Malpedia Library

2026-07-21 ⋅ DTEX ⋅ Michael Barnhart
From Payroll to Pyongyang: The DPRK IT Worker Money Trail

2026-07-21 ⋅ ANY.RUN ⋅ ANY.RUN
SnappyClient Analysis
SnappyClient

2026-07-20 ⋅ sysdig ⋅ Michael Clark
JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models
JadePuffer

2026-07-20 ⋅ Medium Ireneusz Tarnowski ⋅ Ireneusz Tarnowski
INC Ransom: Infrastructure Analysis, Operational Tradecraft, and Detection Opportunities
INC INC

2026-07-18 ⋅ Github (muhammadzidane632) ⋅ Zdn2Pwn
Hopeless
Hopeless

2026-07-17 ⋅ Volexity ⋅ Sean Koessel, Steven Adair
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
Behinder UTA0533

2026-07-17 ⋅ OpenSourceMalware ⋅ Jenn Gile
ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
JADESNOW

2026-07-17 ⋅ Elastic ⋅ Daniel Stepanic
New North Korean campaign uses fake coding interviews to steal developer credentials
OtterCookie

2026-07-16 ⋅ Cisco Talos ⋅ Alex Karkins, Chetan Raghuprasad
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
CASTLESTEALER Remcos UAT-11795

2026-07-16 ⋅ Hacking But Legal ⋅ Jackie Singh
North Korea Is Hiring
StoatWaffle

2026-07-16 ⋅ Microsoft Security ⋅ Balaji Venkatesh S, Microsoft Security Research
ACR Stealer: Two observed intrusion chains amid increased threat activity
ACR Stealer

2026-07-16 ⋅ Elastic ⋅ Cyril François
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
TELEPUZ

2026-07-15 ⋅ Github (Yavuzhanzgen) ⋅ Yavuzhan Özgen
StealC V2 Malware Technical Analysis
Stealc

2026-07-15 ⋅ fs:0xC0
Lx(Base) RAT: A Technical Deep Dive
LxBase RAT

2026-07-15 ⋅ Zscaler ⋅ Ruchna Nigam
ClaudeFix: Shared Claude Chats Meet ClickFix
MacSync

2026-07-15 ⋅ OpenSourceMalware ⋅ Paul McCarty
PolinRider Confirmed Footprint Grows 6.5x Since March
JADESNOW

2026-07-15 ⋅ Expel ⋅ AARON WALTON
Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident
Ghost RAT

2026-07-15 ⋅ Symantec ⋅ Threat Hunter Team
Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
Daxin

2026-07-14 ⋅ Checkmarx ⋅ Pavan Gudimalla
Sequel to ChainVeil npm Malware Targets Vite Ecosystem
JADESNOW

2026-07-14 ⋅ Ctrl-Alt-Intel ⋅ Ctrl-Alt-Intel
Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links