUTODYN software. The malware uses a kernel driver and Lua-based logic to selectively alter simulation outputs when material density exceeds 30 g/cm³—consistent with uranium under implosion—thereby distorting critical physics calculations. It targets specific instruction sequences in Intel-compiled binaries and modifies Cauchy stress tensor or pressure outputs down to 1–10% of their true values, potentially causing flawed design decisions in nuclear weapon development.

2mo ago · security-com

A five-month espionage campaign targeted the Outlook mailbox of a senior executive at a major global stock exchange, using masqueraded binaries and legitimate cloud services for persistence and data exfiltration. The attackers achieved SYSTEM-level access and deployed a custom Aspose-based OST stealer to incrementally extract mailbox data, exfiltrating it in small batches via Dropbox and OneDrive Personal to avoid detection. The campaign demonstrated high operational discipline, leveraging scheduled tasks, IP-based OneDrive connections to evade DNS logging, and multiple file redeployments under different names but consistent hashes, indicating a focused, long-term intelligence collection effort.

1mo ago · security-com

Attackers are increasingly leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to exploit legitimate, signed Windows kernel drivers and gain kernel-level privileges, enabling them to disable or bypass security software such as antivirus (AV) and endpoint detection and response (EDR) solutions. This method abuses flaws in trusted drivers like truesight.sys and those used by Microsoft Process Explorer, allowing attackers to terminate, suspend, or blind security processes. The technique has become widespread, with ready-made tools such as TrueSightKiller, GhostDriver, AuKill, and Poortry being integrated into ransomware-as-a-service (RaaS) offerings, making it a common component of modern ransomware attack chains.

1mo ago · security-com

The GodDamn ransomware, a rebranded variant of Beast and Monster ransomware, has been used in a recent attack attributed to the threat actor Hyadina. The attackers leveraged AnyDesk for remote access, deployed the malicious PoisonX kernel driver—signed by Microsoft—to disable endpoint defenses, and used a suite of credential-harvesting tools from NirSoft. The attack involved lateral movement via PsExec, deployment of backdoors across multiple hosts, and eventual execution of the ransomware payload after a four-day dwell period. This represents an evolution in defensive evasion tactics, leveraging signed malicious drivers in a BYOVD-style attack.

1mo ago · security-com

Symantec's Threat Hunter Team discovered the China-linked kernel-mode rootkit Backdoor.Daxin active on a compromised host in Taiwan in May 2026, more than four years after its initial public disclosure. Alongside Daxin, a previously undocumented backdoor, Backdoor.Stupig, was found deployed on the same system. Stupig enables pre-authentication command execution as SYSTEM via a Trojanized keyboard-layout DLL loaded by winlogon.exe, bypassing logon audit events. Both malware samples carry compile timestamps from early 2013, suggesting a potential long-term undetected compromise lasting over a decade, possibly facilitated through an outdated Digiwin single sign-on portal with legacy Java components.

4w ago · security-com

A new Rust-based ransomware named Spirals was deployed in a double extortion attack against an IT services company in South Asia in June 2026. The attackers gained initial access via a compromised IIS web server and used an ASP.NET web shell to establish persistence, escalate privileges, and move laterally using WMI and PsExec. The ransomware, disguised as bitsadmin.exe, encrypted files using AES-128 keys wrapped with ECDH P-256, and threatened to leak stolen data via a Tor-based portal. Multiple tunneling tools and C2 infrastructure were used to maintain access and exfiltrate data.