Investigations

Vidar-as-a-Service: Stolen Certificates, Telegram Dead Drops, and the 185.56.45.235 C2 Infrastructure

GriftClient: Minecraft RAT Using the Ethereum Blockchain as a C2 Resolver

NetScan/WPMagic CaaS: Mass WordPress Exploitation Panel Unmasked (wpmagic.net + xssnew.com)

REFUNDEE: Inside a Shadow Panel Phishing-as-a-Service Operation

AllSyDevs C2 Infrastructure -- Breakglass Intelligence Report

CPUID.com Supply Chain Compromise -- Breakglass Intelligence Report

CastleLoader / maybedontbanplease[.]com

Calipology / SystemAutoUpdater — Trojanized RustDesk via Signed MSTeams Installer

SideWinder APT Credential Harvesting Campaign — PaaS Platform Abuse at Scale

Operation FiyatTeklifi -- CVE-2025-8088 WinRAR Exploit Delivering Turkish Telegram RAT

Operation Charger Van — Breakglass Intelligence Report

HYFLOCK RaaS — Breakglass Intelligence Report

Operation HEXSTRIKE -- npm Supply Chain Attack Targeting Guardarian Cryptocurrency Exchange

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

FEZBOX Supply Chain Attack C2 Panel -- Breakglass Intelligence Report

ELF Modified UPX — Breakglass Intelligence Report

CRPX0 / DataBreachPlus — Multi-Platform Crypto Clipper + Ransomware MaaS Panel

LOTUSLITE and MSC File Attack Vector -- Breakglass Intelligence Report

Operation PHANTOM CENTRE -- Breakglass Intelligence Report

Smile Admin Panel -- Breakglass Intelligence Report

SuperShell C2 Panel at 8[.]216[.]26[.]169:8888 -- Breakglass Intelligence Report

OPERATION CREST SNAKE — Breakglass Intelligence Report

OPERATION KLEIN CHANGES — Breakglass Intelligence Report

OPERATION NUTTEN TUNNEL — Breakglass Intelligence Report

Operation VOICETRAP — FUD Batch File Campaign Targeting Israel via TryCloudflare Tunnels

XWorm V6.0 Multi-Stage Campaign — "backupallfresh2030" — Breakglass Intelligence Report

CVE-2026-21509 South Asian Espionage Campaign (WarMachine/MALDEV01) — Breakglass Intelligence Report

Operation MIRZBOW — LNK Dropper Campaign Targeting Arabic-Speaking Users

Android TV Botnet Landscape: Bigpanzi, Kimwolf, and the Misattribution of Kimsuky

ChanMirai Botnet C2 — Breakglass Intelligence Report

HOSTING///SEO Credential Phishing & Payment Fraud Platform -- Breakglass Intelligence Report

Operation CLICKSMOKE -- Deno-Based ClickFix MaaS Platform

GlassWorm Wave 3: The Supply Chain Worm Goes Cross-Platform -- A macOS Chrome RAT, a Windows ABE Bypass, and a Blockchain Dead-Drop

GlassWorm: 9 Infected VS Code Extensions Are Still Live -- Inside the Rust-Powered Supply Chain Attack Targeting Developers

KORTEX Stealer Defeats Chrome's App-Bound Encryption -- What Defenders Need to Know Now

SilverFox Deploys VM-Obfuscated RAT with ChaCha20 Encryption and RPC-Based C2 Disguised as Trend Micro

HackForums Actor "gigajew" Caught Red-Handed: AsyncRAT Campaign Uses Cloudinary CDN Steganography and 7-Month-Old Bulletproof Infrastructure

Unmasked: A 5-Stage DonutLoader Campaign Hiding Behind a Fake Adobe Storefront

BlackSanta: How a Legitimately Signed Windows Driver Became a 192-Process EDR Killer

Lazarus Group is Using the Solana Blockchain as a Dead-Drop C2 Channel -- and Nobody Noticed for 4 Months

That Password Manager You Downloaded Is Actually a $3,000/Month Infostealer

Astaroth Returns: 1,680 Fake Brazilian Hosting Accounts, Reflective .NET Loading, and a Compromised Spanish Web Server Still Serving Malware

Fancy Bear's Weather Report: APT28 Harvests NTLMv2 Credentials from Ukraine's Meteorologists Using Weaponized RTF Documents

SEAL RAT: A Czech-Language Job Phishing Dropper With a Proof-of-Work Twist and a Microsoft-Signed Certificate

StarDev's ACE-Tray Rootkit: A Chinese Cheat-as-a-Service Operation Running Dual Kernel Drivers Since 2016

The FreePBX Turf War: How VoIP Threat Actors Are Fighting Over Your Phone System

SalatStealer's New Trick: Using TON Blockchain DNS to Make C2 Takedowns Impossible

