Arnold Chan

Suspected North Korean threat actors are using 13 malicious npm packages to deliver WeaselBiscuit, a lightweight stealer targeting Chrome extension storage and system metadata.

Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.

MovieReaper uses compromised torrent repositories and the Solana blockchain to deploy a multi-stage modular framework targeting diverse global sectors.

The ORAX Phishing-as-a-Service platform utilizes WebSockets and SignalR to bypass MFA by synchronizing an attacker-controlled page with real authentication sessions without a traditional reverse proxy.

The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.

The SilkParasite campaign, active since 2022, utilizes shared SpiceRAT, NodeEdgeRAT, and NomadRAT infrastructure to target government and energy sectors across Central Asia.

Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.

Researchers at pwn.ai discovered the Click2Shell attack chain, which leverages a WordPress core selector injection vulnerability to force theme installations and achieve remote code execution through theme-specific flaws.

Threat actors are chaining three JFrog Artifactory vulnerabilities to bypass authentication, escalate privileges to administrator, and deploy Rust-based backdoors.

Settra ransomware targets consumer services and manufacturing sectors using MeshAgent RMM for persistence and Bring Your Own Vulnerable Driver (BYOVD) to disable security tools.