ForestTiger (ScoringMathTea) Backdoor
ForestTiger, also known as ScoringMathTea, is a backdoor used by Lazarus Group to provide remote access to compromised hosts. It is deployed…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
FudModule Rootkit: Version 3.1 Enhancements
FudModule is a kernel-mode rootkit used by Lazarus Group since at least 2022. Version 3.1 adds the ability to disable Windows Smart…
RelayShell: PHP Web Shell Deployed on Roundcube Servers
RelayShell is a previously undocumented PHP web shell used by Lazarus Group to compromise Roundcube webmail servers. It enables command and response…
Play Ransomware: Prevention Rates Collapse in 2026
Play ransomware is a notorious ransomware family. According to the Blue Report 2026, prevention effectiveness against Play dropped from 50% to 13%,…
GoReShell: Windows Backdoor Using Reverse SSH
GoReShell is a Windows backdoor used by the PurpleHaze threat cluster. It leverages functionalities from the reverse_ssh tool to establish reverse SSH…
reverse_ssh Backdoor Used for Persistent Access
The China-nexus APT used reverse_ssh binaries to maintain persistent access to compromised vCenter instances.
Kimwolf v7 Android Botnet Uses HTTP/2 to Evade DDoS Detection
Cybersecurity researchers have uncovered a new version of the Kimwolf/AISURU Android and IoT botnet, tracked as Kimwolf v7, which introduces significant enhancements…
SopraVPN: Malicious WireGuard-Based VPN Client
SopraVPN is a trojanized VPN client distributed by UAC-0145 via SourceForge. It is compiled from WireGuard source code with modifications that allow…
DeadLock Ransomware Abuses Polygon Smart Contracts for Resilient Extortion Infrastructure
Microsoft Threat Intelligence has uncovered that the DeadLock ransomware group is leveraging decentralized infrastructure, including Polygon smart contracts and the Session messaging…
DeadLock Ransomware: Technical Analysis
DeadLock ransomware uses hybrid cryptography (Curve25519 and XChaCha20), selective encryption, and geofencing. It employs an HTML-based recovery chat that interacts with Polygon…