By 2026, MSSPs will compete less on tooling and more on clarity, speed, and foresight. Security buyers want proof that their provider understands what threats matter now, how fast they can respond, and how security decisions reduce business risk.
At the center of this challenge sits threat intelligence. Not as a research output, but as an operational input shaping every security decision.
What Clients Will Demand This Year: The Five Deciding Factors
Winning deals in 2026 means excelling where others fall short. Prospects grill providers on these five areas before signing:
Relentless Threat Blocking: They want evidence you’re stopping attacks they can’t see coming.
Clean, Actionable Alerts: Too many false positives waste time and erode confidence.
Blazing-Fast Incident Response: Slow containment turns small incidents into headline breaches.
Forward-Leaning Threat Hunting: Reactive-only services feel outdated in a zero-trust world.
Undeniable ROI Visibility: Executives need clear proof of risks blocked and value delivered.
Master these with actionable threat intelligence, and you’ll close more deals while your competitors hassle.
ANY.RUN’s Threat Intelligence Feeds contain real-time streams of malicious IPs, domains, and URLs pulled from millions of sandbox submissions, updated frequently to keep you ahead. TI Feeds are not background data. They are the operational core of detection, response, hunting, reporting, and proactive defense.
How live threat intelligence impacts the key performance metrics
Here are the five ways to stand out by employing real-time trustworthy threat data.
1. Early awareness defines credibility
Clients rarely see the attacks you stop. They only notice the ones you miss. One successful intrusion can erase years of good service and trigger immediate vendor reassessment.
The difficulty lies in the speed of attacker adaptation. Malware changes quickly, infrastructure rotates, and indicators expire fast. Detection logic based on static or delayed intelligence struggles to keep pace.
What mature threat intelligence enables:
TI Feeds deliver IOCs from hands-on analyses to your infrastructure
ANY.RUN’s TI Feeds deliver continuously updated indicators along with sandbox analyses documenting attacker behavior extracted from live malware execution. For MSSPs, this means:
Detection rules that evolve as threats evolve;
Faster identification of emerging malware families;
Visibility into infrastructure used in active attacks;
Reduced reliance on outdated or recycled indicators.
Instead of reacting to incidents reported elsewhere, your MSSP detects threats while competitors are still catching up. For clients, that difference is felt as safety, not statistics.
Build a retention-first security service with real-time, 99% unique threat intelligence
No MSSP can prevent every incident. What matters is how quickly and confidently you respond. Long investigations, unclear answers, and delayed containment create anxiety at the executive level.
Most delays come from context gaps. Analysts must validate indicators, understand attackers’ intent, and assess scope before acting. That takes time when intelligence is fragmented.
TI Feeds give response teams immediate access to:
TI Feeds by ANY.RUN can be integrated through multiple sources
Fresh, validated indicators of compromise: malicious IPs, domains, and URLs continuously updated from real malware analysis by over 15K SOC teams;
Contextual metadata including links to sandbox analysis sessions that provide additional insight into threat behavior;
Intelligence that supports instant containment decisions;
Formats compatible with SIEMs and security platforms (STIX, MISP) for seamless integration into existing workflows;
API-enabled delivery so intelligence can feed automated detection and monitoring systems in real time.
This allows MSSPs to move from alert to action in minutes, not hours. Over time, clients associate your service with decisiveness and control. That perception is critical for renewal conversations.
3. Proactive security becomes expected
By 2026, clients will not ask whether you offer threat hunting. They will assume you do. The real question will be whether your hunting produces meaningful results or just internal noise.
Without fresh intelligence, hunting teams often chase weak signals or outdated hypotheses. That leads to low impact and poor client communication.
With TI Feeds, MSSPs can anchor threat hunting in reality:
Hunt for indicators tied to active attacker campaigns;
Correlate client telemetry with known malicious behavior;
Continuously refine hypotheses using new feed data;
Demonstrate findings backed by observable attacker activity.
This makes threat hunting repeatable, scalable, and easier to justify commercially.
You can improve your SOC’s metrics by adding TI Feeds to your security stack
4. Reporting shapes executive perception
Executives don’t want dashboards full of alerts. They want confidence that risk is being reduced and managed. Poor reporting creates the impression that security work is abstract or disconnected from business reality.
In many cases, churn begins not after incidents, but after months of unclear reporting.
TI Feeds allow MSSPs to report on outcomes, not effort:
Indicators with associated threat context help explain why a detected indicator matters;
Detection timestamps and threat labels reveal whether an indicator is recent and connected to active campaigns;
Consistent delivery of validated, actionable IOCs allows reports to reflect real threat activity, not noise.
Reports become stories of protection delivered, not lists of events processed. This is where MSSPs justify their value in language decision-makers understand.
Expand threat coverage and speed up MTTR Integrate real-time intel from 15K SOCs
Clients increasingly expect their security posture to evolve alongside attacker behavior. Generic controls applied uniformly across clients feel outdated and inattentive. The challenge is keeping defenses current without overwhelming analysts.
By aligning TI Feeds with each client’s risk profile, MSSPs can:
Base decisions on high-confidence threat data, minimizing distraction from low-value or false signals;
Use enriched contextual data to explain how specific IOCs are connected to observed or emerging threats;
Update detection logic as campaigns evolve.
Security stops being reactive and starts feeling anticipatory. Clients feel seen, protected, and prioritized. That emotional factor matters more than most technical metrics.
Final Thought: What Clients Are Willing to Pay For
MSSPs don’t lose clients because attackers exist. They lose clients because they fail to show awareness, speed, and progress.
In 2026, Threat Intelligence Feeds are the foundation of competitive MSSP services. They power better detection, faster response, meaningful hunting, credible reporting, and proactive protection. The key metrics demonstrate this clearly:
Security teams report up to a 21‑minute reduction in MTTR per case, with automation-ready feeds accelerating triage and containment actions.
Up to 58% more threats identified after integrating TI Feeds into detection rules and playbooks.
Streamlined intelligence lets Tier 1 teams resolve more incidents independently, reducing escalations to senior analysts by 30%.
The MSSPs that win will be those who turn intelligence into visible outcomes their clients can trust month after month.
About ANY.RUN
Trusted by over 500,000 cybersecurity professionals and 15,000+ organizations in finance, healthcare, manufacturing, and other critical industries, ANY.RUN helps security teams investigate threats faster and with greater accuracy.
Our Interactive Sandbox accelerates incident response by allowing you to analyze suspicious files in real time, watch behavior as it unfolds, and make confident, well-informed decisions.
1. Why will TI Feeds be critical for MSSPs in 2026?
Because attackers move faster than manual analysis can handle. TI Feeds provide a continuous stream of fresh indicators and attacker behavior that allow MSSPs to detect, respond, and adapt in near real time—something clients will increasingly expect as standard service.
2. How do TI Feeds improve detection compared to traditional threat intel sources?
Unlike static or delayed sources, TI Feeds are updated continuously and reflect indicators observed in real malware executions. This helps MSSPs detect emerging threats earlier and avoid relying on outdated indicators.
