Labs

Medium

Campaign, LOLBin, Malware

Defense Evasion

Network, Windows

PureLog Stealer distributed via trojanized TaskScheduler targets Italy

A sophisticated phishing campaign targets manufacturing/government sectors in Italy, Finland, and Saudi Arabia via trojanized TaskScheduler loader. It abuses RegAsm.exe […]

Learn more

Medium

Campaign, Malware

Defense Evasion

EDR, Sysmon, Windows

Matanbuchus 3.0: Advanced C++ Loader Evolving MaaS

Matanbuchus 3.0 is a C++-based Malware-as-a-Service loader that represents a major evolutionary step from earlier Matanbuchus branches. First observed as […]

Learn more

Medium

APT, Campaign, Malware

Persistence

EDR

Fancy Bear's NotDoor: Hijacking Outlook for NATO Espionage via OneDrive Side-Loading

The Russian-linked Fancy Bear (aka APT28) has unleashed NotDoor, a high-stakes espionage campaign targeting NATO member countries. By side-loading through […]

Learn more

Medium

APT, Campaign

Privilege Escalation

EDR, Sysmon, Windows

Silver Fox’s ICMLuaUtil UAC Bypass: Abusing Auto-Elevated COM for Stealthy Privilege Escalation

In modern Windows security architecture, User Account Control (UAC) serves as a key defensive layer against unauthorized privilege escalation. Its […]

Learn more

Medium

Campaign, Malware

Persistence

EDR, Windows

Latrodectus Unmasked: The Art of Persistent Execution via Trusted Binaries

In a recent Latrodectus malware campaign, we observed a particularly insidious choice for persistence by modifying Windows registry keys to […]

Learn more

High

Campaign, CVE

Lateral Movement, Privilege Escalation

EDR, Sysmon, Windows

Patch Management Under Fire: Navigating the Vulnerabilities of WSUS in Enterprise Cybersecurity

In the realm of cybersecurity, robust patch management is essential to fortify enterprise networks against evolving threats, particularly in Active […]

Learn more

Medium

CyberCrime, LOLBin

Command and Control, Credential Access, Defense Evasion, Execution, Privilege Escalation

EDR

When Defense Tools Turn Adversarial: Detecting the Misuse of Velociraptor in Modern Attack Chains

We are witnessing a significant evolution in adversary tactics: threat actors are actively leveraging legitimate, open-source incident response tools like […]

Learn more

Medium

Campaign, CVE

Persistence

EDR, Sysmon, Windows

Inside RemCom’s Latest Evolution: Weaponizing WinRAR Vulnerability CVE-2025-8088 in 2025 Attacks

WinRAR is one of the most popular file compression tools globally, known for its ability to efficiently compress, package and […]

Learn more

High

Bypass, LOLBin

Defense Evasion, Execution

Windows

How EDR-Freeze Turns Windows Debugging into a Weapon Against Antivirus and EDR

It has been over two years since the distribution of the PPL-Blade and Terminator tools, which leveraged the Bring-Your-Own-Vulnerable-Driver (BYOVD) […]

Learn more

Medium

Campaign, LOLBin, Malware

Defense Evasion, Execution

Sysmon, Windows

Beyond the Takedown: How Lumma Stealer Maintains Persistent Campaigns Worldwide

Despite the takedown efforts, Lumma Stealer’s continued adaptability and innovative tactics have allowed it to maintain active campaigns, posing persistent […]

Learn more