-
A campaign by the BITTER threat group that delivers a custom remote access trojan (RAT) called PapRAT to South Asian organizations. FortiGuard attributes the activity to the group with high confidence, based on lure filenames, command-and-control (C2) …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Fake Adobe Acrobat pages distribute signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs, CloudSEK’s researchers say.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft has resolved an issue in Windows 11 that prevented non-administrator users from connecting to devices with Administrator protection enabled. This fix was included in KB5127936, released on October 28, 2026, and is part of subsequent updates. …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Attackers are using compromised websites to present fake Cloudflare verification pages that steer Windows and macOS users toward executing malicious commands. The findings establish a delivery attempt, not a confirmed infection or identified malware fa…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft has released an emergency Windows update to remove trust in certificates associated with compromised eMudhra certificate authority keys. The out-of-band update, issued on October 26, 2026, eliminates seven certificates from the Windows trust …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Attackers are compromising camera management software to gain remote access, run malicious DLLs through a legitimate Windows component, and maintain persistent footholds in enterprise environments. The incidents show how overlooked surveillance applica…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A previously undocumented Sirius backdoor variant during a priority customer investigation, revealing a multistage campaign that hides malicious code inside legitimate Windows processes. The supplied analysis details stealthy remote access and persiste…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
BRONZE SANDCASTLE intrusions involving hidden Windows backdoors and the theft of the Active Directory database. The suspected China-based group combines legitimate applications, malicious DLLs, and encrypted payloads to execute code inside trusted proc…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