Signed, Sealed, Delivered: How a Legitimately-Signed NetSupport Binary Became a Weapon Across 333+ ClickFix Infections

Formbook Hides in Plain Sight: Three-Stage Dropper Chain Abuses Legitimate Paste Sites to Bypass Domain Blocking

Competent Malware, Incompetent Infrastructure: A SnakeKeylogger Operator Builds a Steganographic Kill Chain Then Leaves XAMPP Dashboard Open to the Internet

XWorm via IPFS: Actor "jerrymac2008" Runs a One-Person Cybercrime Supermarket on Censorship-Resistant Infrastructure

EssentialAcquisition: A Custom Go Financial Trojan Running Raft Consensus C2 on Kubernetes

XWorm V5.6 Meets Carding Shop: Inside a Brazilian Operator's Vertically Integrated Cybercrime Pipeline

FlashTest Stealer: A $5,000 EV Certificate, a Shell Company, and a Speed Test That Steals Your Browser

WallStealer: A Full-Featured Infostealer Whose Operator Put Their C2 Domain as Their Steam Display Name

Twelve Samples, One Operation: Inside the HTA Crypto Stealer MaaS Platform

VictamPbx: Inside a Brazilian VoIP Toll Fraud Operation Targeting FreePBX and Asterisk

The SilverFox Den: Inside a Chinese-Targeting Malware Campaign Built on Winos4.0

PS.Maloader.w: Tracking a Five-Domain PowerShell Dropper Campaign Across Rotating Cloudflare-Shielded Infrastructure

KongTuke Stage 2 Dissected: From CLR Memory Patching to XWorm RAT Delivery

BGI Weekly Intelligence Roundup: March 8-14, 2026

Pulsar RAT v2.4.5 — MSI Dropper with GUID-Encoded Shellcode & Cloudflare Workers C2

IcedID / Latrodectus — Signed WiX MSI Dropper Campaign

SakuraCraft Infostealer — Multi-Stage Discord Token & Browser Credential Stealer

Linux.IRCBot/RaspiWorm — Raspberry Pi SSH Worm with IRC C2

DollRAT / "Lilly's RAT V8" — QuasarRAT Custom Variant with ngrok C2 Tunneling

Gh0stRAT / Farfli — "WisemanSupport" Campaign

RUGMI/IDAT Loader + Aurora Stealer — Multi-Stage DLL Sideloading Campaign

Python Infostealer / SKRX Dropper — Multi-Platform Credential Harvester

ACRStealer Infrastructure Report — March 8, 2026

AsyncRAT "Spotify.exe" Campaign Investigation

TernDoor WSPrint.dll Decryption Analysis

Go Loader Framework Deep Dive Report

CountLoader C2 Panel — Full Investigation Report

Abuse Notifications — March 8, 2026

Untitled Investigation

Bashlite/Mirai-Variant IoT Botnet — Full Source Code Recovery

https://www.robotstxt.org/robotstxt.html

InstallFix Campaign: Fake Claude Code Installers Delivering Amatera Stealer

Port 7070 Cluster Investigation — ThinkHuge /21 Infrastructure

QuasarRAT v1.4.1 Fake Client - Technical Report

Untitled Investigation

WaterHydra/DarkCasino APT Nexus: evilgrou-tech Attribution Report

How a Threat Actor's Own RAT Gave Up His Secrets: Dismantling Khan Islam's XWorm MaaS Operation

Bucklog Panel — Full JavaScript Bundle Reverse Engineering

Fresh Hunt Report - March 7, 2026

MalwareBazaar Fresh Hunt Report — March 7, 2026 (Evening Session)

Consolidated Honeypot Threat Intelligence Report

NEKOBYTE Redis Crontab Injection - clu-e.eu Cryptominer Botnet

Blake C2 Infrastructure Dump

BrowserWare ClickFix Campaign Investigation

WsgiDAV Open Directory / Cloudflare Tunnel Malware Distribution Campaign

Open Directory Investigation: 193.111.117[.]17:8080

SERPENTINE#CLOUD - Active Campaign Analysis

Kuwait Air Force Lure — Data Exfiltration via Rclone + MEGA

58,000 Baby Monitors Left Wide Open: How Default Credentials Expose Children Worldwide

Untitled Investigation

Untitled Investigation

Untitled Investigation

Untitled Investigation

Ju

Untitled Investigation

Untitled Investigation

Untitled Investigation

Untitled Investigation

C2 Investigation: 178.22.24.175 — Multi-RAT/Stealer Cluster on GALEON-AS

Threat Actor Profile: angela / angelalk21 / 王从天降

MalwareBazaar Fresh Sample Hunt — 2026-03-05

Threat Investigation Report: Fake CVS Recruiter Malware Campaign

Threat Investigation: "Download ZIP" Campaign — Oman Origin

Phishing Kit Hunting Report — 2026-03-04

AMOS Stealer Campaign Investigation Report

Orçamento2026.msi — GoToResolve Unattended Access Abuse

Remcos RAT — "Mhunter" Campaign

Steaelite RAT C2 Infrastructure Dump

Fake "OpenClaw Skill" macOS Stealer - Full Analysis Report

MuddyWater Infrastructure Exposé: Full Offensive Toolkit Recovered from Open Directory

