Mustang Panda Deploys Signed Windows Rootkit in Updated CoolClient Backdoor
Mustang Panda (aka HoneyMyte) has been observed deploying an updated version of the CoolClient backdoor that includes a signed Windows kernel-mode rootkit,…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
COOLCLIENT: Updated Backdoor with Kernel-Mode Driver
COOLCLIENT is a backdoor used by Mustang Panda. An updated variant deploys a signed kernel-mode driver (Msagent.sys) to hide processes and protect…
msagent.sys Rootkit Driver
msagent.sys is a signed Windows kernel-mode driver used by the latest CoolClient variant. It provides stealth by hiding processes, files, registry keys,…
Ransomware as a Key Cybercrime Tool Used by Transnational Criminal Organizations
Ransomware is a type of malware deployed by Transnational Criminal Organizations to extort victims. The White House memo highlights ransomware as one…
Antino: Windows Backdoor
Antino is a Windows backdoor used by Jewelbug, delivered via malicious HTML Application (HTA) downloaders. It uses Microsoft Graph API for C&C…
ClientKing: Rust Implant for Linux and Routers
ClientKing is a Rust implant used by Jewelbug that targets Linux servers and routers. It uses five C&C channels, including a DNS…
XG-Web: Browser-Centric Remote-Access and Information-Stealing Framework
XG-Web is a browser-centric remote-access and information-stealing framework used by Jewelbug. It turns a victim's browser into a full remote-control channel, allowing…
PDF Viewer: Malicious Browser Extension
PDF Viewer is a malicious browser extension used by Jewelbug that runs on Chrome and Firefox. It requests dangerous permissions to access…
GhostDesk Chrome Spyware Distributed via Fake CCleaner
A fake CCleaner installer from a lookalike domain delivers the GhostDesk Chrome extension, which steals credentials, captures screenshots, and logs keystrokes.
HACKERAI C2: AI-Assisted Malware Project Using GitHub Gists
HACKERAI C2 is an AI-assisted malware project that overlaps with PATCHCORD and SHEETCORD but uses GitHub Gists for C2. It implements dedicated…