Search for a command to run...
Series
0. Overview This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 (also tracked by CERT-UA as UAC-0226), delivering an updated
TL;DR. The malware sample uses the three-file set Avk.exe, Avk.dll, and AVKTray.dat, deployed from an MSI file downloaded by Browser_Updater.exe. The execution chain starts with DLL sideloading throug
I. The big picture: why this chain is worth pulling apart Mustang Panda is hardly a new name in the threat intelligence community. The group has shown up repeatedly across campaigns built on multi-lay
Charon is a sophisticated ransomware strain associated with the Earth Baxia APT group. This report dissects its TTPs end‑to‑end: DLL sideloading, multi‑layer shellcode staging, process hollowing into svchost.exe, pre‑encryption anti‑recovery/defense‑...
Code flow Code flow of the malware Clickfix technique in the wild This case was found by Blue Cyber Threat Intelligence during our hunting. Clickfix disguise as Captcha The technique used to trick users into executing malware is known as Clickfix...
I. Over view File nameWelcome to the Darkness.html sha25656e926b816c062078f8acac3bd28e2759447d07d9fb6e1d31d2a032121c110c6 File Size5.01 MB (5256901 bytes) This is an Easter Egg left behind in a cyberattack targeting the telecommunications s...