3. Can TI Feeds really help reduce MTTR?
Yes. By supplying validated IOCs and associated TTPs upfront, TI Feeds remove much of the uncertainty during investigations. Response teams spend less time validating alerts and more time containing threats.
4. How do TI Feeds support threat hunting services?
TI Feeds give hunters access to indicators and techniques tied to active campaigns, making hunting more focused and defensible. This allows MSSPs to offer threat hunting as a repeatable, intelligence-driven service rather than ad hoc investigation.
5. Do TI Feeds help with client reporting and renewals?
They do. TI Feeds enable MSSPs to report on real threats detected, blocked campaigns, and changes in risk exposure. This turns reports into proof of value, which is critical for client retention and contract renewals.
6. Are TI Feeds useful for proactive protection, not just detection?
Absolutely. By tracking evolving attacker behavior and infrastructure, TI Feeds help MSSPs keep detection rules updated and defenses aligned with current threats—before attacks reach client environments.
7. What makes TI Feeds scalable for MSSPs managing many clients?
TI Feeds automate intelligence delivery. Instead of analysts manually researching each alert, intelligence is continuously ingested into security tools, allowing MSSPs to protect more clients without proportional growth in headcount.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-12-29 14:06:382025-12-29 14:06:385 Ways MSSPs Can Win Clients in 2026
ANY.RUN is wrapping up 2025 with updates that take pressure off your SOC and help your team work faster. You can now get AI‑generated Sigma rules, track threats by industry and region, and detect new campaigns with better speed and accuracy.
Let’s see what these improvements bring to your security stack.
Product Updates
Industry & Geo Threat Landscape in TI Lookup
Industry & geo threat landscape data for the Tycoon2FA phishkit
TI Lookup now gives every indicator extra context showing which industries and countries are linked to the threat of your industry and where similar activity is trending. It’s an easy way to see whether a threat actually affects your business or if it’s just background noise.
Built on live data from more than 15,000 organizations, this update helps your team tighten detection focus and reduce blind spots:
See what matters first: Identify threats targeting your market or region so you can prioritize high‑risk activity.
Triage faster: Skip irrelevant alerts and go straight to the ones that match your exposure.
Work with better insight: Use targeted intelligence to guide hunts, automate enrichment, and improve MTTD.
With TI Lookup, you spot threats earlier, respond faster, and keep your attention where it counts.
The threat landscape changes fast Now your SOC can move with it
The new AI Sigma Rules feature in the Interactive Sandbox turns your confirmed detections into ready‑to‑use Sigma rules automatically. Instead of spending hours writing them by hand, you can now take the rule straight from the sandbox and add it to your SIEM or SOAR in seconds.
The rules are created from the same processes, files, and network events you see in the sandbox, so they stay closely tied to real attacker behavior. That means better accuracy and quicker response without extra effort.
Here’s what you gain:
Less manual work: Every confirmed threat instantly becomes a reusable detection rule.
Better coverage: Each investigation now improves how your SOC spots similar attacks later.
Faster action: Analysts spend less time writing rules and more time acting on real signals.
Cut MTTR by 21 min and reduce MTTD to 15 sec Request trial of ANY.RUN’s Enterprise plan
Together, these bring better coverage of C2 traffic, phishing domains, and low‑signal campaign infrastructure.
Businesses that are constantly being bombarded by hundreds of hacker attacks daily can upgrade their proactive defense with ANY.RUN’s Threat Intelligence Feeds.
Expand threat coverage and cut MTTR with ANY.RUN’s TI Feeds
Powered by sandbox analyses of the latest malware & phishing samples across 15K SOCs, they deliver fresh, real-time malicious network IOCs to numerous companies around the globe. Enriched with detailed sandbox reports, TI Feeds not only help you catch emerging threats early but also provide your analysts with actionable intelligence for fast remediation, boosting your detection rate and driving down the MTTR.
Keep your defense up-to-date with TI Feeds Get 99% unique IOCs from live attacks on 15K SOCs
Each brief distills TTPs, campaigns, and IOCs from live submissions to help SOC teams anticipate what’s next.
About ANY.RUN
ANY.RUN powers SOCs at more than 15,000 organizations, giving them faster visibility into live threats through interactive sandboxing and cloud‑based intelligence.
Our Interactive Sandbox lets you analyze Windows, Linux, and Android samples in real time, watch the execution flow second‑by‑second, and pull IOCs instantly, no installs, no waiting. Combined with Threat Intelligence Lookup and Threat Intelligence Feeds, you get a single workflow built to speed up investigation, cut MTTD and MTTR, and keep your SOC focused on the right threats.
Start 2026 with faster detection, better threat intel, and less noise.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-12-29 13:06:422025-12-29 13:06:42Release Notes: AI Sigma Rules, Live Threat Landscape & 1,700+ New Detections
We’re glad to present our regular quarterly report highlighting the most prominent malicious trends of the last three months of 2025, as observed by ANY.RUN’s community.
Following the release of our annual report on key threats and milestones, this report offers a closer look at the threat landscape of the final chapter of 2025.
The Malware Trends report Q4 features top malware types, families, phishing kits, TTPs, APTs, and other notable insights.
You can turn to the previous Q3 report for reference.
Key Takeaways
Threat activity remained steady, with sandbox usage up 6% quarter over quarter and over 1 billion IOCs collected, reflecting sustained investigative demand rather than volume spikes.
Stealers still dominate, even after a 16% decline, confirming credential theft as a primary attacker objective.
RATs and backdoors gained momentum, with RATs up 28% and backdoors up 68%, signaling a shift toward persistent access and modular malware.
XWorm and open-source RATs surged, with XWorm up 174%, showing attackers favor adaptable, widely shared toolsets over saturated stealer families.
Phishing continued to evolve, led by Tycoon and EvilProxy, underscoring the growing sophistication of PhaaS and 2FA bypass campaigns.
Summary
Sandbox activity summary
Total sandbox sessions: 2,015,181
Malicious: 389,636
Suspicious: 75,113
IOCs: 1,015,431,934
During the last quarter of 2025, overall threat investigation activity remained stable — no drastic growth in volume. The total number of sandbox analyses conducted in ANY.RUN’s Interactive Sandboxincreased slightly by 6%, surpassing 2 million since Q3.
Over one billion indicators were gathered by our community during analysis sessions. A total of 389,636 samples were labeled as malicious, and 75,113 as suspicious.
Top Malware Types: Highlights
Top malware types Q4 2025
Stealer: 36,685
RAT: 23,788
Loader: 19,070
Backdoor: 10,560
Ransomware: 7,317
Adware: 5,854
Botnet: 5,149
Trojan: 2,813
Miner: 2,668
Keylogger: 2,598
Although the list of top malware types looks similar to Q3 at first glance, several notable changes in activity levels should be pointed out:
Stealer dominance persists despite a 16% drop. This signals that credential theft remains a priority for attackers targeting financial sectors.
