Pinned Tweet
📡New research inside #DarkVision #RAT | #DarkVisionRAT, one of the most capable yet underanalyzed RATs currently active. Available on underground forums since 2020, used by countless #TA ever since
⛓️ #Phishing | Fake link | Fake sw > ZIP/RAR | Other #Malware > #Loader > #DarkVisiL > Priv. Escalation / Persistence / Proc. Injection > #C2 > Add plugins > Steal info + Remote Access
🔎Full research: rexorvc0.com
#ThreatIntelligence #CTI #Threathunting #Threat
⛓️ #Phishing | Fake link | Fake sw > ZIP/RAR | Other #Malware > #Loader > #DarkVisiL > Priv. Escalation / Persistence / Proc. Injection > #C2 > Add plugins > Steal info + Remote Access
🔎Full research: rexorvc0.com
#ThreatIntelligence #CTI #Threathunting #Threat
5
14
61
3,591
#APT & #TA #TA6 mid year global report from QianXin
Summary of attacks by relevant #APT#APTan#Ransomwarec. Highlights from groups such as #Turla, #APT28, #Bitter, #Lazarus, #OilRig, #Gentlemen, #Interlock and more
🔗Link: ti.qianxin.com/uploads/2026/1…
📄Translated Report:
httThreat #Campaign #Report #CTI #malware #intel
Summary of attacks by relevant #APT#APTan#Ransomwarec. Highlights from groups such as #Turla, #APT28, #Bitter, #Lazarus, #OilRig, #Gentlemen, #Interlock and more
🔗Link: ti.qianxin.com/uploads/2026/1…
📄Translated Report:
httThreat #Campaign #Report #CTI #malware #intel
0
6
46
1,777
New extortion campaign, STRU team found a #TA who breached a major Japanese real estate company and pivoted to ~20 other sites via shared hosting.
🪙 Stolen: plaintext passwords, financial data, customer records. Victims extorted via site defacement. The TA shares his findings o found a weaponized #PHP2Shell copy (CVE-2026-109618/109619) staged on their server
🔗Full Research: socradar.io/blog/php2shell…
#ThreatIntelligence #CTI #CyberSecurity #SupplyChain #DataBreach #InfoSec #Japan #Threat
🪙 Stolen: plaintext passwords, financial data, customer records. Victims extorted via site defacement. The TA shares his findings o found a weaponized #PHP2Shell copy (CVE-2026-109618/109619) staged on their server
🔗Full Research: socradar.io/blog/php2shell…
#ThreatIntelligence #CTI #CyberSecurity #SupplyChain #DataBreach #InfoSec #Japan #Threat
1
3
7
1,497
#TTP
📩[T1566.001] SpearPhishing
📄[T1059.001] PS persistence script
🦠[T1059.003] Shell with cmd.exe as injection
⚓️[T1547.001] Registry Run Keys with obfuscated PowerShell
🛗[T1548.002] COM Elevation Moniker
🧩[T1027] Obfuscated Files or Information
💉[T1055.002] Process DLL injection into browser process
🔎[T1497] CreateToolhelp32Snapshot in anti-Debug/Analysis thread
🪪[T1082] OS version, local IP, admin status
📤[T1041] WinHTTP POST
📡[T1095] TCP protocol with proprietary framing and handshake
📩[T1566.001] SpearPhishing
📄[T1059.001] PS persistence script
🦠[T1059.003] Shell with cmd.exe as injection
⚓️[T1547.001] Registry Run Keys with obfuscated PowerShell
🛗[T1548.002] COM Elevation Moniker
🧩[T1027] Obfuscated Files or Information
💉[T1055.002] Process DLL injection into browser process
🔎[T1497] CreateToolhelp32Snapshot in anti-Debug/Analysis thread
🪪[T1082] OS version, local IP, admin status
📤[T1041] WinHTTP POST
📡[T1095] TCP protocol with proprietary framing and handshake
3
3
12
902
#IOC
2a67ec9b4db3954e30b1fa26fe87dea4f89ce4d011415e00d48f3200c9fe1f88
6700075bf252fbc09453df6f543d36bbd7f7a011ed2b5bf7fc86df1c4b634c8d
B1c7d89f04a4a9a2729f6030b581e5a7cfb2afe766b36c80cfad5ece7ecccfed
Fb76ed9669c3c728806fa4d349e46bcec2e51f474ac829269e3713f3909c051b
c5f67f17f532c8379adfa0d1ab0185620fb62627f
9a0369f05cd24b818b5885b3866643d168f6f4216724641ca540613972e9e682
8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550
92ad02bd0ce9160a8ad87ffd7fba019a366b4e70056b3e8bd35c706abdb4a2ff
...
