JPCERT exposed APT-C-60 targeting Japan via VHDX LNK files in phishing emails. The SpyGlace malware uses GitHub to fetch encrypted commands and statcounter for victim telemetry.

ENKI exposed a Kimsuky APT campaign using a dual PE/PowerShell payload that switches based on Windows Defender status to deploy KimJongRAT. The malware steals Chrome AppBound keys via GitHub Releases C2.

Operation Hanoi Thief targets Vietnam with a pseudo-polyglot LNK/image file that executes malicious code via ftp.exe. The attack deploys LOTUSHARVEST stealer via DLL sideloading to steal Chrome/Edge credentials.

Microsoft has quietly patched a long-standing flaw in Windows that had been exploited in real-world attacks for several

SEQRITE exposed Operation DUPEHIKE targeting Russian HR with a malicious LNK bonus lure. The DUPERUNNER implant uses PowerShell and process injection into explorer.exe to deploy the Adaptix C2 Beacon.

Patchwork APT deployed StreamSpy, a new trojan that uses WebSocket for covert C2 and HTTP for file transfer, blending malicious activity with web traffic to evade detection during espionage operations.

Operation FrostBeacon targets Russian B2B with Cobalt Strike. The dual attack uses LNK files and chained legacy exploits (CVE-2017-0199/11882) to gain persistent, financially motivated access.

A movie torrent scam uses a DiCaprio film lure to infect PCs with Agent Tesla RAT. The attack chain uses LNK files and malicious code hidden in a subtitle file to achieve fileless execution via LotL tools.

The sophisticated threat group APT-36 is hacking government systems by warning them about hackers. A new intelligence report from CYFIRMA exposes a targeted espionage campaign where the attackers …

CYFIRMA unmasks APT36's latest campaign: a fake JLPT exam lure using fileless LNK malware to evade antivirus and spy on Indian government targets.

The adversarial collective APT-C-28, recognized alternatively as ScarCruft or Konni, has broadened its operational horizons by orchestrating surgical

Phorpiex botnet returns in "Your Document" phishing campaign. Attackers use malicious .LNK files and hidden extensions to trick users.

ASEC uncovers Kimsuky’s evolved LNK-to-Python chain abusing Dropbox for stealthy persistence. Learn how to detect this complex multi-stage backdoor.

FortiGuard Labs unmasks a South Korean espionage wave abusing the GitHub API for C2 and using LNK files to stay invisible. Protect your network from LotL.

Akamai uncovers CVE-2026-32202: A zero-click LNK flaw used by APT28 to steal Windows NTLM hashes silently. No user interaction required. Patch alert!

Genians unmasks an APT37 campaign using environment variable tricks and compiled Python malware to bypass EDR. Protect your network from these stealthy lures.

At a glance Actor / group Clubfoot Wolf (cluster tracked by BI.ZONE) Activity type Phishing that deploys NetSupport Manager for remote access Targets / victims Russian firms across eight sectors; …

At a glance Malware family Node.js backdoor (tracked as “TonRAT” by some researchers) Threat actor Unattributed; no named group Target / victims Hospitality sector; hotel staff Deliver…

At a glance Actor / group APT-C-60 (threat group) Activity Spear-phishing, LNK loader, SpyGlace backdoor Targets / victims Organizations in Japan Scale Ongoing campaign; victim count not disclosed…

At a glance Actor Kimsuky, a North Korea-linked threat group (assessed by Genians) Activity Reply-baiting spear phishing, malicious LNK files, fake Zoom installer, credential phishing Targets Ukra…