Vidar Infostealer: Commodity Malware Used by UNC7005
Vidar is a commodity infostealer used by UNC7005 to siphon data from Windows hosts. It is distributed via malicious URLs and phishing…
Tag: Windows
China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
The China-linked threat actor known as Jewelbug has been observed conducting cyber espionage against governments and militaries while simultaneously running a cryptocurrency…
AFD.sys: Windows Kernel Driver Targeted by Exploit
AFD.sys is a Windows kernel driver that provides Winsock functionality. It contains the privilege escalation vulnerability CVE-2026-68820, which was exploited by Lazarus…
Zoom Workplace VDI Client
Zoom Workplace VDI Client for Windows is affected by annotation vulnerabilities before versions 7.0.11 and 6.6.16. The flaws could allow a meeting…
New Passkey Attacks Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Three independent research efforts presented at Black Hat USA 2026 and in subsequent disclosures have demonstrated practical attacks against passkey implementations, undermining…
Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Attackers breached an organization's Oracle database via a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit named…
GoFlyDrv.sys: Vulnerable Driver Abused in BYOVD Attacks by Cruciferra
GoFlyDrv.sys is a vulnerable driver abused by Cruciferra as part of bring-your-own-vulnerable-driver (BYOVD) attacks to terminate security processes on Windows systems.
DevMan Ransomware: Technical Analysis and Capabilities
DevMan ransomware is a locker that targets Windows, ESXi, and Linux systems. It uses ChaCha20-Poly1305 encryption, fully encrypting files up to 3…
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
The operators of the DevMan ransomware-as-a-service (RaaS) scheme maintain a dedicated web platform that offers affiliates the ability to build payloads, oversee…
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate…