A suspected China-nexus threat activity cluster, codenamed Operation DragonReturn by Seqrite Labs, has been targeting Indian taxpayers, tax professionals, and corporate finance…
REF3864 is an intrusion set attributed by Elastic Security Labs for targeting Chinese-speaking regions with malicious installers for Telegram and Opera, delivering…
SADBRIDGE is a custom malware loader that uses PoolParty Variant 7 to inject shellcode into explorer.exe. It is designed to deploy GOSAR,…
GOSAR is a Golang-based remote access trojan that reimplements Quasar RAT. It is deployed by the SADBRIDGE loader and has been used…
Cybereason is a cybersecurity company that analyzed the use of PoolParty Variant 7 in fake installer attack chains delivering ValleyRAT. Researcher Hajime…