RAT surged (+28%), overtaking Loaders’ second place. A clear indication of remote access tools gaining traction for persistent post-exploitation in enterprise environments.
ANY.RUN’s Interactive Sandbox enables businesses and SOC teams to proactively identify cyber threats by analyzing files and URLs inside interactive Windows, Linux, Android VMs.
Stronger Protection for Businesses: Early detection and shorter MTTD minimize risks, safeguarding infrastructure and reputation.
Higher Efficiency & ROI: Faster investigations cut costs, reduce analyst load, and power quicker incident resolution.
Smarter Decision-Making: Flexible, enterprise-grade solution enhances visibility into threats, allowing for insight-driven action.
Achieve tangible results with interactive analysis by ANY.RUN
Lumma’s fall from first to eighth place with a -65% plunge highlights attacker shifts to newer, less-detected families, reducing reliance on saturated stealer platforms.
Vidarand Stealcwith 4K+ detections each re-emerged in Q4, indicating a sudden end-of-year growth.
Another addition to the chart is Blackmoonwith 3,208 detections. At the same time, AgentTeslaand Remcosthreats saw a reduction in detections and went from second and fourth places to tenth andseventh respectively.
Ensure early threat detection via Threat Intelligence Feeds
TI Feeds provides fresh data from 15k organizations
Gain a live view of the threat landscape with fresh, actionable IOCs delivered to you from investigations done across 15,000 companies.
Refine detection and response: Rich threat context and integration opportunities power your SOC for proactive defense.
Mitigate risks of breaches: Expanded threat coverage and visibility into threats help stay ahead of attackers without wasting time on false alarms.
Improve performance rates: Unique, noise-free indicators beat alert fatigue and promote early detection even for hidden and evasive threats.
The top 10 most detected techniques, tactics, and procedures (TTPs) show significant shifts from quarter to quarter — a reminder that threat actors never stop refining and changing their methods.
The number of detections for TTPs mostly grew: the first place is taken up by Subvert Trust Controls: Install Root Certificate, T1553.004 with 227,451 detections. In Q3, the first place was taken by a TTP with activity rate twice as small.
Second place was still occupied by Masquerading: Rename Legitimate Utilities, T1036.003 with 105,539 detections (+9%).
A new addition to the list, Command and Scripting Interpreter: Windows Command Shell , T1059.003, came third with 71,608 detections.
10. Signed Binary Proxy Execution: Rundll32, T1218.011: 19,236
Collect Fresh Threat Intelligence with Threat Intelligence Lookup
TI Lookup sharing info on threats submitted in Germany and relevant for finance companies
TI Lookup offers a searchable database of fresh Indicators of Compromise (IOCs), Attack (IOAs), and Behavior (IOBs) belonging to the latest cyber attacks on 15,000 companies.
Build proactive defense: Actionable threat intelligence drives targeted and insightful research for staying ahead.
Ensure rapid triage and response: Instant enrichment of indicators with behavioral context makes for fast and smart decisions.
Optimize workload: Rich threat data empowers Tier 1 analysts to work sustainably, reducing escalations to Tier 2.
Instant access to fresh threat data Streamline threat hunting with TI Lookup
Q4’s results align with our annual report’s conclusions: phishing is a prevalent type of cyber threat and Tycoondominates in this category:
It remained at the top of the list with double the intensity of detections. Same with EvilProxy: it stayed second with 51% increase in volume. This underscores PhaaS maturation, with kits now bundling advanced 2FA bypass for high-value targets.
Sneaky2FAmoved from fourth to third place with a whopping +138% rise in activity.
Salty2FAmoved two places down, pointing to 2FA fatigue exploitation accelerating in enterprise phishing campaigns.
Mamba2FA, absent from the list in the previous quarter, took fourth place with 3.9K detections.
Activity by cyber criminal groups
Storm1747: 37,274
TA569: 4,054
TA558: 231
Storm1575: 21
APT36: 18
Key observations regarding APT activity in Q4 2025:
Storm1747’s dominance continued with a 51% rise in activity, likely tied to phishing infrastructure evolution targeting finance across EU/NA regions.
TA558‘s jumped into top ranks with +83% detections, suggesting expanded operations, possibly leveraging modular loaders for broader campaign reach.
At the lower part of the list, we can see APTs’ displaying sharp 70-97% declines, likely due to the detection improvements or operational pauses. The focus shifted to more opportunistic actors.
Top Protectors and Packers
Top protectors and packers Q4 2025
UPX: 12,576
NetReactor: 4,300
Themida: 3,244
ASPack: 1,263
Confuser: 2,204
Top 5 most detected protectors and packers correspond with those of Q3. However, there are differences in terms of their intensity:
UPX remains dominant despite an 11% drop, remaining attackers’ go-to for simple, fast obfuscation across commodity malware.
NetReactor and Themida’s sharp declines (-49% and -37% respectively) signal detection improvements and attacker shift to newer .NET-focused protectors.
Confuser kept its fifth place with a 48% growth that reflects .NET malware boom. Attackers favor it for evading static analysis in enterprise-targeted payloads.
Conclusion
Q4 2025 shows a stable but evolving threat landscape. Key trends include persistent stealer activity, rising RATs and backdoors, and a dynamic phishing landscape. These insights underscore the importance of continuous monitoring and proactive threat analysis to stay ahead of emerging risks.
About ANY.RUN
ANY.RUN develops solutions for malware analysis and threat hunting. Its interactive malware analysis sandbox is used by over 500,000 cybersecurity professionals worldwide. It enables detailed investigation of threats targeting Windows, Android, and Linux systems with hands-on analysis and instant visualization of malware behavior.
ANY.RUN’s threat intelligence solutions, including Threat Intelligence Lookup and Threat Intelligence Feeds, allow teams to quickly identify indicators of compromise, enrich alerts, and investigate incidents early on. As a result, analysts gain actionable insights, uncover hidden threats, and improve overall cybersecurity posture.
From a quintuple-encryption ransomware attack to zany dark web schemes and AI fails, Sophos X-Ops looks back at some of our favorite weirdest incidents from the last few years – and the serious lessons behind them
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-12-24 10:06:462025-12-24 10:06:46Laughter in the dark: Tales of absurdity from the cyber frontline and what they taught us
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-12-24 08:06:342025-12-24 08:06:34A brush with online fraud: What are brushing scams and how do I stay safe?
Following our earlier reporting on RTO-themed threats, CRIL observed a renewed phishing wave abusing the e-Challan ecosystem to conduct financial fraud. Unlike earlier Android malware-driven campaigns, this activity relies entirely on browser-based phishing, significantly lowering the barrier for victim compromise. During the course of this research, CRIL also noted that similar fake e-Challan scams have been highlighted by mainstream media outlets, including Hindustan Times, underscoring the broader scale and real-world impact of these campaigns on Indian users.
