Cybersecurity researchers at Acronis Threat Research Unit (TRU) have uncovered a new campaign targeting individuals and organizations in Cambodia with an open-source…
A newly documented Windows backdoor named SLEEPWALKER has been detailed by independent malware researcher Dominik Reichel. The implant remains dormant in memory…
SLEEPWALKER is a Windows backdoor that remains dormant until receiving a crafted network packet. It executes commands in a custom 23-instruction bytecode…
ESET Management Agent is a Windows executable (ERAAgent.exe) that SLEEPWALKER abuses via DLL side-loading. The backdoor impersonates dpapi.dll and loads each time…
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched Microsoft Windows…
Fortinet FortiGuard Labs has disclosed a long-standing supply chain attack targeting QuickFox, a VPN and network acceleration tool popular among overseas Chinese…
A suspected Chinese-speaking threat actor has been conducting a series of cyber attacks against government organizations in Central Asia since January 2025.…
SilkLurk is a backdoor deployed via DLL side-loading. It connects to a C2 server, collects victim information, and can execute commands, update…
Cybersecurity researchers at Blackpoint Cyber have uncovered a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as…
HollowFrame is a previously undocumented Go-based loader framework used in a spear-phishing attack targeting a law firm. It is launched via DLL…