Lynx Ransomware Overview
Lynx ransomware is a malware family used by the Lynx affiliate program. It has been observed in attacks alongside DeadLock, indicating a…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
w2.js: Malicious JavaScript Payload in BdThemes Supply Chain Attack
w2.js is a JavaScript payload used in the BdThemes supply chain attack. It contacts a C2 server, creates rogue admin accounts, installs…
x.js: Deterministic Credential Generator Payload
x.js is an alternate payload in the BdThemes attack that generates deterministic administrative credentials based on the victim website's hostname, allowing attackers…
emer-run.php: PHP Web Shell Deployed in BdThemes Attack
emer-run.php is a PHP web shell installed via a fake plugin in the BdThemes supply chain attack, enabling remote code execution on…
Magic-Login Backdoor: Unauthenticated Admin Access
The magic-login backdoor is a persistence module installed in the mu-plugins directory that allows unauthenticated administrative entry via a URL parameter targeting…
PhantomGraph: Backdoor with OneDrive C2
PhantomGraph is a backdoor that shares code overlap with PhantomCore. It consists of two DLL modules: SysExcSvc.dll for receiving commands and exfiltrating…
HelloInjector: Loader DLL Sideloaded via ViPNet Update
HelloInjector is a malicious loader DLL that is sideloaded by the ViPNet update binary itcsrvup64.exe. It injects itself into svchost.exe processes and…
HelloProxy: Hidden Proxy and Loader
HelloProxy is a hidden proxy and loader used in the HelloNet attack. It loads additional modules from a C2 server and interferes…
HelloBackdoor: Rust Implant for File Transfer and Command Execution
HelloBackdoor is a Rust-based implant discovered in systems infected by the HelloNet attack. It enables file uploads and downloads to and from…
Havoc C2: Framework Deployed via TrueConf Client Zero-Day
Havoc C2 is a command-and-control framework that was deployed in campaigns exploiting CVE-2026-3502, a zero-day in the TrueConf client. The attacks targeted…