Threats & Attacks
Ransomware, malware, phishing and the actors behind them.
How Crypto Clipper Malware Hides Behind Tor's SOCKS5 Proxy to Steal Crypto Wallets
A deep dive into how the Crypto Clipper malware campaign uses a local SOCKS5 proxy at localhost:9050 to route all command-and-control traffic through Tor, evading traditional network defenses while stealing cryptocurrency seed phrases, private keys, and swapping wallet addresses.
Boring and Brutal: How Russia's Gamaredon Scaled Its Spear-Phishing Pipeline
Analysis of ESET's 2025 report on the Gamaredon APT group: their downloader development, infrastructure obfuscation, and strategic collaborations.
The Mistic Backdoor: How KongTuke’s Stealthy Memory-Only Tool Powers Ransomware Intrusions
Mistic is a stealthy, fileless backdoor developed by initial access broker KongTuke to enable long-term persistence for ransomware operators like Qilin and Black Basta. Here’s how it avoids detection, exploits legitimate tools, and why behavioral analysis is essential to stop it.
Targeting the Malware Assembly Line: How Coordinated Legal Tactics and AI Disrupt Cybercrime Infrastructure
A global coalition of tech firms and law enforcement agencies disrupted the shared command-and-control infrastructure of the Amadey and Stealc malware operations using a combination of artificial intelligence and organized-crime laws.
The Digital Scalpel: Dr. Mehmet Oz Employs AI to Target Medicare Fraud
An in-depth look at Dr. Mehmet Oz's AI-powered strategy to modernize fraud prevention at CMS.
Fake Security Verification Frameworks Abuse Native macOS Utilities to Execute Hidden Infostealers
An in-depth analysis of the macOS ClickFix campaign, which leverages system commands to bypass manual interaction by silently downloading, mounting, and launching the Atomic macOS Stealer (AMOS), highlighting how the threat landscape is evolving to bypass user and OS boundaries.
Operation Endgame: Law Enforcement Seizes Control of SocGholish Malware infrastructure From Nearly 15,000 WordPress Sites
A sweeping international operation dismantled the SocGholish malware distribution network, cleaning 14,971 compromised WordPress sites and disabling over 100 servers tied to Evil Corp—marking a pivotal moment in the multi-year Operation Endgame campaign against global cybercrime.
How a Developer Token Compromise Sparked a Global Pharma Data-Extortion Crisis
Novo Nordisk recent massive data breach: Investigating the impact of a developer token compromise on pharma data security, research, and manufacturing.
AryStinger Botnet Hijacks 4,000+ Routers as Malicious Proxy Network
Previously undocumented malware botnet AryStinger has compromised thousands of outdated D-Link routers worldwide, converting them into remotely controlled 'executors' for scanning, proxying, and command execution activities.
WordPress Compromise Fuels Vice Society Ransomware Delivery
A new malware campaign is leveraging compromised WordPress sites and 'ClickFix' tactics to deploy threats linked to the ransomware group Vice Society.
AI Voice-Cloning Scams: How Vocal Timbre Bypasses Human Skepticism
A new study reveals that AI voice-cloning scams are highly persuasive because they weaponize vocal timbre to bypass human critical skepticism and force compliance.
The JDY Botnet: A Malware Network Expanding Its Targeting Scope
The JDY botnet, previously associated with Chinese threat actors like Volt Typhoon, has significantly expanded its targeting scope and reconnaissance efforts to include US military networks.