NFe-RAT Full Investigation Report

Kent-Loader / CS2 Cloud Radar - Malware Analysis Report

Smishing Triad C2 Infrastructure Dump

Forensic Intelligence Report: 186.169.75.221

Forensic Intelligence Report: "SILENT" RAT/Stealer Infrastructure

Vidar Stealer (Go Variant) — Threat Intelligence Report

Threat Intelligence Report: setup-edea1565

Threat Intelligence Report: ELF/Wraith SSH Backdoor + Tux Mirai Botnet

GHOST Intelligence Report

GHOST OSINT Investigation Report

GHOST Intelligence Report: Crypto Investment Scam — zolviqhub[.]live

GHOST Intelligence Report: 139.162.162[.]66

GHOST Intelligence Report: chatcamic[.]com DNS-Based PowerShell C2

Threat Intelligence Report: Phorpiex Dropper + Needle C2 + XMR Mining Botnet

GHOST Intelligence Report — all.sh (Mirai/Titan Botnet Dropper)

GHOST Intelligence Report — QS48890 AgentTesla JScript Dropper

GHOST Intelligence Report: VTUPRESS Bot Panel

GHOST Intelligence Report: Nebula Stealer

GHOST OSINT Report: Odyssey Stealer — cloud-verificate[.]com

GHOST OSINT Report: dashwake[.]info — Malware Distribution Domain

GHOST Intelligence Report: heliosdue[.]info — Remcos RAT Distribution

GHOST Intelligence Report: Intesa Sanpaolo Phishing Campaign

GHOST Intelligence Report: MacSync Stealer C2 Infrastructure

Threat Intelligence Report: SecuriteInfo.com.Heur.MSIL.Benin.5

GHOST Intelligence Report: Fake Stake Casino Stealer Campaign

GHOST Intelligence Report: xeniominb[.]info

GHOST Intelligence Report: 115.175.16[.]26

KB C2 Panel — Threat Intelligence Report

GHOST Investigation: HollyShit JAVA Stealer

GHOST Intelligence Report: SPARROW C2 Panel — 79.7.152[.]162

GHOST Intelligence — Threat Investigation Report

Threat Intelligence Report: 64.exe (c30be980)

GHOST Intelligence Report — SilverFox/ValleyRAT Campaign

THERMITE C2-Lite — Infrastructure Intelligence Report

GHOST Intelligence Report — XWorm Multi-Stage Dropper Campaign

GHOST Intelligence Report — ValleyRAT/SilverFox/RustyStealer

GHOST Intelligence Report — SilverFox/ValleyRAT Campaign

GHOST Intelligence Report: DRAZY V3 Info Stealer Panel

GHOST Intelligence Report: scp749[.]com

GHOST Intelligence Report: SPIDY C2 Panel — vayusena[.]online

GHOST Intelligence Report: SPIDY C2 — vayusena[.]online

GHOST Intelligence Report: Kimsuky DDNS C2 Infrastructure

GHOST Intelligence Report: SPIDY C2 Panel — 176.125.240[.]169

GHOST Investigation: SPM Cloud Worm (TeamPCP Rival)

GHOST Intelligence Report: 35.196.105[.]113

GHOST Investigation: 43.139.81[.]96

GHOST Intelligence Report: React2Shell Worm — "SPM" Campaign

Threat Intelligence Report: cat.sh / Iran Botnet Dropper

GHOST Intelligence Report: centralcoretech[.]com

GHOST Intelligence Report: HeriosBot Campaign

Threat Intelligence Report: invite_card.vbs

GHOST Intelligence Report — Statement-03-2026.vbs

GHOST Intelligence Report — njRAT/Bladabindi

GHOST Intelligence — Vidar Stealer Infrastructure Report

GHOST Investigation: MacSync Stealer C2 — glowmedaesthetics[.]com

DCRat Investigation — 06fdb48d415ce4d6bb0905b9a01e47c2

ValleyRAT / HijackLoader Campaign Investigation

GHOST Intelligence Report — DarkCloud Stealer (a310Logger) Campaign

GHOST Intelligence Report: lotuscare[.]com[.]my Malware Distribution

GHOST Intelligence Report: Trojanized LetsVPN Installer — vpntop[.]com / vpntop[.]com[.]cn

