ESET uncovered a six‑month supply‑chain poisoning campaign in which the OceanLotus APT group compromised the FireAnt Metakit update server, delivered a malicious SPECTRALVIPER backdoor to Vietnamese investors, and highlighted critical flaws in unsigned software updates.
When traditional decompilers output unintelligible C‑style code for Rust binaries, Oxidizer restores Rust‑specific structures, enums and macros, achieving up to 28% higher accuracy and 20% faster analysis, as demonstrated on 28 popular Rust projects and validated in user studies.
KAIDO RAT v3.0, a .NET 9‑based modular malware suite with over 60 plugins, targets Brazil's PIX payment system, injects malicious QR codes, locks user devices, harvests AI platform credentials, and employs advanced evasion techniques, while the article also offers detailed defense recommendations.
The article traces the nine‑year journey from the Shadow Brokers leak to the 2026 AI‑assisted reverse‑engineering of Fast16, revealing its three‑layer sabotage architecture, uranium‑density manipulation, targeted industrial simulation software, and its relationship to Stuxnet, while highlighting security lessons for critical infrastructure.
Security researchers discovered that VECT ransomware unintentionally embeds the ChaCha20 key and nonce for files under 128 KB, allowing easy decryption, while its chunked encryption of larger files loses three of four nonces, rendering those files permanently unrecoverable even after ransom payment.
Sophos researchers discovered that the Payouts King ransomware family deploys a fully hidden Alpine Linux VM via the open‑source QEMU emulator, allowing data theft, C2 communication, and tool deployment to remain invisible to host‑based antivirus and EDR solutions.
The 2025 Malware Hunter sample disguises a password‑protected PDF about rare‑earth governance as bait, then uses SecurityKey.exe to display the password, allocate RWX memory, run a PEB‑traversing, API‑hashing downloader shellcode, impersonate a REIA domain, and finally execute the payload via Windows fibers, with detailed detection recommendations provided.
The article details an AI‑crafted C2 remote‑access trojan framework hosted at 101.32.128[.]36:8443, describing its Go implant, Python listener, PowerShell stager, custom 443‑based encryption, Telegram bot exfiltration, the payload delivery chain via paste.rs and GitHub Gist, and provides sample hashes for the binaries.
TeamPCP, a newly identified cloud‑native threat group, has compromised at least 60,000 servers worldwide by exploiting exposed Docker APIs, Kubernetes clusters, Redis instances, and the React2Shell vulnerability, employing automated tools such as proxy.sh, kube.py, and react.py, with detailed MITRE ATT&CK mapping and concrete defense recommendations.
StepSecurity uncovered a sophisticated supply‑chain attack on the popular Axios HTTP client where compromised maintainer credentials were used to publish malicious versions that injected a hidden postinstall RAT, evaded detection, and executed platform‑specific payloads before self‑destructing, prompting detailed forensic and remediation guidance.
On March 25, 2026 a malicious script hijacked Apifox's CDN, inflating a 34 KB tracking file to 77 KB and using obfuscated JavaScript, RSA and AES‑256‑GCM encryption to collect system fingerprints, SSH keys, Git credentials and exfiltrate them through a multi‑stage C2 chain.
A new AI‑assisted malware called Arkanix Stealer, promoted on dark‑web forums, can steal data from 22 cryptocurrency wallets, browsers, VPN services, and social platforms, offering both a Python‑based basic version and a native C++ advanced version, while highlighting the lowered barrier for cybercrime.
Police in Zhejiang dismantled a full‑cycle black‑market operation that stole, cracked and resold rental smartphones, arresting three high‑paid engineers from major internet firms who earned over ten million yuan by exploiting fnOS vulnerabilities, highlighting both technical methods and legal consequences.
Over 300,000 users have installed 30 malicious Chrome extensions that pose as AI assistants, stealing account credentials, email content and browsing data; the most popular, Gemini AI Sidebar, had 80,000 installs before removal, and the extensions share a common backend infrastructure.
The TA584 threat group, acting as a high‑activity initial‑access broker, now employs the Tsundere Bot and XWorm remote‑access trojans in a multi‑stage phishing chain that culminates in ransomware deployment, with Proofpoint noting a two‑fold activity surge and expanded geographic reach in 2025.
