Malvertising campaign leads to PS1Bot, a multi-stage malware framework

Author(s): Edmund Brumaghin, Jordyn Dunk
Organization: Cisco Talos

Open article directly Open article on Archive.org

2026-07-16 ⋅ Cisco Talos ⋅ Alex Karkins, Chetan Raghuprasad
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
CASTLESTEALER Remcos UAT-11795

2026-07-07 ⋅ Cisco Talos ⋅ Asheer Malhotra, Brandon White, Jungsoo An, Vanja Svajcer
UAT-7810 continues building ORB networks using new malware
DOGLEASH LONGLEASH JARLEASH UAT-7810

2026-05-05 ⋅ Cisco Talos ⋅ Asheer Malhotra, Brandon White, Jungsoo An
UAT-8302 and its box full of malware
SNOWLIGHT DracuLoader FINALDRAFT SNAPPYBEE STOWAWAY VShell UAT-8302

Propose Change Malvertising campaign leads to PS1Bot, a multi-stage malware framework