Malpedia Library

2026-03-20 ⋅ Nextron Systems ⋅ Pezier Pierre-Henri
RegPhantom Backdoor Threat Analysis
RegPhantom

2026-03-18 ⋅ Google ⋅ Google Threat Intelligence Group
The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors
GHOSTBLADE UNC6748

2026-03-18 ⋅ Google ⋅ Google Threat Intelligence Group
The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors
GHOSTBLADE

2026-03-17 ⋅ Seqrite ⋅ Sathwik Ram Prakki
Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency
Unidentified JS 007 (Zimbra Stealer)

2026-03-17 ⋅ NTT Security ⋅ Rintaro Koike, Ryu Hiyoshi
StoatWaffle, malware used by WaterPlum
StoatWaffle

2026-03-16 ⋅ Ransom-ISAC ⋅ François-Julien Alcaraz, Yashraj Solanki
Contagious Interview: VS Code to RAT
StoatWaffle

2026-03-13 ⋅ Scarlet Shark
Analyst’s Brief: Moonrise RAT
MoonRise

2026-03-13 ⋅ kmsec ⋅ Kieran Miyamoto
First instance of PylangGhost RAT observed on npm
PylangGhost

2026-03-12 ⋅ IBM X-Force ⋅ Golo Mühr
A Slopoly start to AI-enhanced ransomware attacks
Slopoly Hive0163

2026-03-12 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
Storm-2561

2026-03-12 ⋅ Palo Alto Networks Unit 42 ⋅ Lior Rochberger, Yoav Zemah
Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia
AppleChris CL-STA-1087

2026-03-12 ⋅ Gdata ⋅ John Dador
Endgame Harvesting: Inside ACRStealer’s Modern Infrastructure
ACR Stealer

2026-03-11 ⋅ Rapid7 ⋅ Rapid7
Iran’s Cyber Playbook in the Escalating Regional Conflict
Cyber Islamic Resistance

2026-03-11 ⋅ Hunt.io ⋅ Hunt.io
Operation Roundish: Uncovering an APT28 Roundcube Toolkit Used Against Ukrainian Government Targets

2026-03-10 ⋅ ZenoX ⋅ , ZenoX
VENON: The First Brazilian Banker RAT in Rust
VENON

2026-03-09 ⋅ Abstract Security ⋅ Abstract Security Threat Research Organization (ASTRO)
Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains Part 2
GolangGhost PylangGhost GolangGhost

2026-03-07 ⋅ OpenSourceMalware ⋅ OpenSourceMalware
PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos
JADESNOW

2026-03-06 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
AI as tradecraft: How threat actors operationalize AI
OtterCookie

2026-03-05 ⋅ Cisco Talos ⋅ Asheer Malhotra, Brandon White
UAT-9244 targets South American telecommunication providers with three new malware implants
BruteEntry PeerTime TernDoor UAT-9244

2026-03-05 ⋅ Symantec ⋅ Threat Hunter Team
Seedworm: Iranian APT on Networks of U.S. Bank, Airport, Software Company
Tsundere