Labs

Medium

Campaign, CVE

Persistence

EDR, Sysmon, Windows

Inside RemCom’s Latest Evolution: Weaponizing WinRAR Vulnerability CVE-2025-8088 in 2025 Attacks

WinRAR is one of the most popular file compression tools globally, known for its ability to efficiently compress, package and […]

Learn more

High

Bypass, LOLBin

Defense Evasion, Execution

Windows

How EDR-Freeze Turns Windows Debugging into a Weapon Against Antivirus and EDR

It has been over two years since the distribution of the PPL-Blade and Terminator tools, which leveraged the Bring-Your-Own-Vulnerable-Driver (BYOVD) […]

Learn more

Medium

Campaign, LOLBin, Malware

Defense Evasion, Execution

Sysmon, Windows

Beyond the Takedown: How Lumma Stealer Maintains Persistent Campaigns Worldwide

Despite the takedown efforts, Lumma Stealer’s continued adaptability and innovative tactics have allowed it to maintain active campaigns, posing persistent […]

Learn more

High

Bypass, Campaign

Defense Evasion, Impact

EDR, Sysmon, Windows

Chepalus APT: Sophisticated Ransomware Operations Leveraging DLL Side-Loading

The Chepalus APT group is a sophisticated cyber threat actor known primarily for conducting targeted ransomware campaigns with advanced evasion […]

Learn more

Medium

Campaign, LOLBin

Privilege Escalation

EDR, Sysmon, Windows

Wbadmin Weaponized: The Silent Credential Dumping Behind Bumblebee’s Enterprise Attacks

A recent cyberattack campaign has leveraged the Bumblebee malware as an initial infection vector, demonstrating increasing sophistication in targeting enterprise […]

Learn more

Medium

Campaign, Malware

Defense Evasion, Persistence

EDR, Sysmon, Windows

Remcos RAT Campaigns Escalate: Advanced Evasion and Infection Techniques Uncovered

Remcos malware operations have remained highly active, constantly evolving to evade detection. In a recent campaign, the infamous Remcos RAT, […]

Learn more

Medium

Bypass, Campaign

Defense Evasion

EDR, Sysmon, Windows

Concealing Execution Flows: Device Credential Deployment and the Art of Persistent Intrusion

The concealment of execution flows remains a core pillar of advanced cyber operations, enabling persistent intrusion and evasion from both […]

Learn more

Medium

CyberCrime, Malware

Command and Control, Credential Access, Defense Evasion, Execution

Cloud

When Malicious Traffic Blends In: Trojan-Proxies Leveraging DNS Over HTTPS for Stealth

Protocol tunneling enables malware and threat actors to stealthily communicate with their command-and-control (C2) servers by encapsulating malicious traffic within […]

Learn more

Medium

Campaign, LOLBin

Defense Evasion, Execution

Cloud, EDR, Sysmon

How Stealth Falcon Abused WebDAV Zero-Day CVE-2025-33053 Before Microsoft’s Patch

On the last cumulative patch of June Microsoft has addressed several issue. One of the most important is the vulnerability […]

Learn more

Medium

Campaign, Malware

Defense Evasion, Execution

Cloud, EDR, Sysmon

The Italian RAT Campaign: When Malicious JARs Wear the Mask of Innocent PNG Images

During a recent malware campaign targeting Italian companies, threat actors disguised stager components to evade security controls by masquerading a […]

Learn more