GHOST Investigation: xtrafftrck[.]net / "Chopi" C2 Panel

GHOST Intelligence Report: Android RAT C2 Panel — 144[.]31[.]221[.]172

GHOST Intelligence Report: ZETA C2 Panel — 160[.]179[.]52[.]9

GHOST Intelligence Report: 192.151.146.82 — "CC Panel" C2 Infrastructure

GHOST Intelligence Report: ScreenConnect VBS Loader Campaign

GHOST Intelligence Report: Chopi C2 Infrastructure on 70.34.205[.]43

GHOST Intelligence Report: hx1.bounceme[.]net — Remcos RAT C2

GHOST Intelligence Report: razortiger.docx — Remote Template Injection

Threat Intelligence Report: 20260428-00326

Threat Intelligence Report: inet-mark.com / terazosine.fit Infrastructure

Threat Intelligence Report: INTXCP0Y — AgentTesla v3 Multi-Stage Dropper

Viper Platform15 — Threat Intelligence Report

GHOST Investigation: 152[.]32[.]243[.]224 — Panda Shop / Smishing Triad Korea Campaign

GHOST Intelligence Report — PHPUnit Webshell Dropper & Healthcare SaaS Infrastructure

GHOST Intelligence — Threat Investigation Report

GHOST Intelligence Report — CVE-2017-9841 Webshell Dropper

GHOST Intelligence Report — 164[.]90[.]195[.]107 / CVE-2017-9841 PHPUnit RCE Dropper

DCRat Campaign — Infrastructure Report

Threat Intelligence Report: DCRat / MSIL.Crysan Campaign

Threat Intelligence Report: 104.164.55[.]223

GHOST Intelligence Report: Lazarus-Linked Stealer C2 Infrastructure

AgentTesla Campaign Analysis — ps_pal5rj5H4bCo_1776177017870

GHOST Intelligence Report — AgentTesla Multi-Stage Loader

ValleyRAT / SilverFox Campaign — Threat Intelligence Report

SilverFox / ValleyRAT Malware Analysis

Threat Intelligence Report: Themida-Packed Stealc (Dropped by Amadey)

GHOST Intelligence — Threat Report

GHOST Intelligence Report: India Tax Phishing → DLL Side-Loading RAT Campaign

GHOST OSINT Report: 38.76.199.112 — Infostealer Distribution via Open Directory

GHOST Intelligence Report: Odyssey Stealer (macOS)

GHOST Investigation: AsyncRAT C2 — lapoire*.hopto.org

GHOST Intelligence Report: Turkish-Targeted Multi-Stage VBS Downloader Campaign

GHOST Intelligence Report — invoice-1645080830.pdf (34).js

GHOST Intelligence Report

GHOST Intelligence Report: lesoulkir[.]info

GHOST Intelligence Report

GHOST Intelligence Report — package.ps1 / Nigerian BEC Infostealer Campaign

GHOST Intelligence Report — IMMORTAL DROPPER Campaign

GHOST Intelligence Report — XWorm Multi-Stage Dropper

GHOST OSINT Report: WordPress Domain Renewal Phishing Campaign

GHOST Investigation: 31.58.220.250 — SpiceRAT C2 Infrastructure

GHOST Intelligence Report — Smoke Loader / GCleaner Campaign

JOMANGYRUNNER — FreePBX/VoIP Toll Fraud Campaign

GHOST Intelligence Report — 023782pler.x86_64 (Ladvix Campaign)

RatonRAT Investigation — ivyvbs-45680610

GHOST Intelligence — Threat Actor Infrastructure Report

Threat Intelligence Report: Medusa Botnet — "fuckjewishpeople" Campaign

GHOST Intelligence Report — cat.sh / Mirai Botnet

GHOST Intelligence Report: SideWinder APT — Nayatel Zimbra Credential Harvester on Railway

GHOST Intelligence Report

GHOST Intelligence — Investigation Report

GHOST Intelligence Report — TVT IoT Botnet / "Alyssa" Campaign

GHOST Investigation: greenwoodsinvestmentsltd[.]pro

Threat Intelligence Report: rattnano-0c747417

GHOST Intelligence — Threat Report

Threat Intelligence Report: Aotera Trojanized libpsl-5.dll

JOMANGY VoIP Webshell — Threat Intelligence Report

Threat Intelligence Report: JOMANGY RUNNER — VoIP Toll Fraud Campaign

FlyStudio/FlyAgent RAT — VBS Watchdog Investigation

GHOST Intelligence Report — VBS3.vbs / FlyAgent Backdoor Campaign

GHOST Intelligence Report — LummaStealer C2 Infrastructure

GHOST Intelligence Report — GCleaner PPI Distribution Node

GHOST Intelligence Report: DCRat C2 Infrastructure on tw1[.]ru

GHOST Intelligence — SilverFox/ValleyRAT WPS Lure Investigation

GHOST Intelligence — Threat Investigation Report

Threat Intelligence Report: sxjbv.ps1

Salat Stealer — Dior fix.exe

GHOST Intelligence Report — GoRAT C2 Infrastructure

GHOST Intelligence Report — Mirai Botnet Dropper v.sh

GHOST Intelligence Report: Booking.com ClickFix Campaign Delivering NetSupport RAT