The campaign primarily targets Indian vehicle owners via unsolicited SMS messages claiming an overdue traffic fine. The message includes a deceptive URL resembling an official e-Challan domain. Once accessed, victims are presented with a cloned portal that mirrors the branding and structure of the legitimate government service. At the time of this writing, many of the associated phishing domains were active at the time, indicating that this is an ongoing and operational campaign rather than isolated or short-lived activity.
The same hosting IP was observed serving multiple phishing lures impersonating government services, logistics companies, and financial institutions, indicating a shared phishing backend supporting multi-sector fraud operations.
The infection chain, outlined in Figure 1, showcases the stages of the attack.
Figure 1: Campaign Overview
Key Takeaways
Attackers are actively exploiting RTO/e-Challan themes, which remain highly effective against Indian users.
The phishing portal dynamically fabricates challan data, requiring no prior victim-specific information.
The payment workflow is deliberately restricted to credit/debit cards, avoiding traceable UPI or net banking rails.
Infrastructure analysis links this campaign to BFSI and logistics-themed phishing hosted on the same IP.
Browser-based warnings (e.g., Microsoft Defender) are present but frequently ignored due to urgency cues.
A sense of urgency, evidenced in this campaign, is usually a sign of deception. By demanding a user’s immediate attention, the intent is to make a potential victim rush their task and not perform due diligence.
Users must accordingly exercise caution, scrutinize the domain, sender, and never trust any unsolicited link(s).
Technical findings
Stage 1: Phishing SMS Delivery
The attack we first identified started with victims receiving an SMS stating that a traffic violation fine is overdue and must be paid immediately to avoid legal action. The message includes:
Threatening language (legal steps, supplementary charges)
A shortened or deceptive URL mimicking e-Challan branding
No personalization, allowing large-scale delivery
The sender appears as a standard mobile number, which increases delivery success and reduces immediate suspicion. (see Figure 2)
Figure 2: Fraudulent traffic violation SMS delivering a malicious e-Challan payment link
Stage 2: Redirect to Fraudulent e-Challan Portal
Clicking the embedded URL redirects the user to a phishing domain hosted on 101[.]33[.]78[.]145.
The page content is originally authored in Spanish and translated to English via browser prompts, suggesting the reuse of phishing templates across regions. (see Figure 3)
Figure 3: Fake e-Challan landing page
The Government insignia, MoRTH references, and NIC branding are visually replicated. (see Figure 3)
Stage 3: Fabricated Challan Generation
The portal prompts the user to enter:
Vehicle Number
Challan Number
Driving License Number
Regardless of the input provided, the system returns:
A valid-looking challan record
A modest fine amount (e.g., INR 590)
A near-term expiration date
Prominent warnings about license suspension, court summons, and legal proceedings
This step is purely psychological validation, designed to convince victims that the challan is legitimate. (see Figure 4)
Figure 4: Fraudulent e-Challan record generated
Stage 4: Card Data Harvesting
Upon clicking “Pay Now”, victims are redirected to a payment page claiming secure processing via an Indian bank. However:
Only credit/debit cards are accepted
No redirection to an official payment gateway occurs
CVV, expiry date, and cardholder name are collected directly
During testing, the page accepted repeated card submissions, indicating that all entered card data is transmitted to the attacker backend, independent of transaction success. (see Figure 5)
Figure 5: E-Challan payment page restricted to card-only transactions
Infrastructure Correlation and Campaign Expansion
CRIL identified another attacker-controlled IP, 43[.]130[.]12[.]41, hosting multiple domains impersonating India’s e-Challan and Parivahan services. Several of these domains follow similar naming patterns and closely resemble legitimate Parivahan branding, including domains designed to look like Parivahan variants (e.g., parizvaihen[.]icu). Analysis indicates that this infrastructure supports rotating, automatically generated phishing domains, suggesting the use of domain generation techniques to evade takedowns and blocklists.
The phishing pages hosted on this IP replicate the same operational flow observed in the primary campaign, displaying fabricated traffic violations with fixed fine amounts, enforcing urgency through expiration dates, and redirecting victims to fake payment pages that harvest full card details while falsely claiming to be backed by the State Bank of India.
This overlap in infrastructure, page structure, and social engineering themes suggests a broader, scalable phishing ecosystem that actively exploits government transport services to target Indian users.
Further investigation into IP address 101[.]33[.]78[.]145 revealed more than 36 phishing domains impersonating e-Challan services, all hosted on the same infrastructure.
The infrastructure also hosted phishing pages targeting:
BFSI (e.g., HSBC-themed payment lures)
Logistics companies (DTDC, Delhivery) (see Figures 7,8)
Figure 7: DTDC-themed phishing page impersonating a failed delivery notificationFigure 8: Fake DTDC address update page used for data harvesting
Consistent UI patterns and payment-harvesting logic across campaigns
This confirms the presence of a shared phishing infrastructure supporting multiple fraud verticals.
SMS Origin and Phone Number Analysis
As part of the continued investigation, CRIL analyzed the originating phone number used to deliver the phishing e-Challan SMS. A reverse phone number lookup confirmed that the number is registered in India and operates on the Reliance Jio Infocomm Limited mobile network, indicating the use of a locally issued mobile connection rather than an international SMS gateway.
Additionally, analysis of the number showed that it is linked to a State Bank of India (SBI) account, further reinforcing the campaign’s use of localized infrastructure. The combination of an Indian telecom carrier and association with a prominent public-sector bank likely enhances the perceived legitimacy of the scam. It increases the effectiveness of government-themed phishing messages. (see Figure 9)
Figure 9: Phone number intelligence linked to the e-Challan phishing campaign
Conclusion
This campaign demonstrates that RTO-themed phishing remains a high-impact fraud vector in India, particularly when combined with realistic UI cloning and psychological urgency. The reuse of infrastructure across government, logistics, and BFSI lures highlights a professionalized phishing operation rather than isolated scams.
As attackers continue shifting from malware delivery to direct financial fraud, user awareness alone is insufficient. Infrastructure monitoring, domain takedowns, and proactive SMS phishing detection are critical to disrupting these operations at scale.
Our Recommendations:
Always verify traffic fines directly via official government portals, not SMS links.
Organizations should monitor for lookalike domains abusing government and brand identities.
SOC teams should track shared phishing infrastructure, as takedown of one domain may disrupt multiple campaigns.
Telecom providers should strengthen SMS filtering for financial and government-themed lures.
Financial institutions should monitor for card-not-present fraud patterns linked to phishing campaigns.
The IOCs have been added to this GitHub repository. Please review and integrate them into your Threat Intelligence feed to enhance protection and improve your overall security posture.
Cyble Vulnerability Intelligence researchers tracked 2,415 vulnerabilities in the last week, a significant increase over even last week’s very high number of new vulnerabilities. The increase signals a heightened risk landscape and expanding attack surface in the current threat environment.
Over 300 of the disclosed vulnerabilities already have a publicly available Proof-of-Concept (PoC), significantly increasing the likelihood of real-world attacks.
A total of 219 vulnerabilities were rated as critical under the CVSS v3.1 scoring system, while 47 received a critical severity rating based on the newer CVSS v4.0 scoring system.
