Malpedia Library

2026-07-20 ⋅ Medium Ireneusz Tarnowski ⋅ Ireneusz Tarnowski
INC Ransom: Infrastructure Analysis, Operational Tradecraft, and Detection Opportunities
INC INC

2026-07-17 ⋅ Volexity ⋅ Sean Koessel, Steven Adair
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
Behinder UTA0533

2026-07-17 ⋅ OpenSourceMalware ⋅ Jenn Gile
ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
JADESNOW

2026-07-17 ⋅ Elastic ⋅ Daniel Stepanic
New North Korean campaign uses fake coding interviews to steal developer credentials
OtterCookie

2026-07-16 ⋅ cocomelonc ⋅ cocomelonc
Malware development trick 60: Function stomping (remote process). Simple C example

2026-07-16 ⋅ Cisco Talos ⋅ Alex Karkins, Chetan Raghuprasad
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
CASTLESTEALER Remcos UAT-11795

2026-07-16 ⋅ Hacking But Legal ⋅ Jackie Singh
North Korea Is Hiring
StoatWaffle

2026-07-16 ⋅ Microsoft Security ⋅ Balaji Venkatesh S, Microsoft Security Research
ACR Stealer: Two observed intrusion chains amid increased threat activity
ACR Stealer

2026-07-16 ⋅ Elastic ⋅ Cyril François
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
TELEPUZ

2026-07-15 ⋅ Zscaler ⋅ Ruchna Nigam
ClaudeFix: Shared Claude Chats Meet ClickFix
MacSync

2026-07-15 ⋅ Symantec ⋅ Threat Hunter Team
Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
Daxin

2026-07-14 ⋅ Checkmarx ⋅ Pavan Gudimalla
Sequel to ChainVeil npm Malware Targets Vite Ecosystem
JADESNOW

2026-07-14 ⋅ Ctrl-Alt-Intel ⋅ Ctrl-Alt-Intel
Burnt by Burgers: Highlighting Void Blizzard’s Russian State Links

2026-07-14 ⋅ PICUS Security ⋅ Sıla Özeren Hacıoğlu
FSB Center 16: How Russian hackers exploit routers via SNMP and Cisco Smart Install

2026-07-13 ⋅ Github (VenzoV) ⋅ VenzoV
Lockbit 5.0 loader technical analysis
LockBit

2026-07-13 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
[QuickNote] SolidPDFCreator – Mustang Panda Stage-1 Backdoor (Target India)

2026-07-12 ⋅ OX Security ⋅ Moshe Siman Tov Bustan
Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials
OtterCandy

2026-07-07 ⋅ Proofpoint ⋅ Greg Lesnewich, Mark Kelly, Proofpoint Threat Research Team
One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation
IceCube

2026-07-07 ⋅ Cisco Talos ⋅ Asheer Malhotra, Brandon White, Jungsoo An, Vanja Svajcer
UAT-7810 continues building ORB networks using new malware
DOGLEASH LONGLEASH JARLEASH UAT-7810

2026-07-02 ⋅ Mrtiepolo ⋅ Gianluca Tiepolo
Operation Turb00 — Part 3: Unmasking the SnappyClient RAT
HijackLoader SnappyClient