The Chinese National Time Service Center revealed a sophisticated cyber‑attack attributed to the U.S. NSA, detailing the deployment of multiple custom malware families—including Back_eleven, eHome_0cx, and New_Dsz_Implant—used for data theft, persistent footholds, encrypted tunneling, lateral movement, and command‑and‑control via numerous IP addresses.
An in‑depth investigation reveals the rise and takedown of the RapperBot DDoS botnet, detailing its malware lineage, sample analysis, sophisticated attack techniques, criminal profit models, and practical security recommendations, while showcasing Tencent’s Zeus Shield intelligence platform and AI‑enhanced threat analysis.
Explore the most common Kali Linux penetration testing utilities—including Nmap, Metasploit, Hydra, Wireshark, and more—organized by categories such as information gathering, vulnerability exploitation, password cracking, and network monitoring, with brief usage commands and guidance for each tool.
This guide lists the most common Kali Linux penetration testing utilities—including Nmap, Metasploit, Hydra, Wireshark, and many others—explaining their primary functions and providing concise command‑line examples for quick reference.
This article provides a comprehensive technical breakdown of the DarkComet remote‑access trojan, covering its classification, Delphi‑based static characteristics, step‑by‑step dynamic behaviors such as hidden startup, file dropping, registry auto‑run, QQ data harvesting, SMS bombing, plus extracted IOCs and practical mitigation recommendations.
The article delivers a technical overview of modern botnet threats, detailing the PBot and Xanthe families, their infection vectors, command‑and‑control operations, and provides practical detection, mitigation, and statistical analysis methods for defending against large‑scale DDoS, spam, and other malicious activities.
This article provides a step‑by‑step technical analysis of the DarkKomet remote‑access trojan, covering its capabilities, infection vectors, detection methods using TTP‑driven EDR, containment actions, eradication procedures, root‑cause forensics, and post‑incident recovery measures.
During a penetration testing exercise, the team discovered a cleverly disguised GitHub repository that leaked credentials, leading to a vulnerable admin interface, a malicious Python‑based VPN client which, after reverse‑engineering with PyInstaller extraction, revealed embedded shellcode hidden in images, allowing the attackers to trace the command‑and‑control server and pinpoint the origin of the intrusion.
GoodWill ransomware, discovered by CloudSEK in Mumbai, encrypts all files and demands victims complete three charitable acts and post a personal essay on social media before providing a decryption key, blending malware tactics with forced philanthropy while employing .NET, UPX packing, AES encryption, and location detection.
The GoodWill ransomware, discovered by CloudSEK in Mumbai, forces victims to perform three charitable acts, document them, and post a personal essay before providing a decryption key, while employing .NET, UPX packing, AES encryption, and location‑tracking techniques.
This article chronicles the discovery of a server breach used for cryptocurrency mining, detailing the malicious code, forensic analysis of the trojan's actions and artifacts, and the step‑by‑step remediation measures taken to secure the system.
This article chronicles the discovery of a server breach used for cryptocurrency mining, analyzes the malicious Python payload and its system modifications, and provides concrete remediation steps such as system reinstall, non‑root deployment, firewall hardening, and Nginx authentication.
This comprehensive guide walks security engineers through every phase of an incident response—from initial information gathering, containment, and vulnerability scanning to detailed log, process, and account analysis, culminating in recovery steps and post‑incident hardening recommendations.
Security researchers at ESET reveal that the Hive ransomware group has expanded its attacks to Linux and FreeBSD systems, releasing a buggy yet feature‑rich Linux variant written in Go, while noting a broader industry trend of ransomware operators developing Linux encryptors to compromise virtualized server environments.
This article walks through a real‑world server breach where a disguised gpg‑agentd process was used to install backdoors, download malicious scripts, exploit Redis, and launch mass scans, and then offers concrete hardening steps to prevent similar compromises.
This article walks through a real-world server breach where attackers hijacked SSH access, deployed malicious scripts, leveraged Redis vulnerabilities, and turned the machine into a high‑speed crypto‑mining botnet, while offering detailed forensic clues and remediation advice.
Huorong’s threat intelligence team discovered that the Qike PDF Converter carries a malicious proxy module that silently spreads via download‑site installers, hijacks system processes, persists as a startup service, and can turn infected machines into high‑CPU‑usage botnets, prompting immediate security updates.
This comprehensive guide explains remote‑control trojans—covering their basic concepts, classifications, infection methods, communication techniques, typical functionalities, their role in APT attacks, and practical detection strategies—providing security professionals with essential knowledge to defend against these sophisticated threats.