Even after factoring out a high number of Linux kernel and Adobe vulnerabilities (chart below), new vulnerabilities reported in the last week were still very high.
What follows are some of the IT and ICS vulnerabilities flagged by Cyble threat intelligence researchers in recent reports to clients spanning December 9-16.
The Week’s Top IT Vulnerabilities
CVE-2025-59385 is a high-severity authentication bypass vulnerability affecting several versions of QNAP operating systems, including QTS and QuTS hero. Fixed versions include QTS 5.2.7.3297 build 20251024 and later, QuTS hero h5.2.7.3297 build 20251024 and later, and QuTS hero h5.3.1.3292 build 20251024 and later.
CVE-2025-66430 is a critical vulnerability in Plesk 18.0, specifically affecting the Password-Protected Directories feature. It stems from improper access control, potentially allowing attackers to bypass security mechanisms and escalate privileges to root-level access on affected Plesk for Linux servers.
CVE-2025-64537 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager. The vulnerability could allow attackers to inject malicious scripts into web pages, which are then executed in the context of a victim’s browser, potentially leading to session hijacking, data theft, or further exploitation.
CVE-2025-43529 is a critical use-after-free vulnerability in Apple’s WebKit browser engine, which is used in Safari and other Apple applications. The flaw could allow attackers to execute arbitrary code on affected devices by tricking users into processing maliciously crafted web content, potentially leading to full device compromise. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
CVE-2025-59718 is a critical authentication bypass vulnerability affecting multiple versions of Fortinet products, including FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb. The flaw could allow unauthenticated attackers to bypass FortiCloud Single Sign-On (SSO) login authentication by sending a specially crafted SAML message. The vulnerability has been added to CISA’s KEV catalog.
Notable vulnerabilities discussed in open-source communities included CVE-2025-55182, a critical unauthenticated remote code execution (RCE) vulnerability affecting React Server Components; CVE-2025-14174, a critical memory corruption vulnerability affecting Apple’s WebKit browser engine; and CVE-2025-62221, a high-severity use-after-free elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver.
Vulnerabilities Discussed on the Dark Web
Cyble Research and Intelligence Labs (CRIL) researchers also observed several threat actors discussing weaponizing vulnerabilities on dark web forums. Among the vulnerabilities under discussion were:
CVE-2025-55315, a critical severity vulnerability classified as HTTP request/response smuggling due to inconsistent interpretation of HTTP requests in ASP.NET Core, particularly in the Kestrel server component. The flaw arises from how chunk extensions in Transfer-Encoding: chunked requests with invalid line endings are handled differently by ASP.NET Core compared to upstream proxies, enabling attackers to smuggle malicious requests. An authorized attacker can exploit this vulnerability over a network to bypass security controls, leading to impacts such as privilege escalation, SSRF, CSRF bypass, session hijacking, or code execution, depending on the application logic.
CVE-2025-59287 is a critical-severity remote code execution (RCE) vulnerability stemming from improper deserialization of untrusted data in Microsoft Windows Server Update Services (WSUS). The core flaw occurs in the ClientWebService component, where a specially crafted SOAP request to endpoints like SyncUpdates triggers decryption and unsafe deserialization of an AuthorizationCookie object using .NET’s BinaryFormatter, allowing arbitrary code execution with SYSTEM privileges. Unauthenticated remote attackers can exploit this over WSUS ports (e.g., 8530/8531) to deploy webshells or achieve persistence, with real-world exploitation already observed.
CVE-2025-59719, a critical severity vulnerability due to improper cryptographic signature verification, permitting authentication bypass in Fortinet FortiWeb through FortiCloud SSO. Attackers can submit crafted SAML response messages to evade login checks without proper authentication. This unauthenticated flaw has a high impact and has been actively exploited post-disclosure.
ICS Vulnerabilities
Cyble also flagged two industrial control system (ICS) vulnerabilities as meriting high-priority attention by security teams. They include:
CVE-2024-3596: multiple versions of Hitachi Energy AFS, AFR, and AFF Series products are affected by a RADIUS Protocol vulnerability, Improper Enforcement of Message Integrity During Transmission in a Communication Channel. Successful exploitation of the vulnerability could compromise the integrity of the product data and disrupt its availability.
CVE-2025-13970: OpenPLC_V3 versions prior to pull request #310 are vulnerable to this Cross-Site Request Forgery (CSRF) flaw. Successful exploitation of the vulnerability could result in the alteration of PLC settings or the upload of malicious programs.
Conclusion
The record number of new vulnerabilities observed by Cyble in the last week underscores the need for security teams to respond with rapid, well-targeted actions to patch the most critical vulnerabilities and successfully defend IT and critical infrastructure. A risk-based vulnerability management program should be at the heart of those defensive efforts.
Other cybersecurity best practices that can help guard against a wide range of threats include segmentation of critical assets; removing or protecting web-facing assets; Zero-Trust access principles; ransomware-resistant backups; hardened endpoints, infrastructure, and configurations; network, endpoint, and cloud monitoring; and well-rehearsed incident response plans.
Cyble’s comprehensive attack surface management solutions can help by scanning network and cloud assets for exposures and prioritizing fixes, in addition to monitoring for leaked credentials and other early warning signs of major cyberattacks.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-12-23 13:06:332025-12-23 13:06:33The Week in Vulnerabilities: More Than 2,000 New Flaws Emerge
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-12-23 12:06:542025-12-23 12:06:54Revisiting CVE-2025-50165: A critical flaw in Windows Imaging Component
The outgoing year of 2025 has significantly transformed our access to the Web and the ways we navigate it. Radical new laws, the rise of AI assistants, and websites scrambling to block AI bots are reshaping the internet right before our eyes. So, what do you need to know about these changes, and what skills and habits should you bring with you into 2026? As is our tradition, we’re framing this as eight New Year’s resolutions. What are we pledging for 2026?
Get to know your local laws
Last year was a bumper crop for legislation that seriously changed the rules of the internet for everyday users. Lawmakers around the world have been busy:
Applying pressure through blocks and lawsuits against platforms that wouldn’t comply with existing child protection laws — with Roblox finding itself in a particularly bright spotlight.
Your best bet is to get news from sites that report calmly and without sensationalism, and to review legal experts’ commentary. You need to understand what obligations fall on you, and, if you have underage children, what changes for them.
You might face difficult conversations with your kids about new rules for using social media or games. It’s crucial that teenage rebellion doesn’t lead to dangerous mistakes, such as installing malware disguised as a “restriction-bypassing mod” or migrating to small, unmoderated social networks. Safeguarding the younger generation requires reliable protection on their computers and smartphones, alongside parental control tools.
But it’s not just about simple compliance with the laws. You will almost certainly encounter negative side effects that lawmakers didn’t anticipate.
Master new methods of securing access
Some websites choose to geoblock certain countries entirely to avoid the complexities of complying with regional regulations. If you are certain your local laws allow access to the content, you can bypass these geoblocks by using a VPN. You need to select a server in a country where the site is accessible.
