Labs

Medium

CyberCrime, Malware

Command and Control, Credential Access, Defense Evasion, Execution

Cloud

When Malicious Traffic Blends In: Trojan-Proxies Leveraging DNS Over HTTPS for Stealth

Protocol tunneling enables malware and threat actors to stealthily communicate with their command-and-control (C2) servers by encapsulating malicious traffic within […]

Learn more

Medium

Campaign, LOLBin

Defense Evasion, Execution

Cloud, EDR, Sysmon

How Stealth Falcon Abused WebDAV Zero-Day CVE-2025-33053 Before Microsoft’s Patch

On the last cumulative patch of June Microsoft has addressed several issue. One of the most important is the vulnerability […]

Learn more

Medium

Campaign, Malware

Defense Evasion, Execution

Cloud, EDR, Sysmon

The Italian RAT Campaign: When Malicious JARs Wear the Mask of Innocent PNG Images

During a recent malware campaign targeting Italian companies, threat actors disguised stager components to evade security controls by masquerading a […]

Learn more

High

Bypass

Defense Evasion

EDR, Windows

Inside Ghosting AMSI: A Novel, Patchless Method to Bypass Windows Anti-Malware Defenses

The Antimalware Scan Interface (AMSI) is a security feature developed by Microsoft and integrated into Windows 10 and later versions […]

Learn more

Medium

APT, LOLBin

Defense Evasion, Execution

EDR, Sysmon, Windows

Unveiling Earth Alux’s VARGEIT Backdoor: Leveraging Legitimate Debuggers for Cyber Espionage

Recently, the use of legitimate Windows debugging tool to load malicious code into memory has been observed. The APT Earth […]

Learn more

High

APT, Campaign, LOLBin

Defense Evasion

EDR, Sysmon, Windows

Massive Reach, Agile Tactics: Inside LuminousMoth’s Southeast Asia Cyber Spree

LuminousMoth, an advanced persistent threat (APT) group linked to the HoneyMyte (Mustang Panda) cluster, has distinguished itself through large-scale, targeted […]

Learn more

High

APT, Campaign, Malware

Defense Evasion

EDR, Sysmon, Windows

The Dark Side of Windows Sandbox: A New Frontier for Stealthy Threats

MirrorFace, a Chinese advanced persistent threat (APT) under the APT10 umbrella, was observed to conceal malicious activities by exploiting the […]

Learn more

High

APT, Malware

Defense Evasion, Execution

EDR, Sysmon, Windows

Stately Taurus Abuses KeyScramble to Stealthily Exfiltrate Data from Asian Governments

Stately Taurus, a Chinese advanced persistent threat (APT) group also known as Mustang Panda, has demonstrated sophisticated cyberespionage techniques targeting […]

Learn more

High

APT, LOLBin

Defense Evasion, Execution

EDR, Sysmon, Windows

Tracking DarkPink’s Rapid TTP Changes: Staying Ahead in the Intelligence-Driven Defense

The rapid TTP evolution underscores a cyclical "cat and mouse" dynamic, where defenders must adopt proactive, intelligence-driven strategies to mitigate […]

Learn more

High

CVE

Lateral Movement

Linux

CVE-2024-12084: Critical Rsync Heap Buffer Overflow Opens Door to Remote Code Execution

Buffer overflows, including heap buffer overflows, pose significant security risks by allowing unauthorized code execution. Notably, CVE-2024-12084 in Rsync exploits […]

Learn more