Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2026-10-06 ⋅ Huntress Labs ⋅ Harlan Carvey, Lindsey O'Donnell-Welch
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Akira Akira
2026-10-05 ⋅ Github (ksi-digital) ⋅ Christophe Hubert
"Ancient": a Linux IoT botnet with a custom ANCT C2 protocol
Ancient
2026-08-26 ⋅ Lumen ⋅ Black Lotus Labs
The infrastructure quartermaster: inside a China-nexus state enablement model
2026-08-26 ⋅ Github (blacklotuslabs) ⋅ Black Lotus Labs
The infrastructure quartermaster: inside a China-nexus state enablement model (IOCs)
2026-08-24 ⋅ Field Effect ⋅ Damon Toumbourou, Hugh Whitewood
A ClickFix cluster: Observed activity from recent ClickFix campaigns
Lorem Ipsum
2026-08-19 ⋅ Bitdefender ⋅ Gheorghe Adrian Schipor, Marius Andrei Baciu, Victor Vrabie
SilkParasite: Inside a China-nexus espionage cluster and its seven-family RAT ecosystem across Central Asia
BloodAlchemy ShadowPad SNAPPYBEE
2026-08-19 ⋅ Bitdefender ⋅ Martin Zugec
SilkParasite: Tracking a China-Nexus APT Across Central Asia
BloodAlchemy ShadowPad SNAPPYBEE SilkParasite
2026-08-18 ⋅ Gen ⋅ Vojtěch Krejsa
WordlistLoader Delivering Amatera via ClearFake Campaigns
ACR Stealer Amatera
2026-08-10 ⋅ LevelBlue ⋅ Rodel Mendrez
CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain
Babadeda
2026-08-03 ⋅ SOCRadar ⋅ SOCRadar
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
CountLoader
2026-07-28 ⋅ t0ast's blog ⋅ t0ast
Download Meccha Chameleon Cheats, Get Malware
Remus
2026-07-23 ⋅ NSA ⋅ NSA
NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign
ZimReaper
2026-07-23 ⋅ Group-IB ⋅ Group-IB
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake
AdaptixC2 reGeorg
2026-07-22 ⋅ Huntress Labs ⋅ Michael Tigges
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
SectopRAT
2026-07-16 ⋅ Elastic ⋅ Cyril François
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
TELEPUZ
2026-06-24 ⋅ JFrog Security ⋅ Guy Korolevski, Yair Benamou
Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer
JADESNOW
2026-06-17 ⋅ Rapid7 ⋅ Anna Širokova
Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain
Unidentified 125 (RAT, Dropping Elephant)
2026-06-16 ⋅ Huntress Labs ⋅ Anna Pham, Zach Rogers
Potemkin Loader & RMMProject - The Anatomy of a ClickFix Attack
EtherRAT Chisel Potemkin
2026-06-08 ⋅ SYGNIA ⋅ Sygnia Team
Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected
2026-05-19 ⋅ Microsoft ⋅ Steven Masada
Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware
Akira INC Qilin Rhysida AgendaCrypt Akira Broomstick INC Lumma Stealer Rhysida Vidar Fox Tempest