Intel Exchange

Threat actors are exploiting ScreenConnect to deploy a four-stage VBScript chain that propagates across active remote sessions, ultimately delivering miners and backdoors.

The WEEVILPROXY threat actor is deploying JSCeal, a compiled V8 JavaScript malware that uses stolen session cookies to bypass Google authentication and target cryptocurrency investors.

APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.

Adversaries such as ShinyHunters are exploiting known vulnerabilities and unsecured remote access services to target the healthcare sector, leading to significant ransomware impacts and clinical disruptions.

Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.

Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.

TWINLOOT is a modular Python implant using Microsoft SharePoint, Teams, and headless Edge browsers for stealthy command-and-control and lateral movement.

Toy Ghouls (Bearlyfy) is using new custom backdoors, mqtt-bird-agent and matrix-bird-agent, targeting Russian organizations via HiveMQ and Element C2 channels.

Threat actors are abusing the legitimate Faronics Deploy platform to execute malicious PowerShell scripts and establish persistent remote access via ScreenConnect.

The suspected APT29 group (Cloaked Ursa) launched the Spring Ring campaign targeting over 150 employees with Microsoft Teams-based voice phishing to deploy RMM tools and custom PowerShell RATs.