🔗More at: rexorvc0.com
🔗And: virustotal.com/gui/collection…
2a67ec9b4db3954e30b1fa26fe87dea4f89ce4d011415e00d48f3200c9fe1f88
6700075bf252fbc09453df6f543d36bbd7f7a011ed2b5bf7fc86df1c4b634c8d
B1c7d89f04a4a9a2729f6030b581e5a7cfb2afe766b36c80cfad5ece7ecccfed
Fb76ed9669c3c728806fa4d349e46bcec2e51f474ac829269e3713f3909c051b
c5f67f17f532c8379adfa0d1ab0185620fb62627f
9a0369f05cd24b818b5885b3866643d168f6f4216724641ca540613972e9e682
8edac9f53baffdb318253b4874a7776339c322e46ca88f32c169199556109550
92ad02bd0ce9160a8ad87ffd7fba019a366b4e70056b3e8bd35c706abdb4a2ff
...
🔗More at: rexorvc0.com
🔗And: virustotal.com/gui/collection…
0
2
4
736
🚨 Threat actor unmasked: CyberXero 🎭
STRU has identified a new Russian IAB #TA operating two distinct pipelines targeting critical infrastructure in Ukraine and other countries, alongside WordPress sites worldwide.
Using PentAGI, +50 agents, Cobalt Strike and dedicated frastructure and Telegram notification.
👽 Blogpost: socradar.io/blog/cyberxero…
🔗 Full report: socradar.io/resources/repo…
#ThreatIntelligence #CTI #ThreatResearch #AI #IAB #threat #campaign
STRU has identified a new Russian IAB #TA operating two distinct pipelines targeting critical infrastructure in Ukraine and other countries, alongside WordPress sites worldwide.
Using PentAGI, +50 agents, Cobalt Strike and dedicated frastructure and Telegram notification.
👽 Blogpost: socradar.io/blog/cyberxero…
🔗 Full report: socradar.io/resources/repo…
#ThreatIntelligence #CTI #ThreatResearch #AI #IAB #threat #campaign
1
13
23
2,857
#TTP
🔎[T1590.002] Enumeration of domains
🗡️[T1588.005] Exploits usage
🔮[T1078.003] Admin accounts
🧩[T1110.003] Psw spraying
🕷️[T1082] System info discovery
🧲[T1047] Remote exec
👥[T1136.001] Creation of rogue accounts
🪄[T1102.002] TG for real time notification
📡[T1041] Info Exfiltration
...
🔎[T1590.002] Enumeration of domains
🗡️[T1588.005] Exploits usage
🔮[T1078.003] Admin accounts
🧩[T1110.003] Psw spraying
🕷️[T1082] System info discovery
🧲[T1047] Remote exec
👥[T1136.001] Creation of rogue accounts
🪄[T1102.002] TG for real time notification
📡[T1041] Info Exfiltration
...
1
2
3
1,007
#IOC
92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090
a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c
71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192
59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483
...
🔗More at: socradar.io/blog/cyberxero…
92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090
a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c
71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192
59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483
...
🔗More at: socradar.io/blog/cyberxero…
0
1
2
345
🚨 New Research: VectraRAT 🐀
We at STRU have identified a previously undocumented #RAT operating under the #MaaS model.
The dev has been active for years. This isn't their first build. Previously known as #Nyxel. VectraRAT combines #RAT capabilities with #Stealer through a centralized panel to control multiple victims simultaneously.
Active campaigns confirmed. Victims identified worldwide and #USA among the top targets.
👽 Blogpost: socradar.io/blog/vectrarat…
🔗 Full report: socradar.io/resources/whit…
#ThreatIntelligence #CTI #ThreatHunting #Malware #Threat #TA #Campaign
We at STRU have identified a previously undocumented #RAT operating under the #MaaS model.
