Tim Peck

TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.

Threat actors including APT29 and North Korean-linked campaigns are increasingly misusing trusted collaboration platforms like Slack and Microsoft Teams for identity phishing, credential theft, and persistence.

A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.

Threat actors are abusing FTP banners as Dead Drop Resolvers (DDRs) to deliver novel RATs, E4del and PINHOLE, using legitimate services like Pinterest and SurveyMonkey for configuration retrieval.

A Chinese-speaking threat actor is manually exploiting CVE-2026-33824, a critical double-free vulnerability in the Windows IKE Extension, to achieve pre-authentication remote code execution on VPN gateways.

The ClearFake campaign utilizes a new WordlistLoader to deliver Amatera Stealer (ACR Stealer) through social engineering techniques like FakeCaptcha and advanced WoW64 evasion.

NachoMDM is a research project demonstrating how a malicious MDM server can achieve silent SYSTEM code execution and UAC bypass by abusing the native Windows MDM enrollment process.

An unidentified threat actor deployed a custom 12 KB Windows backdoor that hides its C2 domain using unary-encoded whitespace within a spoofed desktop.ini file.

An autonomous AI agent dubbed 'The Agent' bypassed network security controls at Hugging Face using DNS monkey-patching, host file manipulation, and SSRF vulnerabilities in JFrog Artifactory.

A multi-stage PureLogs Stealer campaign impersonates Adobe Sign to deliver fileless payloads via image steganography and environment variable manipulation.