GHOST Intelligence Report: youtude-dl[.]pro / 185[.]107[.]74[.]215

GHOST Investigation: Kimsuky DDNS Infrastructure (216.158.235.97)

GHOST Investigation: 45.227.254[.]10 — Grandoreiro Banking Trojan C2 Infrastructure

GHOST Intelligence Report — NetSupport Manager RAT Campaign

NetSupport RAT Campaign — installer.msi

GHOST Investigation: cksredi[.]pages[.]dev — SharePoint Phishing Redirector

GHOST Investigation: SharePoint Phishing via Cloudflare Pages + IPFS

GHOST Investigation: Microsoft OAuth Device Code Phishing via Compromised WordPress Site

EXECUTIVE SUMMARY

Threat Intelligence Report: Hydra Installer / Galaxy Swapper v2

GHOST Intelligence Report

Agent Tesla Infostealer — Threat Intelligence Report

GHOST Intelligence Report — SnakeKeylogger Campaign Analysis

AgentTesla Campaign — Threat Intelligence Report

XLLiveUpdateAgent.dll — ValleyRAT/Winos Campaign Investigation

GHOST OSINT Investigation: Go-Based Infostealer/Ransomware Abusing gofile.io

LummaStealer Campaign — Setup.exe.exe

Threat Intelligence Report — JS.Stealer / Bundled Node.js Info Stealer

GHOST Intelligence Report: 149.28.141[.]17

GHOST Intelligence Report: DarkCloud Stealer C2 Infrastructure

GHOST Intelligence Report: Braodo Stealer — New Campaign Infrastructure

GHOST Intelligence Report: fast16 Cyber Sabotage Framework

Threat Intelligence Report: BOOKING.vbs / GuLoader → AgentTesla Campaign

GHOST Intelligence — Threat Investigation Report

GHOST Intelligence Report — Formbook/JS Dropper

DCRat Campaign — Investigation Report

PhantomStealer Investigation: Online.bat

PhantomStealer — Rose.ps1 Intelligence Report

GHOST Intelligence Report: htp.win / CVE-2025-48700

GHOST Investigation Report: htp-win-shadowserver-20260424

GHOST Intelligence Report — Mirai Botnet "Ciabins" / "BotnetV2"

GHOST OSINT Investigation Report

GHOST Investigation: dust.exe (MD5: 5b347a6a5104d72a6592568a33778eb2)

GHOST Intelligence Report: Anarchy RAT Panel — 77[.]92[.]36[.]10

GHOST Intelligence Report: DeskRAT Campaign Targeting Indian Defense Sector

GHOST Intelligence Report — Ciabins Mirai/Gafgyt IoT Botnet

GHOST Intelligence Report — bot.ppc (Mirai PPC32 Variant)

PhantomStealer Campaign — String.ps1

THANKS.ps1 — PhantomStealer Campaign Analysis

ValleyRAT / Winos4.0 DLL Module — Investigation Report

GHOST Intelligence Report: Multi-Stage RAT Campaign via Blogspot/Wix Abuse

GHOST Intelligence Report: Tech Support Scam Network on AWS EC2

GHOST Investigation: Voltstealer (Discord Token Stealer)

GHOST OSINT Investigation: Bloated Signed Malware (>650MB) — Probable SolarMarker Variant

GHOST OSINT Investigation: SolarMarker Signed Malware — Bloated Installer with Revoked Certificate

GHOST Investigation: docshub-secure[.]com — Booking.com Phishing → Remcos RAT / Weedhack

Threat Intelligence Report: Percentage.vbs — GT:VB.Laburrak.11

GHOST OSINT Report: 104.18.27.173 — "Smile AiTM" REDUMP Investigation

Kimsuky Credential Phishing Infrastructure — Re-Investigation Report

Go Relay RAT v1.0 — REDUMP Investigation Report

GHOST Intelligence Report: REFUNDEE / Shadow Panel PhaaS+RaaS Operation

GHOST Intelligence Report — your-c2[.]com (MorsWorm C2 REDUMP)

GHOST Intelligence Report: tpmspoof-fc094a9c

GHOST OSINT — Threat Intelligence Report

SOMEONE.vbs — Threat Intelligence Report

GHOST Investigation: ARMV4L Gafgyt/BotnetV2 — b515b4eb

GHOST Intelligence Report — c56e7b25000.vbs

GHOST Intelligence — Threat Actor Infrastructure Report

GHOST Intelligence — Threat Investigation Report

GHOST Investigation: win.node / Glassworm

GHOST Intelligence Report — GCleaner PPI Loader (MIX8 Variant)

