CastleLoader: Malware Loader Associated with GrayBravo
CastleLoader is a malware loader used by the GrayBravo threat cluster to deliver payloads such as CastleStealer. It has been observed in…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors tampered with the official release channels…
Gh0st RAT: Remote Access Trojan Used by Multiple Threat Actors
Gh0st RAT is a well-known remote access trojan that has been used by various cybercriminal and state-sponsored groups. It offers extensive remote…
ValleyRAT (Winos 4.0): Remote Access Trojan Used by Silver Fox
ValleyRAT, also known as Winos 4.0, is a variant of Gh0st RAT that provides remote access, C2 communication, and post-compromise capabilities. It…
WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool
A new active campaign is targeting WhatsApp Desktop and WhatsApp Web users across multiple countries, including Malaysia, Brazil, India, Mexico, Singapore, the…
Malicious npm Packages Disguised as PostCSS Tools Deploy Windows RAT
Cybersecurity researchers at JFrog have uncovered a set of malicious npm packages that masquerade as legitimate PostCSS tools to deliver a Windows-based…
BeaverTail: JavaScript Malware Used in Contagious Interview Campaign
A known JavaScript malware associated with the Contagious Interview campaign. Delivered via malicious packages and extensions, it searches for configuration files and…
InvisibleFerret: Python Backdoor for Cryptocurrency and Credential Theft
InvisibleFerret is a Python backdoor deployed by the Fake Font campaign. It steals cryptocurrency wallets, browser credentials, and establishes persistent access on…
MYRA: Linux Remote Access Trojan
MYRA is a full-featured Linux RAT delivered via a malicious npm package 'apintergrationpost', claiming to be a Node.js integration client for red…
FortigateSniffer: Golang-Based Tool for Passive Credential Sniffing on FortiGate
FortigateSniffer is a Golang-based tool used in the FortiBleed campaign to passively intercept authentication traffic from compromised FortiGate firewalls. It leverages the…