Tim Peck

The MALFEX threat actor is using malicious npm packages like 'imgdecode' to deliver a native Windows DLL loader that injects shellcode and a remote access tool into developer workstations.

An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.

AvisLoader is a Windows malware loader that utilizes the Tox peer-to-peer messaging protocol for resilient command-and-control and is delivered via ClickFix social engineering lures.

Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.

The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).

The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.

A pre-authentication heap buffer overflow in AnyDesk for Linux version 8.0.2 allows remote attackers to execute root commands via direct TCP port 7070 connections.

Threat actors are chaining two vulnerabilities in the AhsayCBS backup utility to achieve remote code execution and deploy XMRig cryptominers and JSP webshells.

The Kimsuky threat group is utilizing malicious Hangul (HWP) resume documents to deploy Quasar RAT and ultimately the Funhouse ransomware variant.

Adversaries utilize eBPF rootkits like Bad-bpf to evade traditional Linux integrity monitoring by intercepting syscalls and rewriting user-space memory without modifying kernel symbols.