Threat Intelligence Report — Gafgyt ELF Sample (I586)

Threat Intelligence Report: njRAT / Bladabindi Sample

GHOST Intelligence Report: Tech Support Scam Network on 54[.]177[.]189[.]169

Threat Intelligence Report: SilverFox / ValleyRAT — Taiwan Escort Scam + RAT Campaign

ValleyRAT Campaign — Infrastructure Analysis

GHOST Intelligence Report — Factory-v3 Stealer Campaign

GHOST Threat Intelligence Report

GHOST Intelligence Report: paksecurity[.]org

GHOST OSINT Investigation Report

GHOST OSINT Report: techoption[.]org

GHOST Intelligence Report: travelmarkbd[.]com Phishing Infrastructure

GHOST Intelligence Report: travelmarkbd[.]com Microsoft Credential Phishing Infrastructure

GHOST Intelligence Report: Dust RAT

ShadowRAT Investigation Report

GHOST Intelligence Report: AgentTesla & PhantomStealer FTP C2 Infrastructure

GHOST Intelligence Report: Agent Tesla Campaign via Blogspot/Wix Redirectors

Threat Intelligence Report: Amadey + Browser Hijacker Combo

GHOST Intelligence Report: Fake Booking.com Invoice Campaign

GHOST Intelligence Report: corella[.]ro — Compromised SMTP Credentials in Malware

GHOST OSINT Investigation: corella[.]ro

GHOST OSINT Report: crioralo[.]ru — QR Code Phishing Redirector

Threat Intelligence Report: dat.bat — Multi-RAT Dropper Campaign

GHOST Intelligence — Threat Investigation Report

Threat Intelligence Report: SilverFox/ValleyRAT — WetypeInstaller Trojan

Threat Intelligence Report: Indeed.bat / DonutLoader → Cobalt Strike

GHOST Intelligence Report: sport.ps1 / PowerShell Infostealer Campaign

GHOST Investigation: endpointdlp.dll — Havoc C2 Beacon

THREAT INTELLIGENCE REPORT

ChromeSetup.exe — DarkComet RAT v5.3.0 Investigation

GHOST Intelligence Report — ZcaLoader C2 Botnet

CDO.EXE — njrat/Bladabindi C2 Infrastructure Investigation

GHOST Intelligence Report — quantium.exe / Vidar Stealer

GHOST Intelligence Report — DS4C1_577888-c01cd8c2

GHOST Investigation: 212.50.233[.]30

GHOST Intelligence Report — 23.94.252[.]145

GHOST Intelligence Report: Trojanized GitHubDesktopSetup with Rust Backdoor

GHOST Intelligence Report: lkgkdsjd[.]com — Malware Distribution Infrastructure

185.177.72.0/24 Deep Dive -- Breakglass Intelligence Report

APT41/Winnti ELF Backdoor (0fca9dae) — Breakglass Intelligence Report

Booking.com ClickFix Campaign Delivering NetSupport RAT — Breakglass Intelligence Report

C2 Infrastructure at 116.202.208.125 -- Breakglass Intelligence Report

GELD-PAYPAL / MHost SMS Fraud Operation — Breakglass Intelligence Report

REFIRE: Amadey Botnet C2 on OMEGATECH Bulletproof Hosting -- Breakglass Intelligence Report

Operation InterviewBait -- Fake Job/Recruitment AiTM Phishing Campaign

FEZBOX npm Supply Chain Attack -- Operator Attribution Report

Operation REFIRE — Italian Banking Phishing Campaign (Multi-Kit)

Kimsuky Webmail/Zoom/Naver/SharePoint Phishing Infrastructure -- Breakglass Intelligence Report

MacSync Stealer C2 Panel at 172.94.9.250 — Breakglass Intelligence Report

Malware Analysis Report — `manual-final-app-exe`

Operation BLOG HARVEST -- Kimsuky Mass Phishing Nexus at 158.247.219.150

MefStealer C2 Panel / NOMADS Group -- Breakglass Intelligence Report

nas.doc CVE-2026-21509 Exploit Targeting Pakistani Aerospace/Military -- Breakglass Intelligence Report

NEXUS-PHISH -- Multi-Campaign Phishing & RAT Infrastructure on DigitalOcean

PlugX Mongolia (TA416/Mustang Panda) -- Breakglass Intelligence Report

RodexRMM GoLang RAT -- Breakglass Intelligence Report

SideWinder APT — Azerbaijan-Russia Diplomatic Crisis Lure Campaign

TEAM24 Korean Credential Phishing Syndicate -- Breakglass Intelligence Report

ValleyRAT Win64/Valley.E — Multi-Stage BYOVD RAT

ValleyRAT / SilverFox — WinRAR SFX Dropper with WeChat Disguise

Multi-RAT C2 Operator: XWorm, Hook, DCRat, AsyncRAT, njRAT — Breakglass Intelligence Report

