BlueNoroff campaign

Michael A@JohnMatrix

•updated Aug 6, 2025•3•1•81

High confidence that the same actor is responsible for earlier attacks attributed to BlueNoroff and the RustDoor/ThiefBucket and RustBucket campaigns. SentinelLABS observed the use of a novel persistence mechanism abusing the Zsh configuration file zshenv.