A detailed walkthrough shows how a low‑skill ransomware written in E‑Language was dissected in a VMware VM, revealing hard‑coded admin credentials, simple command‑line user creation, and a plaintext ransom password, followed by practical removal tips such as Safe Mode and bootable USB cleanup.
Security researchers discovered that the Qike PDF Converter embeds a malicious proxy module that silently spreads via download‑site installers, hijacks system processes, consumes CPU, persists as a startup service, and originates from a Hangzhou tech company, highlighting the risks of silent promotion in freeware distribution.
Security researchers dissect the counterfeit “Le Bao” app that mimics WeChat, revealing its covert QR‑code group‑joining, custom decoding, member‑paid porn livestreams, embedded payment methods, server infrastructure, and illicit profit models, highlighting its high concealment and the need for aggressive mitigation.
This report provides a comprehensive technical analysis of the malicious "Le Bao" app that masquerades as a WeChat‑like chat tool, detailing its sample characteristics, hidden QR‑code group joining mechanism, payment flow, server‑side tracing, and profit model, highlighting its covert distribution of pornographic content and associated illicit activities.
This report investigates the malicious “Le Bao” Android application that masquerades as a WeChat‑like chat tool, detailing its sample characteristics, hidden QR‑code group‑joining mechanism, membership‑based porn livestream access, promotion methods, profit model, and comprehensive traceability of servers, payment channels, and social accounts.
An infected Linux server shows high CPU usage but standard tools miss the culprit; this guide explains how mining malware hides its process via /proc tricks, demonstrates detection using network scans, unhide tools, and offers removal steps to eradicate the hidden miner.
This article walks through a real‑world Linux mining malware infection, detailing how the attacker hid a malicious cron job, used LD_PRELOAD rootkits, propagated via SSH keys, and how the analyst uncovered and removed the threat using busybox, strace, and careful forensic commands.
A detailed forensic walk‑through reveals how a disguised gpg-agentd binary compromised a CentOS server on Alibaba Cloud, using SSH key injection, malicious cron jobs, Redis abuse, and masscan scanning to spread and mine cryptocurrency.
A detailed forensic walkthrough reveals how a compromised CentOS server was hijacked via a disguised gpg-agentd process, leveraged cron jobs to download malicious scripts, abused Redis for persistence, and used masscan for rapid scanning, followed by practical security recommendations to harden servers and Redis instances.
This article walks through a real‑world compromise of an Alibaba Cloud server, detailing how a disguised gpg‑agentd process was used to install backdoors, hijack SSH keys, exploit Redis, and launch mass scanning with malicious scripts, and it concludes with practical hardening recommendations.
The report investigates the malicious “Le Bao” application that mimics WeChat, detailing its hidden QR‑code group‑joining mechanism, server‑side communication, payment and gambling integration, and the broader illicit promotion and profit model, while providing forensic traces, source‑code decoding, and mitigation recommendations.
This report analyzes the malicious “LeBao” application that masquerades as a WeChat‑like chat tool, detailing its covert QR‑code group entry, custom decoding, member‑paid porn livestreams, payment fraud, server tracing, and recommended mitigation measures to curb its illicit operations.
This guide explains sandbox fundamentals, compares Windows and Adobe Reader sandboxes, and provides step‑by‑step instructions for installing and configuring a Cuckoo Linux sandbox on Ubuntu, including SystemTap syscall monitoring and signature creation illustrated with a Gonnacry ransomware case study.
A compromised CentOS server was frozen by Alibaba Cloud after malicious outbound traffic; the investigation uncovered a disguised gpg‑agentd process, malicious cron jobs downloading remote scripts, a Redis exploit that injected SSH keys, and mass‑scan tools, illustrating a sophisticated multi‑stage malware infection.
This article walks through a real‑world Linux mining malware incident, detailing how the attacker used a malicious crontab entry and LD_PRELOAD to hide processes, the forensic steps to uncover the payload, and practical remediation and hardening measures to prevent future compromises.
A client reported unexpected outbound attack traffic from a server, prompting a step‑by‑step forensic investigation that confirms an SSH brute‑force breach, analyzes logs, identifies malicious network connections and cron jobs, uncovers hidden mining malware, and provides hardening recommendations to secure the Linux host.
A detailed forensic walk‑through reveals how a compromised Alibaba Cloud server was seized via a weak root password, a disguised gpg-agentd binary, malicious cron jobs, and Redis configuration abuse, ultimately enabling password‑less SSH access and large‑scale network scanning for cryptocurrency mining.
A detailed forensic walk‑through shows how a compromised CentOS 6 server was infected by a disguised gpg‑agentd binary, how the attacker used cron jobs to pull malicious scripts, leveraged Redis write‑file vulnerabilities and masscan to scan the Internet, and provides concrete hardening recommendations.
After a routine morning, the author discovers an Alibaba Cloud server frozen due to malicious outbound traffic, then traces a sophisticated malware chain involving a disguised gpg-agentd process, malicious cron jobs, compromised SSH keys, Redis exploitation, and mass scanning, culminating in detailed forensic analysis and security recommendations.
On December 14, Tencent's security intelligence team uncovered a “DriverLife” Trojan that exploited the high‑severity EternalBlue vulnerability to propagate like a worm, infecting up to 100,000 users within two hours, and detailed its infection chain, malicious payloads, and mitigation recommendations.
This article details a step‑by‑step incident‑response case study of a Windows internal‑network Trojan that exploited SMB port 445, describing how alerts were identified, malicious processes were traced, terminated, and fully removed using tools such as netstat, PChunter, and process monitoring utilities.
This article analyzes the recent surge of Redis unauthenticated attacks that install a worm, use pnscan for lateral scanning, modify system settings, and launch cryptocurrency mining, while providing detailed script breakdowns and remediation steps.
Tencent's security lab uncovered a large‑scale trojan spread via pornographic web ads that exploits the CVE‑2016‑0189 IE vulnerability, installs a backdoor, and runs a Zcash mining program, while also distributing Linux malware and controlling numerous C&C servers across Chinese provinces.
Tencent Security Lab dissected the compromised XShell remote terminal, revealing a three‑stage malicious process where patched binaries load encrypted shellcode, exfiltrate system information via dynamically generated DGA domains, and ultimately deploy a svchost‑based payload, with detailed IOC listings and remediation advice.
This article summarizes the latest technical analysis of the WannaCry ransomware, offers official prevention guidelines, and provides step‑by‑step recovery tools to help victims restore encrypted files as quickly as possible.
This article provides a comprehensive technical analysis of the WannaCry ransomware, detailing its exploitation of the MS17‑010 vulnerability, propagation mechanisms, AES‑RSA encryption process, ransom infrastructure, decryption tool, and recommended security mitigations.
This article walks through a real‑world investigation of a Linux server infected with the Linux.BackDoor.Gates.5 backdoor, detailing traffic analysis, process inspection, malicious file identification, manual cleanup commands, and the use of ClamAV to scan and eradicate the threat.
During the Chinese New Year a client’s Oracle‑Tomcat server was overwhelmed by massive UDP traffic, prompting a forensic investigation that uncovered a hidden Trojan, detailed command‑line analysis, iptables hardening, and the root cause of a weak SSH password left after a hardware upgrade.
This article examines the XOR.DDoS Linux trojan (sample 101), detailing how it hijacks crontab to launch malicious scripts, the forensic clues left in system logs, and a step‑by‑step emergency removal procedure, while also discussing its polymorphic nature and the broader challenges of defending against such malware.
The article reveals a novel ELF‑binary manipulation technique that prevents IDA Pro from loading malicious Linux samples, demonstrates reconstruction steps with hex editors, compares other disassemblers, and provides YARA rules and a GitHub script for detection and remediation.
This article examines the evolution of a malicious MD5 collision campaign from 2014‑2015, detailing the chosen‑prefix collision method, the combination with digital signatures and dual‑signature tricks, the full infection workflow, and the large‑scale propagation and impact on millions of Windows users.
The article presents a comprehensive technical analysis of a sophisticated Windows trojan that masquerades as a Word document, detailing its delivery method, file extraction process, registry modifications, remote‑control capabilities, and the organized, targeted attack infrastructure behind it.
The article explains two simple yet effective sandbox‑evasion techniques used by a new Upatre Trojan variant—checking system uptime via GetTickCount and monitoring mouse movement—to bypass dynamic analysis environments and remain undetected by antivirus scanners.
This article explains the XcodeGhost malware that infected iOS developers, detailing its data‑reporting and command‑issuing capabilities, the potential threats it poses on older iOS versions, and practical steps to detect and remove an infected Xcode installation.