AgentTesla JScript Dropper — RFQ Spear-Phishing Loader

CountLoader HTML Smuggling Campaign — Breakglass Intelligence Report

NetSupport RAT v14.10 — ClickFix Dropper Campaign via applicationhost17.com

KongTuke Investigation Report

LOKI Ransomware/Extortion Operation — Full Infrastructure & Panel Analysis

GlassWorm HTML Infostealer/RAT — Obfuscated JavaScript Dropper with Crypto-Targeting C2

AgentTesla - Multi-Stage JScript Dropper with Process Hollowing

PhantomStealer - Multi-Stage .NET Credential & Data Stealer

AgentTesla JScript Dropper - Firebase-Staged PowerShell Downloader

PhantomStealer v3.5.0 — Multi-Stage WSH Dropper / .NET Infostealer (MaaS)

AgentTesla v3 — Five-Stage JavaScript Dropper with SMTP Exfiltration

DataSurge Botnet — Mirai Variant IoT Dropper with DNS-Based Dynamic C2

BlinkzSec — Russian Tech-Support Scam / Reverse SSH-RDP Backdoor

AgentTesla/SnakeKeylogger — Multi-Layer VBScript Dropper (PO_20981.vbe)

njRAT v0.7d (Bladabindi) — Active C2 Campaign via No-IP DDNS

Formbook - VBScript Dropper with IPFS-Hosted Steganographic Loader

LummaStealer — HTML Smuggling Dropper with Multi-Stage Cryptocurrency & Browser Credential Theft

Malware Intelligence Report

Threat Intelligence Report: PhantomStealer v3.5.0

Honeypot Counter-Intelligence Hunt — March 13, 2026

Sora/Mirai Botnet Dropper (ohshit.sh) -- Breakglass Intelligence Report

GHOST Investigation: Parasitic Training Insect — Signed MSI Campaign

GoDrive.vhdx -- APT-C-60 SpyGlace Campaign Analysis

Leveros Club SpyAgent -- Brazilian Banking Trojan with Chinese-Origin Signing Certificate

libcef.dll Brazilian Banking Trojan -- SEFAZ Impersonation Campaign

CountLoader HTML Smuggling Campaign (March 12, 2026) -- Breakglass Intelligence Report

Operation MAYNA HARVEST -- Ukrainian MoD Phishing Campaign Delivering Remcos RAT

SWIFT COPY.JS AgentTesla Dropper -- Breakglass Intelligence Report

ValleyRAT DLL Loader (March 12, 2026) -- Breakglass Intelligence Report

ConnectWise ScreenConnect Abuse: Spanish "Factura" Lure Campaign -- Breakglass Intelligence Report

ACRStealer with Telegraph Dead Drop Resolver — Breakglass Intelligence Report

BadPaw .NET Trojan Downloader -- Breakglass Intelligence Report

Joker/Bread Android Trojan: Rust+ChaCha20 Variant in "Cute Emoji Wallpaper" -- Breakglass Intelligence Report

PhantomStealer JavaScript Dropper Campaign -- Breakglass Intelligence Report

Operation Fake Carbanak: Multi-Malware Campaign Targeting Security Researchers via Vidar Stealer

Breakglass Intelligence Report: Gh0stRAT Campaign (March 2026)

Breakglass Intelligence Report: MSC-Loader (Kimsuky)

Breakglass Intelligence Report: UKR-Lure BES Campaign

Vjw0rm RAT Dropper Chain -- Breakglass Intelligence Report

Breakglass Intelligence Report: TrojanizedAutoCAD Campaign

Breakglass Intelligence Report: CVE-2026-21509 Exploit Analysis

ClickFix / FakeCaptcha Booking.com Campaign — Breakglass Intelligence Report

GoldFX — Breakglass Intelligence Report

OffLoader Loader/Dropper -- Breakglass Intelligence Report

QuasarRAT Multi-RAT C2 Infrastructure -- Breakglass Intelligence Report

RedTail Cryptominer (Multiverze Variant) -- Breakglass Intelligence Report

verification.google / lets74.dll -- Breakglass Intelligence Report

SilverFox Trojanized Arma 3 Campaign -- Breakglass Intelligence Report

Evil Stealer — @solostalking Pivot Findings

Evil Stealer — Breakglass Intelligence Report

MacSync Stealer / BarkBlitz — Breakglass Intelligence Report

RESOKER RAT -- Breakglass Intelligence Report

Shadow RAT Panel v2.0 -- Breakglass Intelligence Report

SmokeLoader Remus Plugin Campaign (March 2026) — Breakglass Intelligence Report

DarkCloud Stealer via AutoIt Multi-Payload Crypter — Breakglass Intelligence Report