The dev has been active for years. This isn't their first build. Previously known as #Nyxel. VectraRAT combines #RAT capabilities with #Stealer through a centralized panel to control multiple victims simultaneously.
Active campaigns confirmed. Victims identified worldwide and #USA among the top targets.
👽 Blogpost: socradar.io/blog/vectrarat…
🔗 Full report: socradar.io/resources/whit…
#ThreatIntelligence #CTI #ThreatHunting #Malware #Threat #TA #Campaign
3
21
53
5,292
#TTP
🎣 [T1566.002] Spearphishing via ClickFix lures
📜 [T1059.001] PS execution bypass
🛡️ [T1548.002] UAC Bypass based on UACME #41
👥 [T1134.004] Parent PID Spoofing via computerdefaults.exe
🎭 [T1036.005] Masquerading as Tax lures
🔑 [T1555.003] Credentials theft from Keylogging
📋 [T1115] Clipboard hijack & crypto address swap
🖥️ [T1219] HVNC hidden desktop session
📡 [T1095] TCP over port 3308
🔄 [T1568] Dynamic C2 update via callback.json
🎣 [T1566.002] Spearphishing via ClickFix lures
📜 [T1059.001] PS execution bypass
🛡️ [T1548.002] UAC Bypass based on UACME #41
👥 [T1134.004] Parent PID Spoofing via computerdefaults.exe
🎭 [T1036.005] Masquerading as Tax lures
🔑 [T1555.003] Credentials theft from Keylogging
📋 [T1115] Clipboard hijack & crypto address swap
🖥️ [T1219] HVNC hidden desktop session
📡 [T1095] TCP over port 3308
🔄 [T1568] Dynamic C2 update via callback.json
1
2
6
1,819
#IOC
e2db5db12564d2a9da7ef3a57aa23d95782f5eaddc8bd35eb7c35ae6b844a0f0
dede8bfb55c2e6479d89b1e73e0712791cf16a7179325804fc4bc13f708d08ae
ddbd636f6dfd475dc0c75bf9f6f873fa35b9062dee9d37b3377ae7b9acdcd0c9
b926cfcd3f4b07fe6001c39f46e40225ff8000411198d13782538d770c54ae5e
bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5
c708d413720848f8788f43a4f47ddce016fca9af10c9ba4113f47bf2c9244dc5
[...]
🔗More at: platform.socradar.com
🔗Full report: socradar.io/resources/whit…
e2db5db12564d2a9da7ef3a57aa23d95782f5eaddc8bd35eb7c35ae6b844a0f0
dede8bfb55c2e6479d89b1e73e0712791cf16a7179325804fc4bc13f708d08ae
ddbd636f6dfd475dc0c75bf9f6f873fa35b9062dee9d37b3377ae7b9acdcd0c9
b926cfcd3f4b07fe6001c39f46e40225ff8000411198d13782538d770c54ae5e
bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5
c708d413720848f8788f43a4f47ddce016fca9af10c9ba4113f47bf2c9244dc5
[...]