It’s important to choose a service that doesn’t just offer servers in the right locations, but actually enhances your privacy — as many free VPNs can effectively compromise it. We recommend Kaspersky VPN Secure Connection.
Brace for document leaks
While age verification can be implemented in different ways, it often involves the website using a third-party verification service. On your first login attempt, you’ll be redirected to a separate site to complete one of several checks: take a photo of your ID or driver’s license, use a bank card, or nod and smile for a video, and so on.
The mere idea of presenting a passport to access adult websites is deeply unpopular with many people on principle. But beyond that, there’s a serious risk of data leaks. These incidents are already a reality: data breaches have impacted a contractor used to verify Discord users, as well as service providers for TikTok and Uber. The more websites that require this verification, the higher the risk of a leak becomes.
So, what can you do?
Prioritize services that do not require document uploads. Instead, look for those utilizing alternative age verification methods, such as a micro-transaction charge to a payment card, confirmation through your bank or another trusted external provider, or behavioral/biometric analysis.
Pick the least sensitive and easiest-to-replace document you have, and use only that one for all verifications. “Least sensitive” in this case means containing minimal personal data and not referencing other primary identifiers, such as a national ID number.
Use a separate, dedicated email address and phone number in combination with that document. For the sites and services that don’t verify your identity, use completely different contact details. This makes it much harder for your data to be easily pieced together from different leaks.
Learn scammers’ new playbook
It’s highly likely that under the guise of “age verification”, scammers will begin phishing for personal and payment data, and pushing malware onto visitors. After all, it’s very tempting to simply copy and paste some text on your computer instead of uploading a photo of your passport. Currently, ClickFix attacks are mostly disguised as CAPTCHA checks, but age verification is the logical next step for these schemes. How to lower these risks?
Carefully check any websites that require verification. Do not complete the verification if you’ve already done it for that service before, or if you landed on the verification page via a link from a messaging app, search engine, or ad.
Never download apps or copy and paste text for verification. All legitimate services operate within the browser window, though sometimes desktop users are asked to switch to a smartphone to complete the check.
Analyze and be suspicious of any situation that requires entering a code received via a messaging app or SMS to access a website or confirm an action. This is often a scheme to hijack your messaging account or another critical service.
Even if you’re not a fan of AI, you’ll find it hard to avoid — it’s literally being shoved into each everyday service: Android, Chrome, MS Office, Windows, iOS, Creative Cloud… the list is endless. As with fast food, television, TikTok, and other easily accessible conveniences, the key is striking a balance between the healthy use of these assistants and developing a dangerous dependency.
Identify the areas where your mental sharpness and personal growth matter most to you. A person who doesn’t run regularly loses fitness. Someone who always uses GPS navigation gets worse at reading paper maps. Wherever you value the work of your mind, offloading it to AI is a path to losing your edge. Maintain a balance: regularly do that mental work yourself — even if an AI can do it well — from translating text to looking up info on Wikipedia. You don’t have to do it all the time, but remember to do it often enough. For a more radical approach, you can also disable AI services wherever possible.
Know where the cost of a mistake is high. Despite developers’ best efforts, AI can sometimes deliver completely wrong answers with total confidence. These so-called hallucinations are unlikely to be fully eradicated anytime soon. Therefore, for important documents and critical decisions, either avoid using AI entirely or scrutinize its output with extreme care. Check every number, every comma.
In other areas, feel free to experiment with AI. But even for seemingly harmless uses, remember that mistakes and hallucinations are a real possibility.
How to lower the risk of leaks. The more you use AI, the more of your information goes to the service provider. Whenever possible, prioritize AI features that run entirely on your device. This category includes things like the protection against fraudulent sites in Chrome, text translation in Firefox, the rewriting assistant in iOS, and so on. You can even run a full-fledged chatbot locally on your own computer.
AI agents need close supervision. The agentic capabilities of AI — where it doesn’t just suggest but actively does work for you — are especially risky. Thoroughly research the risks in this area before trusting an agent with shopping or booking a vacation. Use modes where the assistant asks for your confirmation before entering personal data, let alone doing any shopping.
Audit your subscriptions and plans
The economics of the internet are shifting right before our eyes. The AI arms race is driving up the cost of components and computing power, tariffs and geopolitical conflicts are disrupting supply chains, and baking AI features into familiar products sometimes comes with a price hike. Practically any online service can get more expensive overnight, sometimes by double-digit percentages. Some providers are taking a different route, moving away from a fixed monthly fee to a pay-per-use model for things like songs downloaded or images generated.
To avoid nasty surprises when you check your bank statement, make it a habit to review the terms of all your paid subscriptions at least three or four times a year. You might find that a service has updated its plans and you need to downgrade to a simpler one. Or a service might have quietly signed you up for an extra feature you’re not even aware of — and you need to disable it. Some services might be better switched to a free tier or canceled altogether. Financial literacy is becoming a must-have skill for managing your digital spending.
To get a complete picture of your subscriptions and truly understand how much you’re spending on digital services each month or year, it’s best to track them all in one place. A simple Excel or Google Docs spreadsheet works, but a dedicated app like Subscrab is more convenient. It sends reminders for upcoming payments, shows all your spending month-by-month, and can even help you find better deals on the same or similar services.
Prioritize the longevity of your tech
While the allure of powerful new processors, cameras, and AI features might tempt you to buy a new smartphone or laptop in 2026, it’s very likely this purchase will last you several years. First, the pace of meaningful new features has slowed, and the urge to upgrade frequently has diminished for many. Second, gadget prices have risen significantly due to more expensive chips, labor and shipping, making major purchases harder to justify. Furthermore, regulations like those in the EU now require easily replaceable batteries in new devices, meaning the part that wears out the fastest in a phone will be simpler and cheaper to swap out yourself.
So, what does it take to make sure your smartphone or laptop reliably lasts those years?
Physical protection. Use cases, screen protectors, and maybe even a waterproof pouch.
Proper storage. Avoid extreme temperatures, don’t leave it baking in direct sun or freezing overnight in a car at –15°C.
Battery care. Avoid regularly draining it to single-digit percentages.
Regular software updates. This is the trickiest part. Updates are essential for security, protecting your phone or laptop from new types of attacks. However, updates can sometimes cause slowdowns, overheating, or battery drain. The prudent approach is to wait about a week after a major OS update, check feedback from users with your exact model, and only install it if the coast seems clear.
Secure your smart home
The Smart Home is giving way to a new concept: the Intelligent Home. The idea is that neural networks will help your home make its own decisions about what to do and when, all for your convenience — without needing pre-programmed routines. Thanks to the Matter 1.3 standard, a smart home can now manage not just lights, TVs, and locks, but also kitchen appliances, dryers, and even EV chargers! Even more importantly, we’re seeing a rise in devices where Matter over Thread is the native, primary communication protocol, like the new IKEA KAJPLATS lineup. Matter-powered devices by different vendors can see and communicate with each other. This means you can, say, buy an Apple HomePod as your smart home central hub and connect Philips Hue bulbs, Eve Energy plugs, and IKEA BILRESA switches to it.
