Malware families, payloads, loaders, ransomware and related tooling.
Cybersecurity researchers have uncovered a sophisticated software supply chain attack dubbed 'SleeperGem' targeting the Ruby ecosystem. Three malicious gems were published to…
SleeperGem is a software supply chain attack targeting the Ruby ecosystem through three malicious RubyGems packages. The malware acts as a loader,…
Mistic was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
GHETTOVIBE is a VBS file saved in the Startup autorun directory, delivered through fake CAPTCHA checks in the UAC-0145 campaign targeting Ukrainian…
SCOUTCURL is a PowerShell script used by UAC-0145 to perform basic reconnaissance by harvesting details about infected machines.
FLUIDLEECH is a loader used in the UAC-0145 campaign, disguised as software for removing computer viruses to trick users.
LOADLOOP is a loader used alongside FLUIDLEECH in the UAC-0145 campaign to deliver additional malware payloads.
FREAKYPOLL is a Python-based backdoor deployed in the UAC-0145 campaign, providing remote access to infected systems.
COWARDDUCK is a full-featured Android backdoor distributed via messaging apps, disguised as security tools. It exfiltrates contacts, files, and geolocation using Dropbox…
SMARTAXE is a bespoke tool used by UAC-0145 to dynamically alter web page content based on the visitor, injecting fake CAPTCHA checks.