APT ANALYSIS

♣️Behind Khmer Shadow: Targeted espionage against Cambodian government entities 👁Blog : https://www.acronis.com/en/tru/posts/behind-khmer-shadow-targeted-espionage-against-cambodian-government-entities ♣️Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected 👁Blog : https://www.sygnia.co/blog/operation-highland-velvet-ant ♣️ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit 👁Blog : https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit ♣️Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion 👁Blog : https://www.zscaler.com/blogs/security-research/shai-hulud-campaign-evolution-miasma-hades-and-ai-scanner-evasion ♣️Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open 👁Blog : https://www.trendmicro.com/en_us/research/26/f/old-winrar-flaw-fuels-attacks-on-ukraine.html ♣️OceanLotus: From external espionage to domestic targeting 👁Blog : https://www.welivesecurity.com/en/eset-research/oceanlotus-external-espionage-domestic-targeting ♣️Silabrat hijackloader trojan malware 👁Blog : https://www.group-ib.com/blog/silabrat-hijackloader-trojan-malware ♣️Interlock and Rhysida within the ransomware ecosystem 👁Blog : https://www.ibm.com/think/x-force/interlock-and-rhysida-within-the-ransonware-ecosystem ♣️Inside OnyxC2: The New Stealer Targeting 210 Apps 👁Blog : https://www.blackfog.com/inside-onyxc2-the-new-stealer-targeting-210-apps ♣️New NPM Supply Chain Campaign Identified : A Multi-Stage Cryptocurrency Malware with More Than 2.7 million Downloads 👁Blog : https://www.cyfirma.com/research/new-npm-supply-chain-campaign-identified-a-multi-stage-cryptocurrency-malware-with-more-than-2-7-million-downloads ♣️Initial Access: REDCap Exploitation and INFINITERED 👁Blog : https://cloud.google.com/blog/topics/threat-intelligence/prc-targets-us-medical-research ♣️FishMonger’s arsenal upgraded: SprySOCKS for Windows 👁Blog : https://www.welivesecurity.com/en/eset-research/fishmongers-arsenal-upgraded-sprysocks-windows ♣️Operation Turb00 — Part 1: Analyzing and Hunting a Vidar Campaign 👁Blog : https://mrtiepolo.medium.com/operation-turb00-analyzing-and-hunting-a-vidar-campaign-b45481d8cd74 ♣️Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server 👁Blog : https://hunt.io/blog/ababil-of-minab-iranian-hackers-exposed-la-metro-breach-open-directory ♣️Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2 👁Blog : https://www.genians.co.kr/en/blog/threat_intelligence/narwhalrat ♣️Phishing Campaign Targets Banks with Fileless Phantom Stealer Malware 👁Blog : https://www.fortra.com/blog/phishing-campaign-targets-banks-fileless-phantom-stealer-malware ♣️Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework 👁Blog : https://www.sekoia.com/blog/unveiling-errtraffic-inside-a-growing-clickfix-malware-distribution-framework ♣️macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT 👁Blog : https://www.netskope.com/blog/macos-clickfix-lures-deploy-applescript-stealer-persistent-rat ♣️ClickFix Campaign Generated Via AI Delivers SmartRAT 👁Blog : https://www.zscaler.com/blogs/security-research/clickfix-campaign-generated-ai-delivers-smartrat ♣️Someone's Hands Are on Your Keyboard Then Your Whole Network. Courtesy of ClickFix, Potemkin, RMMProject and EtherRAT 👁Blog : https://www.huntress.com/blog/potemkin-loader-rmmproject-clickfix-attack ♣️AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale 👁Blog : https://censys.com/blog/adaptixc2-open-source-c2-framework ♣️Honey trap: examine the attacks of the group Hive0117 on accountants of companies in Russia and the CIS countries 👁Blog : https://www.f6.ru/blog/honey-trap-hive0117 ♣️From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet 👁Blog : https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise ♣️Prinz Eugen ransomware: a deep dive into a new Go-based encryptor 👁Blog : https://www.threatdown.com/blog/prinz-eugen-ransomware-a-deep-dive-into-a-new-go-based-encryptor ♣️From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware 👁Blog : https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware ♣️Lost in relocation: analysis of a new loader distributing CASTLESTEALER 👁Blog : https://www.elastic.co/security-labs/oxloader-malware-loader-infostealer ♣️Killing me gently: Inside Gentlemen’s EDR killer framework 👁Blog : https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework ♣️Fortibleed: Anatomy of the FortiBleed campaign based on the server that the attackers themselves left exposed. 👁Blog : https://zenox.ai/en/fortibleed-anatomy-of-the-fortibleed-campaign-based-on-the-server-that-the-attackers-themselves-left-exposed ♣️GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain 👁Blog : https://blog.synapticsystems.de/ghostshell-mb-0009-targeting-ukraines-uav-operations-and-defense-supply-chain ♣️An Income Tax Assessment Notice Phishing Campaign Delivering Malware 👁Blog : https://www.cyfirma.com/research/an-income-tax-assessment-notice-phishing-campaign-delivering-malware ♣️Inside FortiBleed: Reverse Engineering the CyberStrike Harvester Behind a Global FortiGate Credential Factory 👁Blog : https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory ♣️Analyzing TAX#TRIDENT: Fake Indian Tax Lures Pivot Across ZIP, VBS, Stego and PHP-Wrapped VBS Delivery 👁Blog : https://www.securonix.com/blog/taxtrident-indian-fax-lures ♣️StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader 👁Blog : https://securelist.com/strikeshark-campaign/120326 ♣️From Langflow to Monero: Inside CVE-2026-33017 Cryptominer 👁Blog : https://www.trendmicro.com/en_us/research/26/f/from-langflow-to-monero-inside-cve-2026-33017-cryptominer.html ♣️Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading 👁Blog : https://blog.synapticsystems.de/from-winrar-ads-to-reflective-loading-reversing-a-new-uac-0226-giftedcrook-chain ⭐️@APTANALYSIS