Cybersecurity researchers have uncovered a cyber espionage campaign targeting Myanmar government and IT sectors, dubbed Operation QUICSILVER. The campaign, first observed in…
A newly uncovered cyber espionage operation dubbed SilkParasite has been targeting government bodies in Central Asia, according to a technical report from…
HelloInjector is a malicious loader DLL that is sideloaded by the ViPNet update binary itcsrvup64.exe. It injects itself into svchost.exe processes and…
ViPNet is a product suite by InfoTeCS that provides secure communications. Its update mechanism was hijacked in the HelloNet attack to sideload…
Cybersecurity researchers at Zscaler ThreatLabz have uncovered a malicious campaign targeting government entities in the Middle East, attributed to an East Asian…
TELESHIM is a 32-bit Windows backdoor that abuses the Telegram API for command-and-control communication. It uses DLL side-loading via RegSchdTask.exe and AsTaskSched.dll,…
MIXEDKEY is a reflective loader used in the attack chain to decrypt and execute the final BINDCLOAK payload. It is delivered via…
Group-IB has uncovered a China-nexus cyber operation tracked as JadeProx, which has been targeting government, healthcare, and education organizations across Asia and…
TriBack Loader is a previously undocumented Windows loader used by the JadeProx operation. It employs DLL sideloading with four infection chains, using…
A modular .NET RAT delivered via DLL sideloading through a signed Ubisoft binary, part of the DlrtyGames campaign.