Intel Exchange

ClingSTUN is a Linux back-connect proxy backdoor that exploits numerous IoT vulnerabilities and abuses public STUN infrastructure for NAT traversal and remote command execution.

Adversaries are deploying modular Linux implants including BPFDoor, Rekoobe, and the new AVERAT RAT against telecom edge appliances, utilizing SMTP-disguised C2 and BPF packet filtering to evade detection.

Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.

China-nexus threat actors, including Storm-3069, utilize the modular NeedyMantis malware to maintain long-term access in telecommunications, government, and education sectors following initial compromise.

China-linked threat actor Storm-3069 uses NeedyMantis, a modular post-compromise framework, to maintain long-term access via DLL sideloading and custom encrypted archives.

A suspected China-based threat actor exploited file upload vulnerabilities in a recreation management platform to deploy webshells and steal payment card data.

Water Hydra (EvilNum) has transitioned from complex zero-day exploits to social engineering-driven campaigns using .PIF files and non-standard protocol handlers to deliver the DarkMe RAT.

Sauron Loader is a novel Russian-language Malware-as-a-Service that utilizes social engineering, DLL side-loading, and in-memory decryption to deliver multi-stage payloads.

Kothamine Agent is a C/C++ remote access Trojan distributed via malicious npm packages that leverages Tailscale’s tailcat tool for encrypted C2 communication to bypass network detection.

TASK#STOMP uses a VBScript-orchestrated execution chain to deploy a multi-stage PowerShell backdoor focused on automated document exfiltration, credential theft, and remote access.