Intelligence Feed

2w ago · static-urls

The @joyfill npm scope was compromised on July 28, 2026, with two malicious beta packages (@joyfill/[email protected] and @joyfill/[email protected]) that delivered a blockchain-based command-and-control (C2) loader. The attack uses a two-stage supply chain compromise where the malicious code is embedded in production JavaScript bundles, executing upon import. The payload leverages public blockchain transactions (Tron and BSC) to fetch XOR-encrypted payloads, ultimately deploying a RAT client matching the PolinRider bot. This campaign shares infrastructure with the earlier astro.config.mjs attack, indicating a persistent threat actor using blockchain dead drops to evade detection.

2w ago · static-urls

The article clarifies confusion between malware families attributed to developer PureCoder, specifically distinguishing PureLogs, an infostealer, from PureRAT, a Remote Access Trojan (RAT). Both are .NET-based and have been mislabeled as zgRAT in detection rules, leading to false positives. The article provides technical indicators and Suricata signatures for detecting PureLogs and PureRAT, emphasizing the importance of accurate classification to avoid misattribution.

2w ago · static-urls

Cisco Talos has identified a sophisticated China-nexus APT group tracked as UAT-7290, active since at least 2022, targeting high-value telecommunications infrastructure in South Asia and recently expanding into Southeastern Europe. The group conducts espionage and establishes Operational Relay Box (ORB) nodes using a suite of custom and open-source malware, including RushDrop, DriveSwitch, SilentRaid, and Bulbature. UAT-7290 leverages one-day exploits, SSH brute-forcing, and publicly available proof-of-concept code to compromise edge devices and gain initial access. Technical overlaps with APT10 and Red Foxtrot, as well as shared infrastructure and malware traits, suggest ties to Chinese state-sponsored actors.

2w ago · static-urls

Amazon Threat Intelligence has identified a DPRK-linked threat actor behind multiple supply chain attacks on popular NPM packages including axios, debug, chalk, and typo-crypto. The actor used social engineering to gain access to maintainer accounts and published trojanized updates containing malicious code. These attacks leveraged post-install hooks, multi-stage payloads, and C2 infrastructure to deliver malware across thousands of downstream environments. The same actor is assessed to have tested their tradecraft in a smaller campaign via the typo-crypto package before escalating to higher-impact compromises. The group uses sophisticated evasion techniques including code obfuscation, environment detection to avoid sandboxes, and generative AI to produce convincing malicious packages.

2w ago · static-urls

A remote code execution (RCE) vulnerability in Fastjson versions ≤ 1.2.83 is under active exploitation in the wild. The vulnerability allows unauthenticated attackers to execute arbitrary code on affected servers by sending specially crafted JSON payloads, without requiring user privileges or victim interaction. Exploitation is possible when Fastjson SafeMode is not enabled. ThreatBook TDP has detected active attacks and provides detection capabilities via signature S3100181015. The recommended mitigations include enabling SafeMode, blocking malicious payloads at the perimeter, and migrating to Fastjson 2.x, as no official patch is available for the 1.x series.

3w ago · static-urls

Zscaler ThreatLabz has identified a threat actor operating since January 2026 that conducts vishing attacks via Microsoft Teams to trick victims into launching Quick Assist remote support sessions, enabling initial access. The actor deploys a Go-based backdoor named GoGRPC, with four observed variants (Lep, Giver, Pet, Kind), each exhibiting evolving capabilities including gRPC-based C2 communication over HTTP/2 on port 443. Additional malware tools such as BlindDoor, S3Siphon, RevSocket, PyGRPC, and RSOX are used for persistence, reconnaissance, data exfiltration, and proxying, indicating a sophisticated campaign likely supporting ransomware operations.

3w ago · static-urls

The article details the discovery and analysis of a malicious Android Remote Access Tool (RAT) framework called Flying Eagle, which was leaked in early 2026 and has since been widely distributed by cybercriminal actors. The malware is distributed via fake apps impersonating Chinese government services and includes capabilities for credential theft, keylogging, screen capture, and phishing overlays. At least 170 active servers hosting the Flying Eagle infrastructure were identified, primarily in Hong Kong, using shared codebases and panel fingerprints. A new successor platform named Night Dragon has emerged, developed by the threat actor behind the @SQLRCE0 Telegram channel, indicating ongoing evolution of this mobile threat ecosystem.

3w ago · static-urls

Dysphoria 是一个自2026年初开始活跃的新兴僵尸网络家族，已控制超过20万台设备。该僵尸网络通过弱口令爆破和多个已知IoT漏洞进行传播，包括CVE-2017-17215、CVE-2020-8515等。其技术演进迅速，引入了基于以太坊ENS和Solana SNS区块链域名的C2隐蔽解析机制，并将受感染主机转化为C2中继节点，增强了抗打击能力。最新变种使用自定义RC4加密算法、UPnP内网穿透和动态中继架构，具备强大的DDoS攻击能力，宣称可达到4Tbps，并已实现商业化攻击服务运营。

3w ago · static-urls

MedusaHVNC is a newly identified remote access trojan (RAT) distributed as malware-as-a-service (MaaS) that enables attackers to access live, logged-in browser sessions via a hidden virtual desktop on Windows systems. The infection chain begins with an obfuscated JScript that drops and executes multiple components, including an AutoIt-based decryptor and a layered unpacking routine, ultimately loading a 64-bit payload. The final payload establishes a connection to a hard-coded command-and-control (C2) server and enables screen capture, synthetic input, and clipboard manipulation to interact with the hidden desktop session. This allows operators to stealthily monitor and control active user sessions without detection.

3w ago · static-urls

RedisRaider is a Linux cryptojacking campaign that targets publicly exposed Redis servers to deploy a custom XMRig miner. The threat actor uses aggressive scanning, obfuscation techniques, and cron job manipulation to propagate and maintain persistence. The campaign also leverages in-browser mining infrastructure, indicating a multi-pronged monetization strategy. Anti-forensics measures such as short-lived Redis keys and configuration tampering are used to evade detection.

3w ago · static-urls

Cavalry Werewolf conducted targeted phishing campaigns from May to August 2025, primarily against Russian public sector entities and critical infrastructure organizations. The attackers impersonated Kyrgyz government officials and delivered custom malware, including FoalShell reverse shells and StallionRAT, via malicious RAR attachments. These tools enabled remote command execution, data exfiltration, and persistence through registry modifications, with command and control communications routed through Telegram bots and proxy tools.