SilabRAT malware, aka SnappyClient, is a $5K/month MaaS RAT flagged as HijackLoader. It uses HVNC and cracks crypto wallets, per Group-IB.

Task 4: Vulnerable Startup — Broken Authentication and Task 5: Vulnerable Startup — Broken Authentication 2. These tasks demonstrate how…

Owners of LG monitors recently discovered something unwelcome on their desktops. Their displays had silently triggered the download of companion software, and that software began serving pop-up ad…

At a glance Malware family ClickLock Stealer (new, named by Group-IB) Threat actor Unattributed. No actor or group named. Target / victims macOS users, especially crypto holders. At least 100 vict…

Unveiling the HollowGraph Threat A cloud calendar can conceal far more than mundane appointments; the HollowGraph malware exploits Microsoft 365 to clandestinely receive commands and transmit pilf…

An Unprotected Directory Exposes Espionage Operations A single overlooked server misconfiguration inadvertently exposed the inner workings of an entire China-nexus cyber espionage infrastructure. …

At a Glance Actor or group JadeProx, a China-nexus cluster named by Group-IB; no known group named Activity type Espionage-style intrusions, phishing, credential harvesting, tunnelling Targets A V…

At a glance Field Detail Malware family Modified XMRig 6.25.0 botnet implant (marked “PRIVATE VERSION FOR BOTNET”), cross-compiled with musl libc Threat actor Unidentified; campaign tr…

In this article I will demonstrate how poor dynamic group membership rules could be exploited by hackers in order to enumerate and escalate…

A single phone call with a fraudster can now result, within the same session, in a loan taken out in the victim’s name and unauthorized purchases charged to their bank card. Researchers at G…

A hacked computer has become a commodity whose value an algorithm determines by its banking software, corporate systems, and owner data. Group-IB specialists have discovered a malicious framework …

At a Glance Actor or group: Threat actor known as “ChenLun” and affiliated subscribers. Activity type: Phishing-as-a-Service (PhaaS), Adversary-in-the-Middle (AiTM), and credential the…

An Android feature devised to separate personal and corporate applications has become a hiding place for banking fraud. Group-IB has described the pairing of Gigabud and Vwork, which, in a confirm…

Security researchers at Group-IB recently published an investigation into a Smishing Triad phishing kit deployed across global fraud campaigns. The criminal operation sends fraudulent text message…

The PAYLOAD extortion operators recently targeted a Middle Eastern manufacturing enterprise without executing a single encryptor payload on any Windows machine. After successfully acquiring domain…

Google Plans to Remove Client-Side XSLT Google plans to deprecate client-side XSLT support in Chromium browsers. As a result, the Remote Desktop Web Access pages on Windows Server may stop renderi…

It wasn’t a breach. It was 400 browser extensions nobody had ever reviewed.

QMR Arrives on Windows Server 2025 Microsoft says Windows Server 2025 now supports Quick Machine Recovery (QMR) after the October update. The feature first appeared in Windows 11. When the system …

At a glance Actor Operator using the alias “k0t,” with suspected collaborators; possible initial access broker Activity Mass scanning, exploitation, and brute-forcing of network edge d…

At a Glance Malware Family 7 Android RAT families (cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat/GhostGrab, and tenxen) paired with the d-miner XMRig dropper Threat Actor Confirmed analytical…