A previously unseen Rust-based ransomware family named Spirals was deployed in a double extortion attack against a South Asian IT services company in June 2026. The attackers compromised an internet-facing IIS web server via an ASP.NET web shell, established multiple redundant C2 channels using revsocks, Chisel, and Cloudflare tunnel, performed credential theft via SAM and LSASS dumps, and deployed the ransomware payload via PsExec across the network within 24 hours of initial access. The ransomware uses AES-128 file encryption with ECDH P-256 key wrapping and includes capabilities for defense evasion, lateral movement, and process termination.
Cloudflare
31 posts
Spirals: New Stealthy Ransomware Deployed Against Asian IT Company Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet TrendAI Research analyzed 200 Gemini CLI session logs from the Russian-speaking threat actor 'bandcampro,' revealing a solo operator who used Google Gemini CLI as the primary engineering agent to deploy and operate a C&C botnet targeting a dental clinic. The AI handled architecture design, coding, deployment, debugging, and WAF bypass autonomously, migrating the entire C&C infrastructure in six minutes. The operation is encoded in three portable plain-text files (~5KB) that can be shared and deployed by non-technical actors, representing a paradigm shift where AI lowers the skill barrier for complex cyber operations and makes infrastructure disposable and rapidly rebuildable.
11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload Eleven malicious NuGet DotnetTool packages masquerading as game cheats deliver a two-stage Windows payload. The first-stage .NET downloader resolves GitHub hosts via DNS-over-HTTPS to bypass local DNS controls, requests UAC elevation to resync the system clock, and fetches pepesoft.exe from GitHub Releases and Hugging Face. The second-stage PyInstaller-packed Python payload exfiltrates hardware fingerprints, system information, IP geolocation, and screenshots to Google Sheets and Telegram, with a server-side ban-list and hardware binding for licensing enforcement across all recovered builds.
Kratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk Kratos is a mature Phishing-as-a-Service operation impersonating Microsoft 365 login pages to steal credentials across US and European organizations. The kit uses legitimate platforms (SharePoint, Canva, Tilda) as intermediary redirect pages, Cloudflare Turnstile to block automated analysis, and PHP endpoints for credential exfiltration. Researchers identified three generations (V0, V1, V2) with distinct asset fingerprints and exfiltration code, and uncovered the operator panel with automated deployment, Telegram-based data delivery, and geographic restriction capabilities.
Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor A multi-stage attack campaign uses malicious LNK files delivered via booking-themed phishing emails to deploy a Node.js-based backdoor. The LNK files use bigint arithmetic obfuscation to reconstruct C2 URLs, download a PowerShell payload that deploys a legitimate node.exe binary, and execute an AES-128-CBC encrypted JavaScript backdoor. The backdoor retrieves its C2 address from the TON blockchain using the EtherHiding technique, employs a custom bytecode VM interpreter for defense evasion, and supports downloading and executing additional payloads including PE files, PowerShell, and JavaScript.
US Threat Landscape Alert: 30 Active Malware Families Ranked by Real Sandbox Data ANY.RUN's Malware Trends Tracker data shows that phishing-as-a-service kits now dominate the US threat landscape, with five of the top ten threats being AiTM or device-code phishing platforms that defeat MFA by stealing session cookies or OAuth tokens. Commodity RATs and info stealers remain in constant high-volume circulation, while legacy threats like Emotet and WannaCry persist on unpatched systems. Several top-ranked threats (Cobalt Strike, Qbot, Emotet, DonutLoader, Smoke Loader) function as ransomware precursors, meaning their detection should trigger urgent escalation rather than routine handling.
- 8 minWeekly Recap — 2026-06-29 -> 2026-07-06
Token Theft and AI Poisoning Redefine the Perimeter Attackers are shifting from breaking passwords to stealing active login sessions, bypassing multi-factor authentication entirely. This week, ARToken and ConsentFix exploited Microsoft 365 OAuth flows to hijack accounts, while Anubis ransomware used the ongoing CitrixBleed 2 vulnerability to steal session tokens from network gateways. Even a standard user can become a Global Administrator in minutes if identity settings are loose, as demonstrated by a recent M365 privilege escalation analysis. Simultaneously, artificial intelligence systems have evolved from helper tools to critical vulnerabilities, serving as both the weapon and the target. Threat actors are using AI to generate malware like InfernoGrabber v9.0 and BusySnake Stealer, while also poisoning AI agent ecosystems with malicious skills like OpenClaw and tricking AI models into executing financial fraud via indirect prompt injection. The AI arms race has accelerated breakout times to under 30 minutes, with state-sponsored groups like GTG-1002 now orchestrating entire espionage campaigns via AI. Defenders must immediately audit identity and session controls, treating session tokens as highly sensitive credentials. Security teams should also implement guardrails for AI agents, verifying external URLs and restricting autonomous financial or code execution actions.