All of this means that smart and intelligent homes will become more common — and so will the ways to attack them. We have a detailed article on smart home security, but here are a few key tips relevant in light of the transition to Matter.
Consolidate your devices into a single Matter fabric. Use the minimum number of controllers, for example, one Apple TV + one smartphone. If a TV or another device accessible to many household members acts as a controller, be sure to use password security and other available restrictions for critical functions.
Choose a hub and controller from major manufacturers with a serious commitment to security.
Minimize the number of devices connecting your Matter fabric to the internet. These devices, referred to as Border Routers, must be well-protected from external cyberattacks, for example, by restricting their access at the level of your home internet router.
Regularly audit your home network for any suspicious, unknown devices. In your Matter fabric, this is done via your controller or hub, and in your home network via your primary router or a feature like Smart Home Monitor in Kaspersky Premium.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-12-19 17:31:432025-12-19 17:31:43New cybersecurity laws and trends in 2026 | Kaspersky official blog
CRIL (Cyble Research and Intelligence Labs) has been tracking a sophisticated commodity loader utilized by multiple high-capability threat actors. The campaign demonstrates a high degree of regional and sectoral specificity, primarily targeting Manufacturing and Government organizations across Italy, Finland, and Saudi Arabia.
This campaign utilizes advanced tradecraft, employing a diverse array of infection vectors including weaponized Office documents (exploiting CVE-2017-11882), malicious SVG files, and ZIP archives containing LNK shortcuts. Despite the variety of delivery methods, all vectors leverage a unified commodity loader.
The operation’s sophistication is further evidenced by the use of steganography and the trojanization of open-source libraries. Adding their stealth is a custom-engineered, four-stage evasion pipeline designed to minimize their forensic footprint.
By masquerading as legitimate Purchase Order communications, these phishing attacks ultimately deliver Remote Access Trojans (RATs) and Infostealers.
Our research confirms that identical loader artifacts and execution patterns link this campaign to a broader infrastructure shared across multiple threat actors.
Figure 1 – Infection chain
Key Takeaways
Precision Targeting & Geographic Scope: The campaign specifically targets the Manufacturing and Industrial sectors across Europe and the Middle East. The primary objective is the exfiltration of sensitive industrial data and the compromise of high-value administrative credentials.
Versatile Malware Distribution: The loaders serve as a multi-functional distribution platform. They have been observed delivering a variety of RATs (and information stealers, such as PureLog Stealer, Katz Stealer, DC Rat, Async Rat, and Remcos). This indicates the loader is likely shared or sold across different threat actor groups.
Steganography & Infrastructure Abuse: To bypass traditional network security, the threat actors hosted image files on legitimate delivery platforms. These images contain steganographically embedded payloads, allowing the malicious code to slip past file-based detection systems by masquerading as benign traffic
Trojanization of Open-Source Libraries: The actors utilize a sophisticated “hybrid assembly” technique. By appending malicious functions to trusted open-source libraries and recompiling them, the resulting files retain their authentic appearance and functionality, making signature-based detection extremely difficult.
Four-Stage Evasion Pipeline: The infection chain is engineered to minimize forensic footprint. It employs a high-velocity, four-stage process:
Script Obfuscation: To hide initial intent.
Steganographic Extraction: To pull the payload from images.
Reflective Loading: To run code directly in memory without touching the disk.
Process Injection: To hide malicious activity within legitimate system processes.
Novel UAC Bypass Discovery: A unique User Account Control (UAC) bypass was identified in a recent sample. The malware monitored system process creation events and opportunistically triggered UAC prompts during legitimate launches, tricking the system or user into granting elevated privileges under the guise of a routine operation.
Technical Analysis
To demonstrate the execution flow of this campaign, we analyzed the sample with the following SHA256 hash: c1322b21eb3f300a7ab0f435d6bcf6941fd0fbd58b02f7af797af464c920040a.
Initial Infection vector
The campaign begins with targeted phishing emails sent to manufacturing organizations, masquerading as legitimate Purchase Order communications from business partners (see Figure 2).
Figure 2 – Email with attachment
Extraction of the RAR archive reveals a first-stage malicious JavaScript payload, PO No 602450.js, masquerading as a legitimate purchase order document.
Stage 1: JavaScript and PowerShell execution
The JavaScript file contains heavily obfuscated code with special characters that are stripped at runtime. The primary obfuscation techniques involve split and join operations used to dynamically reconstruct malicious strings (see Figure 3).
Figure 3 – Obfuscated JS script
The de-obfuscated JavaScript creates a hidden PowerShell process using WMI objects (winmgmts:rootcimv2). It employs multiple obfuscation layers, including base64 encoding and string manipulation, to evade detection, with a 5-second sleep delay (see Figure 4).
Figure 4 – De-obfuscated JS script
Stage 2: Steganographic payload retrieval
The decoded PowerShell script functions as a second-stage loader, retrieving a malicious PNG file from Archive.org. This image file contains a steganographically embedded base64-encoded .NET assembly hidden at the end of the file (see Figure 5).
Figure 5 – Base64 decoded PowerShell script
Upon retrieval, the PowerShell script employs regular expression (regex) pattern matching to extract the malicious payload using specific delimiters (“BaseStart-‘+’-BaseEnd”). The extracted assembly is then reflected in memory via Reflection.Assembly::Load, invoking the “classlibrary1” namespace with the class name “class1” method “VAI”
This fileless execution technique ensures the final payload executes without writing to disk, significantly reducing detection probability and complicating forensic analysis (see Figure 6).
Figure 6 – Base64 encoded content at the end of the PNG file
Stage 3: Weaponized TaskScheduler loader
The reflectively loaded .NET assembly serves as the third-stage loader, weaponizing the legitimate open-source TaskScheduler library from GitHub. The threat actors appended malicious functions to the original library source code and recompiled it, creating a trojanized assembly that retains all legitimate functionality while embedding malicious capabilities (see Figure 7).
Upon execution, the malicious method receives the payload URL in reverse and base64-encoded format, along with DLL path, DLL name, and CLR path parameters (see Figure 8).
Figure 8 – Decoded URL and payload
Stage 4: Process injection and payload execution
The weaponized loader creates a new suspended RegAsm.exe process and injects the decoded payload into its memory space before executing it (see Figure 9). This process hollowing technique allows the malware to masquerade as a legitimate Windows utility while executing malicious code.
Figure 9 – Injecting payload into RegAsm.exe
The loader downloads additional content that is similarly reversed and base64-encoded. After downloading, the loader reverses the content, performs base64 decoding, and runs the resulting binary using either RegAsm or AddInProcess32, injecting it into the target process.
Final payload: PureLog Stealer
The injected payload is an executable file containing PureLog Stealer embedded within its resource section. The stealer is extracted using Triple DES decryption in CBC mode with PKCS7 padding, utilizing the provided key and IV parameters. Following decryption, the data undergoes GZip decompression before the resulting payload, PureLog Stealer, is invoked (see Figure 10).