🔗More at: platform.socradar.com
🔗Full report: socradar.io/resources/whit…
0
2
2
1,402
#APT #APT36 #TransparentTribe #CrimsonRAT #threat #malware
📍🇵🇰
💥🇮🇳🌏
⛓️ #Phishing > #ISO | #ZIP > #LNK (#LNK pdf.lnk) > #BAT + cm#BATe > Decoy PDF > Drop in %APPDATA% | Mv LOCALAPPDATA + Self-Delete > Exec payload | RegKey + Startup Persistence > #CrimsonRAT | #Golang#CrimsonRAT
🔗#Golanga#RAT Threao/YZBsqxOUtW
📍🇵🇰
💥🇮🇳🌏
⛓️ #Phishing > #ISO | #ZIP > #LNK (#LNK pdf.lnk) > #BAT + cm#BATe > Decoy PDF > Drop in %APPDATA% | Mv LOCALAPPDATA + Self-Delete > Exec payload | RegKey + Startup Persistence > #CrimsonRAT | #Golang#CrimsonRAT
🔗#Golanga#RAT Threao/YZBsqxOUtW
1
18
64
4,349
#TTP
📩[T1566.001] Spear-Phishing
💿[T1553.005] ISO
📇[T1204.002] Mal LNK
⚙️[T1059.003] BAT + cmd.exe
📜[T1059.001] PowerShell
🎭[T1036] Fake PDF and .txt
⚓️[T1547.001] RegKey + Startup Persistence
🧹[T1070.004] Self-delete files
📂[T1083] File & Dir Discovery
📤[T1041] Exfil overication
📩[T1566.001] Spear-Phishing
💿[T1553.005] ISO
📇[T1204.002] Mal LNK
⚙️[T1059.003] BAT + cmd.exe
📜[T1059.001] PowerShell
🎭[T1036] Fake PDF and .txt
⚓️[T1547.001] RegKey + Startup Persistence
🧹[T1070.004] Self-delete files
📂[T1083] File & Dir Discovery
📤[T1041] Exfil overication
1
0
3
999
#IOC
4c64d98210c7fc53b91ffe8572db9187
411460a835461658ea596a9f52826e65
1d0a37a19233bc64d31f77697247e8f1
72b34401413cd684b7ba0a36f626811b
1b5d96e5b41d9720a4b35919a807bc34
41724f263cac4520874765b11027eaa1
8cd05fd628ed7927871e9dd53d4e613b
43ec61c2a96acef6e36a4b69b8f8e333
...
🔗VT: virustotal.com/gui/collection…
4c64d98210c7fc53b91ffe8572db9187
411460a835461658ea596a9f52826e65
1d0a37a19233bc64d31f77697247e8f1
72b34401413cd684b7ba0a36f626811b
1b5d96e5b41d9720a4b35919a807bc34
41724f263cac4520874765b11027eaa1
8cd05fd628ed7927871e9dd53d4e613b
43ec61c2a96acef6e36a4b69b8f8e333
...
🔗VT: virustotal.com/gui/collection…
0
1
4
430
#APT #Rattlesnake #SideWinder #Rust #RAT #threat #malware
📍🇮🇳
💥🇵🇰🇧🇩🇳🇵🌏
⛓️ #Phishing > #ClickOnce > Load > OneDrive.exe + mscorsvc.dll > Registry Persistence > RC4 > #SC + #Rust Payloa#SC Co#Rust info (JSON) > #RAT > #C2
🔗360 Advanc#RAThreat #C2earch: mp.weixin.qq.com/s?__biz=MzUyMj…
📍🇮🇳
💥🇵🇰🇧🇩🇳🇵🌏
⛓️ #Phishing > #ClickOnce > Load > OneDrive.exe + mscorsvc.dll > Registry Persistence > RC4 > #SC + #Rust Payloa#SC Co#Rust info (JSON) > #RAT > #C2
🔗360 Advanc#RAThreat #C2earch: mp.weixin.qq.com/s?__biz=MzUyMj…
1
15
83
5,916
#TTP
📩[T1566.002] SpearPhishing
👥[T1036] Masquerading (AdobeReader | OneDrive)
📥[T1105] Download next stage
🚀[T1204.001] ClickOnce
👥[T1574.002] DLL SideLoading (OneDrive.exe + mscorsvc.dll)
📄[T1059.005] VBA Macro
⚓️[T1547.001] Registry Run Persistence
🧩[T1140] RC4 + XOR kuneapfvpesuabfmpxgwnad)
💾[T1620] #SC in mem
🔎[T1082] Discover device info
🚇[T1090] SOCKS tunneling
☁️[T1584.006] Abuse of Cloudflare Workers
📡[T1071.001] C&C
📩[T1566.002] SpearPhishing
👥[T1036] Masquerading (AdobeReader | OneDrive)
📥[T1105] Download next stage
🚀[T1204.001] ClickOnce
👥[T1574.002] DLL SideLoading (OneDrive.exe + mscorsvc.dll)
📄[T1059.005] VBA Macro
⚓️[T1547.001] Registry Run Persistence
🧩[T1140] RC4 + XOR kuneapfvpesuabfmpxgwnad)
💾[T1620] #SC in mem
🔎[T1082] Discover device info
🚇[T1090] SOCKS tunneling
☁️[T1584.006] Abuse of Cloudflare Workers
📡[T1071.001] C&C
1
0
5
1,709
#IOC + 🧬Correlation
bc43ee3b9873539932b9eb23f21e9e1b
f310ee836f88cc43d3939f8a88b20495
f80e3806ae3a0dbca9456c3ef422e1d6
a95041469ff85c7a45394e46e566b074
b53aba6a17a156a865c62d84d7e0e367
...