AgentTesla JS Dropper (DonutLoader Chain) -- Breakglass Intelligence Report

Amadey Botnet (fbf543 Campaign) -- Breakglass Intelligence Report

PhishingRAT AsyncRAT Campaign -- Breakglass Intelligence Report

DarkGate Campaign 4479023 -- Breakglass Intelligence Report

DCRat (DarkCrystal RAT) -- Russian Shared Hosting Campaign -- Breakglass Intelligence Report

DeerStealer via GhostPulse/IDAT Loader -- Breakglass Intelligence Report

Formbook/XLoader JavaScript Dropper -- Breakglass Intelligence Report

GhostPulse/IDAT Loader via ShadowLadder Campaign -- Breakglass Intelligence Report

GoToResolve RMM Abuse Campaign -- Breakglass Intelligence Report

GuLoader NSIS Campaign -- Breakglass Intelligence Report

LummaStealer Go Loader / fbf543 Amadey Campaign -- Breakglass Intelligence Report

MeshAgent RMM Abuse Campaign ("traffic-rc") -- Breakglass Intelligence Report

A0Backdoor / Storm-1811 Signed Malware Cluster -- Breakglass Intelligence Report

NetSupport RAT via ClickFix Social Engineering Campaign -- Breakglass Intelligence Report

XWorm RAT "Token GrabberV2" -- Breakglass Intelligence Report

PhantomStealer Campaign Analysis -- Breakglass Intelligence Report

QakBot tchk08 MSI Dropper -- Breakglass Intelligence Report

ClearFake + HijackLoader + Raccoon Stealer v2 -- MSIX Package Campaign

RedLine Stealer: CETA Supply Chain Attack -- Breakglass Intelligence Report

RemcosRAT "SkyLNK" HTA Campaign -- Breakglass Intelligence Report

RemcosRAT Multi-Stage JavaScript Dropper Campaign -- Breakglass Intelligence Report

ResolverRAT Multi-Tool Campaign -- Breakglass Intelligence Report

SectopRAT/Arechclient2 -- ACRStealer Delivery Campaign

SnakeKeylogger Multi-Vector Campaign -- Breakglass Intelligence Report

StealC Infostealer (Botnet 3 / joscramp.top) -- Breakglass Intelligence Report

ValleyRAT "Codemark" Campaign -- Breakglass Intelligence Report

Vidar Stealer March 2026 Campaign -- Breakglass Intelligence Report

XWorm v6.4 Go Loader with ScrubCrypt Dropper -- Breakglass Intelligence Report

zgRAT Booking.com ClickFix Campaign -- Breakglass Intelligence Report

CryptoVista Trojanized Installer -- Breakglass Intelligence Report

EY Invoice VBS Dropper / XWorm 7.4 RAT -- Breakglass Intelligence Report

Gunra Ransomware Linux ELF Variant -- Breakglass Intelligence Report

Lazarus Group Dual-Tool Campaign: Medusa Ransomware + IME Sideloading Loader — Breakglass Intelligence Report

MuddyWater Python Dropper: mazafakaerindahouse Campaign -- Breakglass Intelligence Report

ACRStealer / AmateraStealer — Breakglass Intelligence Report

AgentTesla NSIS Dropper -- Breakglass Intelligence Report

AsyncRAT "PhishingRAT" Variant -- Breakglass Intelligence Report

Weaponized NQVM/NetSupport Manager RAT — Misclassified as BruteRatel C4

BumbleBee Loader "Shanya" Campaign -- Breakglass Intelligence Report

ClickFix EternalRocks Dropper (bruce.php) -- Breakglass Intelligence Report

CobaltStrike Stager + Shellcode Beacon -- Breakglass Intelligence Report

DCRat "Trillex" Campaign — Breakglass Intelligence Report

Emotet/SilverFox March 2026 Campaign Analysis — Breakglass Intelligence Report

Formbook/XLoader Infostealer — Breakglass Intelligence Report

CountLoader HTML Smuggling Campaign -- Breakglass Intelligence Report

ResolverRAT + LummaStealer Multi-Payload .NET Loader -- Breakglass Intelligence Report

Rhadamanthys Stealer JS Dropper ("Hotel-SEP" Campaign) -- Breakglass Intelligence Report

RMM Tool Abuse Campaign -- Amadey/fbf543

ScreenConnect RMM Abuse Campaign (March 2026) -- Breakglass Intelligence Report

SocGholish (FakeUpdates) March 2026 Campaign Wave -- Breakglass Intelligence Report

StealC Infostealer (joscramp[.]top Campaign) -- Breakglass Intelligence Report

Vidar Stealer Campaign Investigation -- March 9, 2026

"Mich0 Shell" (fonts.php) -- Breakglass Intelligence Report

XWorm RAT Campaign Analysis — March 9, 2026