A suspected China-nexus threat activity cluster, codenamed Operation DragonReturn by Seqrite Labs, has been targeting Indian taxpayers, tax professionals, and corporate finance…
SADBRIDGE is a custom malware loader that uses PoolParty Variant 7 to inject shellcode into explorer.exe. It is designed to deploy GOSAR,…
GOSAR is a Golang-based remote access trojan that reimplements Quasar RAT. It is deployed by the SADBRIDGE loader and has been used…
Cybereason is a cybersecurity company that analyzed the use of PoolParty Variant 7 in fake installer attack chains delivering ValleyRAT. Researcher Hajime…