Figure 10 – Triple DES decryption
PureLog Stealer is an information-stealing malware designed to exfiltrate sensitive data from compromised hosts, including browser credentials, cryptocurrency wallet information, and comprehensive system details. The threat actor’s command and control infrastructure operates at IP address 38.49.210[.]241.
PureLog Stealer steals the following from the victim’s machines:
Category
Targeted Data
Detail
Web Browsers
Chromium-based browsers
Data harvested from a wide range of Chromium-based browsers, including stable, beta, developer, portable, and privacy-focused variants.
Firefox-based browsers
Data extracted from Firefox and Firefox-derived browsers
Browser credentials
Saved usernames and passwords associated with websites and web applications
Browser cookies
Session cookies, authentication tokens, and persistent cookies
Browser autofill data
Autofill profiles, saved payment information, and form data.
Browser history
Browsing history, visited URLs, download records, and visit metadata.
Search queries
Stored browser search terms and normalized keyword data
Browser tokens
Authentication tokens and associated email identifiers
Cryptocurrency Wallets
Desktop wallets
Wallet data from locally installed cryptocurrency wallet applications
Browser extension wallets
Wallet data from browser-based cryptocurrency extensions
Wallet configuration
Encrypted seed phrases, private keys, and wallet configuration files
Password Managers
Browser-based managers
Credentials stored in browser-integrated password management extensions
Standalone managers
Credentials and vault data from desktop password manager applications
Two-Factor Authentication
2FA applications
One-time password (OTP) secrets and configuration data from authenticator applications
VPN Clients
VPN credentials
VPN configuration files, authentication tokens, and user credentials
Messaging Applications
Instant messaging apps
Account tokens, user identifiers, messages, and configuration files
Gaming platforms
Authentication and account metadata related to gaming services
FTP Clients
FTP credentials
Stored FTP server credentials and connection configurations
Email Clients
Desktop email clients
Email account credentials, server configurations, and authentication tokens
System Information
Hardware details
CPU, GPU, memory, motherboard identifiers, and system serials
Operating system
OS version, architecture, and product identifiers
Network information
Public IP address and network-related metadata
Security software
Installed security and antivirus product details
Tracing the Footprints: Shared Ecosystem
CRIL’s cross-campaign analysis reveals a striking uniformity of tradecraft, uncovering a persistent architectural blueprint that serves as a common thread. Despite the deployment of diverse malware payloads, the delivery mechanism remains constant.
This standardized methodology includes the use of steganography to conceal payloads within benign image files, the application of string reversal combined with Base64 encoding for deep obfuscation, and the delivery of encoded payload URLs directly to the loader. Furthermore, the actors consistently abuse legitimate .NET framework executables to facilitate advanced process hollowing techniques.
This observation is also reinforced by research from Seqrite, Nextron Systems, and Zscaler, which documented identical class naming conventions and execution patterns across a variety of malware families and operations.
The following code snippet illustrates the shared loader architecture observed across these campaigns (see Figure 11).
Figure 11 – Loader comparison and similarities
This consistency suggests that the loader might be part of a shared delivery framework used by multiple threat actors.
UAC Bypass
Notably, a recent sample revealed an LNK file employing similar obfuscation techniques, utilizing PowerShell to download a VBS loader, along with an uncommon UAC bypass method. (see Figure 12)
Figure 12 – C# code inside an xml file
An uncommon UAC bypass technique is employed in later stages of the attack, where the malware monitors process creation events and triggers a UAC prompt when a new process is launched, thereby enabling the execution of a PowerShell process with elevated privileges after user approval (see Figure 13).
Figure 13 – UAC bypass using User response
Conclusion
Our research has uncovered a hybrid threat with striking uniformity of tradecraft, uncovering a persistent architectural blueprint. This standardized methodology includes the use of steganography to conceal payloads within benign image files, the application of string reversal combined with Base64 encoding for deep obfuscation, and the delivery of encoded payload URLs directly to the loader. Furthermore, the actors consistently abuse legitimate .NET framework executables to facilitate advanced process hollowing techniques.
The fact that multiple malware families leverage these class naming conventions as well as execution patterns across is further testament to how potent this threat is to the target nations and sectors.
The discovery of a novel UAC bypass confirms that this is not a static threat, but an evolving operation with a dedicated development cycle. Organizations, especially in the targeted regions, should treat “benign” image files and email attachments with heightened scrutiny.
Recommendations
Deploy Advanced Email Security with Behavioral Analysis
Implement email security solutions with attachment sandboxing and behavioral analysis capabilities that can detect obfuscated JavaScript, VBScript files, and malicious macros. Enable strict filtering for RAR/ZIP attachments and block execution of scripts from email sources to prevent initial infection vectors targeting business workflows.
Implement Application Whitelisting and Script Execution Controls
Deploy application whitelisting policies to prevent unauthorized JavaScript and VBScript execution from user-accessible directories. Enable PowerShell Constrained Language Mode and comprehensive logging to detect suspicious script activity, particularly commands attempting to download remote content or perform reflective assembly loading. Restrict the execution of legitimate system binaries from non-standard locations to prevent their abuse in living-off-the-land (LotL) attacks.
Deploy EDR Solutions with Advanced Process Monitoring
Implement Endpoint Detection and Response (EDR) solutions that can detect sophisticated evasion techniques and runtime anomalies, enabling effective protection against advanced threats. Configure EDR platforms to monitor for process hollowing activities where legitimate signed Windows binaries are exploited to execute malicious payloads in memory. Establish behavioral detection rules for fileless malware techniques, including reflective assembly loading and suspicious parent-child process relationships that deviate from normal system behavior.
Monitor for Memory-Based Threats and Process Anomalies
Establish behavioral detection rules for fileless malware techniques, including reflective assembly loading, process hollowing, and suspicious parent-child process relationships. Deploy memory analysis tools to identify code injection into legitimate Windows processes, such as MSBuild.exe, RegAsm.exe, and AddInProcess32.exe, which are commonly abused for malicious payload execution.
Strengthen Credential and Cryptocurrency Wallet Protection
Enforce multi-factor authentication across all critical systems and encourage users to store cryptocurrency assets in hardware wallets rather than browser-based solutions. Implement monitoring for unauthorized access to browser credential stores, password managers, and cryptocurrency wallet directories to detect potential data exfiltration attempts.
Implement Steganography Detection and Image Analysis Capabilities
Deploy specialized steganography detection tools that analyze image files for hidden malicious payloads embedded within pixel data or metadata. Implement statistical analysis techniques to identify anomalies in image file entropy and bit patterns that may indicate the presence of concealed executable code. Configure security solutions to perform deep inspection of image formats, particularly PNG files, which are frequently exploited for embedding command-and-control infrastructure or malicious scripts in covert communication channels.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-12-19 13:06:472025-12-19 13:06:47Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns
