Catalin Dragomir admits to hacking an Oregon government office and selling network access. Read more on the $250k fraud case and his 2026 sentencing.
Hackread – Cybersecurity News, Data Breaches, AI and More – Read More
Attackers can inject malicious instructions in a GitHub Issue that are automatically processed by Copilot when launching a Codespace from that issue.
The post GitHub Issues Abused in Copilot Attack Leading to Repository Takeover appeared first on SecurityWeek.
SecurityWeek – Read More
Investments in cybersecurity startups took off in 2025, as venture capital firms focused not just on AI-native tech, but talent as well.
darkreading – Read More
The North Korea-linked Lazarus Group (aka Diamond Sleet and Pompilus) has been observed using Medusa ransomware in an attack targeting an unnamed entity in the Middle East, according to a new report by the Symantec and Carbon Black Threat Hunter Team.
Broadcom’s threat intelligence division said it also identified the same threat actors mounting an unsuccessful attack against a healthcare
The Hacker News – Read More
Most identity programs still prioritize work the way they prioritize IT tickets: by volume, loudness, or “what failed a control check.” That approach breaks the moment your environment stops being mostly-human and mostly-onboarded.
In modern enterprises, identity risk is created by a compound of factors: control posture, hygiene, business context, and intent. Any one of these can perhaps be
The Hacker News – Read More
The vulnerability in TeamT5 ThreatSonar Anti-Ransomware was recently added to CISA’s KEV catalog.
The post Taiwan Security Firm Confirms Flaw Flagged by CISA Likely Exploited by Chinese APTs appeared first on SecurityWeek.
SecurityWeek – Read More
The threat activity cluster known as UnsolicitedBooker has been observed targeting telecommunications companies in Kyrgyzstan and Tajikistan, marking a shift from prior attacks aimed at Saudi Arabian entities.
The attacks involve the deployment of two distinct backdoors codenamed LuciDoor and MarsSnake, according to a report published by Positive Technologies last week.
“The group used several
The Hacker News – Read More
The group’s administrator and moderator were arrested last year, and two other members were arrested this month.
The post Anonymous Fénix Members Arrested in Spain appeared first on SecurityWeek.
SecurityWeek – Read More
Security professionals rely on early detection signals to prioritize and contain incidents. But what happens when a fully capable RAT generates none?
In a recent investigation, the ANY.RUN experts uncovered a new Go-based remote access trojan we named Moonrise. At the time of analysis, it wasn’t detected on VirusTotal and had no vendor signatures tied to it.
That’s the problem teams can’t ignore: credential theft, remote command execution, and persistence can be active while static checks stay silent. The result is slower triage, and more escalations.
Let’s break down Moonrise’s full attack chain and show how you can detect similar threats earlier, before they turn into longer investigations and real business impact.
Moonrise isn’t just a remote access tool. Its command set shows how an attacker can move from access to impact.
One compromised endpoint can disrupt operations and lead to financial and reputational damage, especially when the malware stays below static detection thresholds long enough to expand access.
You can follow the full Moonrise chain in real time, from execution to C2 control, and note the behaviors you can use for detection and triage.
Check analysis session with Moonrise
Within minutes of execution, Moonrise established outbound communication and began responding to operator-driven commands. What looked harmless in static checks immediately revealed interactive control once behavior was observed.
The communication begins with:
These commands handle client identification and keep the WebSocket session alive. This confirms that the infected system is actively connected and ready to receive instructions.
At this stage, traditional static checks still show nothing suspicious. But behaviorally, the endpoint is already under remote control.
Once the session is established, the operator starts requesting information about the system.
Observed commands include:
This allows the attacker to inspect running processes, review directory structures, identify connected displays, and check for available multimedia devices. Even when screen capture fails in a headless environment, the attempt itself signals active operator-driven interaction.
This stage provides the attacker with enough context to determine what data is accessible and which actions to take next.
Moonrise supports active command execution and process manipulation:
Through these commands, the operator can run system commands remotely, terminate selected processes, upload additional payloads, execute them, modify directories, and restart system components.
This shifts the attack from observation to full control. At this point, the endpoint is no longer just compromised. It can be used to deploy further tools or prepare deeper access.
The sample includes commands associated with data theft and credential harvesting:
These functions enable collection of stored credentials, extracted files, logged keystrokes, and clipboard content. If sensitive data is copied between applications, such as passwords or financial details, it becomes accessible to the operator.
This is where technical compromise transitions into business exposure.
Moonrise includes extensive user interaction monitoring capabilities:
These commands allow the operator to monitor user input, track clipboard changes, capture screen content, and access audio or video devices.
The infected endpoint effectively becomes a live surveillance point.
Moonrise also contains commands related to privilege handling and system configuration:
These suggest support for privilege manipulation, system configuration changes, and persistence-related behavior. While not all commands may be triggered in every session, their presence indicatesextended control options.
Moonrise includes lifecycle management functions:
These allow the operator to modify or remove the deployed version of the malware. This indicates support for maintaining or adjusting the infection over time.
The command set also contains user-facing system interaction functions:
These commands suggest the ability to trigger visible system actions, including restarts or shutdown events, depending on operator intent.
Their presence reinforces that Moonrise provides broad remote interaction capabilities beyond silent monitoring.
Moonrise is a good example of an annoying reality: sometimes a RAT shows up with no clean static verdict, no reputation you can trust, and nothing obvious to latch onto. In those cases, early detection comes down to how quickly your team can move from unclear signals to evidence-based containment.
A lot of RAT incidents start with infrastructure: a fresh IP, a new domain, traffic that doesn’t match your baseline.
This is where ANY.RUN’s Threat Intelligence Feeds help. They continuously surface newly observed indicators and patterns based on telemetry and submissions from 15,000+ organizations and 600,000+ security professionals.
For SOC managers, that means fewer blind spots in day-to-day monitoring and earlier detection of suspicious infrastructure before it becomes a bigger incident.
When static checks don’t help, teams often lose time debating severity. That’s where MTTR grows and escalation pressure builds.
A cleaner path is enrich → execute → decide. Use Threat Intelligence Lookup to pull immediate context around a hash, URL, domain, or IP (relationships, related samples, historical sightings). Then run the artifact in the ANY.RUN Sandbox to confirm what it actually does in a safe environment.
This is how teams replace uncertainty with evidence, reduce unnecessary Tier-1 escalations, and contain earlier, before a RAT turns into credential loss or broader access.
Once you confirm a RAT-like incident, the next step is making sure it doesn’t repeat under a slightly different wrapper. Threat Intelligence Lookup helps you pivot from confirmed indicators to related infrastructure and nearby samples, so hunting stays tied to what’s active now.
From there, you can pivot into related IPs/domains, cluster similar samples, and validate behavior in the sandbox to decide whether it’s the same activity or a lookalike.
Below is an example of a TI Lookup query for the Moonrise C2 IP observed in the attack:
When these three motions run as a loop, monitoring, fast triage, and targeted hunting, stealth RATs stop being “late discoveries” and become manageable security events with lower response cost and less business exposure.
Moonrise is a reminder that the biggest risk isn’t the RAT itself but the time lost before it’s clearly identified. When static checks stay silent, attackers can steal credentials, stage more payloads, and lock in persistence while teams are still debating severity.
Reducing exposure comes down to one thing: faster clarity. Feed fresh infrastructure signals into monitoring, enrich quickly with TI Lookup, and confirm behavior in the sandbox before the case grows into a costly incident.
Bring speed and clarity to your SOC with ANY.RUN ➜
ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions, fits naturally into modern SOC workflows and supports investigations from initial alert to final containment.
It allows teams to safely execute suspicious files and URLs to observe real behavior, enrich indicators with immediate context through TI Lookup, and continuously monitor emerging infrastructure using Threat Intelligence Feeds. Together, these capabilities help reduce uncertainty, accelerate triage, and limit unnecessary escalations.
Today, more than 600,000 security professionals across 15,000+ organizations rely on ANY.RUN to make faster decisions, strengthen detection coverage, and stay ahead of evolving phishing and malware campaigns.
To stay informed about newly discovered threats and real-world attack analysis, follow ANY.RUN’s team on LinkedIn and X, where weekly updates highlight the latest research, detections, and investigation insights.
The post Moonrise RAT: A New Low-Detection Threat with High-Cost Consequences appeared first on ANY.RUN’s Cybersecurity Blog.
ANY.RUN’s Cybersecurity Blog – Read More
Want to capture a scrolling screenshot of a web page in Chrome? Here’s how to quickly take one on a desktop or your phone.
Latest news – Read More