🔗VT: virustotal.com/gui/collection…
🧬Same behaviour: arcticwolf.com/resources/blog…
bc43ee3b9873539932b9eb23f21e9e1b
f310ee836f88cc43d3939f8a88b20495
f80e3806ae3a0dbca9456c3ef422e1d6
a95041469ff85c7a45394e46e566b074
b53aba6a17a156a865c62d84d7e0e367
...
🔗VT: virustotal.com/gui/collection…
🧬Same behaviour: arcticwolf.com/resources/blog…
0
3
3
918
#APT #OceanLotus #APT32 #SeaLotus #malware #threat #HiveSwarming #Shellcode
📍🇻🇳
💥🇨🇳🌏
⛓️ #Phishing > ZIP > #IMG >#IMGK (Fak#LNKcx.Lnk) > #VBS + Decoy#VBSs > #DLL Side-Loadi#DLL Anti-Dbg + AV Check > RC4 (userinit.db) > #SC > HiveSwarming > Per#SCtence > B64+RC4 > Load #RAT > #C2
🔗360 Threat Intel: mp.weixin.qq.com/s?__biz=MzUyMj…
📍🇻🇳
💥🇨🇳🌏
⛓️ #Phishing > ZIP > #IMG >#IMGK (Fak#LNKcx.Lnk) > #VBS + Decoy#VBSs > #DLL Side-Loadi#DLL Anti-Dbg + AV Check > RC4 (userinit.db) > #SC > HiveSwarming > Per#SCtence > B64+RC4 > Load #RAT > #C2
🔗360 Threat Intel: mp.weixin.qq.com/s?__biz=MzUyMj…
2
52
217
13,485
#TTP
📩[T1566.001] SpearPhishing
💿[T1553.005] CD IMG/ISO container
📇[T1204.002] Mal LNK
📜[T1059.005] VBS script
🎭[T1036] Abuses legit software
👥[T1574.002] DLL Side-Loading
🕵️[T1622] DBG Evasion
⏱️[T1497] Sandbox & Timing checks
🛡️[T1518.001] Software Discovery (360 AV)
🧩[T1pt
⚓️[T1547.001] Persistence with RegKey via NTUSER
🔃[T1620] Load code in mem
🕷️[T1082] Get device info
⌨️[T1059.003] Run with cmd.exe
📥[T1105] Download next stage
📤[T1041] Exfil over C2 channel
📡[T1071.001] C&C
📩[T1566.001] SpearPhishing
💿[T1553.005] CD IMG/ISO container
📇[T1204.002] Mal LNK
📜[T1059.005] VBS script
🎭[T1036] Abuses legit software
👥[T1574.002] DLL Side-Loading
🕵️[T1622] DBG Evasion
⏱️[T1497] Sandbox & Timing checks
🛡️[T1518.001] Software Discovery (360 AV)
🧩[T1pt
⚓️[T1547.001] Persistence with RegKey via NTUSER
🔃[T1620] Load code in mem
🕷️[T1082] Get device info
⌨️[T1059.003] Run with cmd.exe
📥[T1105] Download next stage
📤[T1041] Exfil over C2 channel
📡[T1071.001] C&C
1
3
6
1,570
#IOC
68124f029a5fafc3733fbc7c43db1e07
698ac1e66c5e9e305ff38388608860dd
f8202f44303c6bc9caaca932b1ab4208
1124092f3de057976a3ef62dbcb14f2e
c2d6795881b2444cc08e846e8fdb7d78
...
🔗VT: virustotal.com/gui/collection…
68124f029a5fafc3733fbc7c43db1e07
698ac1e66c5e9e305ff38388608860dd
f8202f44303c6bc9caaca932b1ab4208
1124092f3de057976a3ef62dbcb14f2e
c2d6795881b2444cc08e846e8fdb7d78
...
🔗VT: virustotal.com/gui/collection…
0
2
3
988