Cybersecurity researchers have identified multiple ClickFix campaigns deploying three new malware loaders: BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. These campaigns use…
Potemkin is a custom x64 loader that uses a domain generation algorithm (DGA) to find its C2 server. It reflectively loads follow-on…
EtherRAT is a remote access trojan (RAT) delivered via the Potemkin loader in ClickFix campaigns. It is used alongside RMMProject for credential…
Chisel is a reverse SOCKS tunnel tool used by threat actors in the Potemkin campaign for persistent access and lateral movement.
Cloudflare tunnel was set up by threat actors in the Potemkin campaign to maintain persistent access to compromised systems.
WMIExec is a lateral movement tool used by threat actors in the Potemkin campaign to spread across the network and reach the…
SMBExec is a lateral movement tool used by threat actors in the Potemkin campaign to propagate EtherRAT across multiple hosts.