PhantomFS: Open-Source Windows Honeypot Using Projected File System
PhantomFS is a free open-source Windows honeypot that uses the Projected File System to project decoy files in memory. When accessed, it…
Tag: Windows
PsExec
PsExec is a Microsoft Sysinternals tool used for remote command execution. Qilin ransomware affiliates used PsExec for lateral movement via administrative shares…
Fake 7-Zip Installers Recruit Devices into Lurking Lizard Proxy Botnet
Cybersecurity researchers at Infoblox have uncovered a threat actor tracked as Lurking Lizard, operating an end-to-end malicious residential proxy business since at…
WireVPN: Malicious VPN App Used in Proxy Botnet Campaign
WireVPN is a malware-laced VPN application used by Lurking Lizard to recruit devices into a residential proxy botnet. Available on Android, macOS,…
New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS
Cybersecurity researchers at LevelBlue have identified a new Java-based remote access trojan (RAT) named QuimaRAT, which is capable of targeting Windows, Linux,…
QuimaRAT: A New Java-Based Cross-Platform Remote Access Trojan
QuimaRAT is a Java-based remote access trojan (RAT) advertised under a malware-as-a-service (MaaS) model, capable of targeting Windows, Linux, and macOS. It…
Quima Control: The Core Remote Administration Tool of the Quima Suite
Quima Control, also known as QuimaRAT, is a remote administration tool with 74 Windows and 46 macOS and Linux modules. It is…
Armored Likho Targets Government and Power Sector with BusySnake Stealer
A previously undocumented threat actor, Armored Likho, has been attributed to cyber attacks targeting government agencies and the electric power sector across…
CVE-2025-9491: Windows Shortcut Vulnerability Exploited by Armored Likho
CVE-2025-9491 is a now-patched Windows shortcut vulnerability (ZDI-CAN-25373) that allows remote code execution. Addressed by Microsoft in November 2025 Patch Tuesday, it…
BusySnake Stealer: Python-Based Infostealer Used by Armored Likho
BusySnake Stealer is a Python-based information stealer targeting Windows systems, used by Armored Likho. It implements evasion techniques like dynamic bytecode decryption…