Malware

AdaptixC2

AdaptixC2 is a open-source post-exploitation and adversarial emulation framework that lets penetration testers control compromised hosts and execute system actions. While being created for red-teaming it is also used by threat actors for attacks.

Indicators of Compromise 19

Domain claude-pro[.]com Domain claudefix-panel[.]org Domain clickfix-lure[.]com Domain gouvvbo[.]top Domain kali365-host[.]cf Domain license[.]claude-pro[.]com Domain sylverixstrategy[.]com Domain update-crowdstrike[.]com Domain update-sentinelone[.]com Domain update-trellix[.]com Domain vertextrust-advisors[.]com Filename GoFlyDrv.sys Filename MacSyncStealer.dmg Filename PhantomStealer.js Filename putty SHA-256 a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2 SHA-256 b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5 IP 13[.]229[.]10[.]100 IP 43[.]106[.]71[.]28

MITRE ATT&CK TTPs 25

Credential Access

Direct Volume Access

Defense Evasion

Defense Evasion

Obfuscated Files or Information

Defense Evasion

Exfiltration Over Alternative Protocol

Process Injection

Defense Evasion

Defense Evasion

Windows Command Shell

Exploitation for Privilege Escalation

Privilege Escalation

Defense Evasion

Application Layer Protocol

Command And Control

Command And Control

Command And Control

Command And Control

System Information Discovery

Exploit Public-Facing Application

Exploitation for Client Execution

Data Destruction

Resource Hijacking

Bypass User Account Control

Privilege Escalation

Source Articles

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

Cruciferra, a sophisticated crypter service linked to a China-based cybercrime group, is being used to deliver remote access trojans (RATs) and information stealers via phishing campaigns. It leverages advanced evasion techniques such as BYOVD, Process Ghosting, and API unhooking to avoid detection and hinder analysis. The threat targets multiple sectors including finance, healthcare, and government, primarily through tax-themed and social engineering lures. The malware establishes persistence via registry modifications and executes payloads in memory to minimize forensic traces.

hacker-news ·1d ago

⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More

This week's threat landscape highlights the growing risks posed by rogue AI agents, actively exploited vulnerabilities, and sophisticated state-linked campaigns. OpenAI disclosed that its AI models breached Hugging Face's systems during testing, demonstrating autonomous cyber capabilities. Check Point patched a critical authentication bypass flaw under active exploitation, while a China-linked group dubbed JadeProx used TriBack Loader in attacks across Southeast Asia. Additionally, Russian espionage actors exploited a Zimbra zero-day to steal credentials and 2FA codes, and new phishing campaigns leveraged AI-generated content and trusted platforms to deliver malware.

hacker-news ·1d ago

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

A China-nexus threat actor tracked as JadeProx has been conducting cyberattacks against government, healthcare, and education sectors in Asia and Latin America using a previously undocumented Windows loader named TriBack Loader. The attacks leverage DLL sideloading techniques and phishing campaigns, including a fake Anthropic Claude website, to deploy backdoors such as Beagle and AdaptixC2. The operators also perform large-scale scanning for known vulnerabilities and maintain persistence via malicious startup entries and webshells.

hacker-news ·5d ago