The Platform You Trust Is the Platform They Target Cofense Intelligence reports a strategic shift in phishing operations toward platform-aware delivery, where threat actors fingerprint victim devices via browser User-Agent strings and deliver OS-specific payloads from a single landing page. Windows users receive legitimate remote access tools like ConnectWise RAT or Itarian RAT repurposed as malware, while MacOS and Android users are redirected to credential phishing pages. The abuse of legitimate RATs evades signature-based detection, and platform-siloed security tools fail to correlate the campaign across operating systems, leaving organizations with an incomplete picture of the intrusion scope.
The Hacker’s 2026 Playbook from the Dark Web The article details two evolving social engineering techniques: ClickFix, which tricks users into pasting and executing attacker-supplied PowerShell commands via fake prompts, and ConsentFix, which abuses Microsoft 365 OAuth consent flows by manipulating users into dragging a localhost callback link into the browser to capture session tokens. A complete ConsentFix playbook with working code was publicly shared on a Russian cybercrime forum, enabling widespread adoption. Both techniques bypass traditional security controls by exploiting user muscle memory and legitimate platform infrastructure.
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances Gamaredon, a Russia-aligned APT group attributed to the FSB, maintained high operational tempo throughout 2025 with 35 spearphishing campaigns exclusively targeting Ukrainian government and military institutions. The group introduced six new PowerShell tools, resurrected the PteroSetup VBScript weaponizer for lateral movement, and began abusing CVE-2025-8088 (WinRAR) for persistence via the Startup folder. A significant infrastructure evolution occurred: C&C servers are now hidden behind tunnel services (Cloudflare tunnels, Cloudflare workers, Microsoft devtunnels, Loophole) and dead-drop resolutions on legitimate platforms (Telegram, Telegra.ph, Rentry, GoFile, Dropbox, and others), while stolen data is exfiltrated to S3-compatible cloud storage (Wasabi, Tebi, Intercolo) rather than attacker-owned servers.
VerdantBamboo: Just Another BRICKSTORM in the Firewall VerdantBamboo, a Chinese threat actor, compromised edge appliances including Egnyte Storage Sync, pfSense firewalls, and Synology NAS devices to deploy custom malware (BRICKSTORM, PLENET, AGENTPSD). The attackers exploited a compromised MSP and local privilege escalation misconfigurations to maintain long-term persistence, using the compromised devices to proxy traffic and bypass Microsoft 365 Conditional Access policies.
FSB’s matryoshka #2/3 – Gamaredon’s gifts that keeps unpacking – GammaLoad Gamaredon, a Russia-nexus threat actor, utilizes a multi-stage VBScript loader framework named GammaLoad to establish persistent access and deploy subsequent payloads like GammaSteel. The infection chain leverages Dead Drop Resolvers on legitimate platforms, stores C2 configurations in the Windows Registry, and uses Alternate Data Streams (ADS) combined with Scheduled Tasks for stealthy execution.
Pointing a Cursor at evading detection Sophos researchers uncovered a threat actor utilizing AI-native development tools, specifically the Cursor IDE and Claude Opus, to build and iteratively test a post-exploitation framework designed to evade major EDR solutions. The framework automates the ingestion of public security research to generate and refine custom Rust and Go payloads, ultimately supporting ransomware and data theft operations.
FSB’s matryoshka #1/3 – Gamaredon’s gifts that keeps unpacking – GammaPhish and GammaWorm Gamaredon (FSB) is conducting an ongoing cyberespionage campaign against Ukrainian targets using a modular, fileless infection chain. The attack leverages HTML smuggling and archive path traversal (CVE-2025-8088) for initial access, followed by the deployment of GammaWorm, which utilizes NTFS Alternate Data Streams (ADS) and Dead Drop Resolvers (DDRs) on legitimate platforms for persistence, propagation, and C2 communication.
From Cookies to Keys: Why Hackers Don’t Need Your Passwords Anymore Cybercriminals are shifting from traditional credential theft to session hijacking using infostealer malware, allowing them to bypass multi-factor authentication (MFA). By harvesting and replaying valid session tokens using automated tools, attackers gain rapid, stealthy access to corporate environments, which is then often monetized by Initial Access Brokers.
APT Meets GPT: Targeted Operations with Untamed LLMs The China-aligned threat actor UTA0388 is leveraging Large Language Models (LLMs) to conduct highly tailored, rapport-building spear-phishing campaigns targeting organizations in North America, Asia, and Europe. These campaigns deliver GOVERSHELL, a custom backdoor deployed via DLL search order hijacking, which has undergone rapid, non-iterative development across five variants to evade detection and establish persistent C2.
One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign A solo Russian-speaking threat actor tracked as 'bandcampro' leveraged jailbroken AI models to automate a multi-year influence operation and cryptocurrency fraud campaign targeting American conservative communities. The actor utilized AI for content generation, infrastructure management, password mutation for WordPress brute-forcing, and distributed a fake crypto wallet that installed the legitimate GoToResolve RMM tool for remote access.
Thus Spoke…The Gentlemen A recent leak of internal communications and backend data from 'The Gentlemen' RaaS operation has revealed the group's highly structured operational model and mature toolset. The threat actors actively exploit edge appliances and NTLM relay vulnerabilities for initial access, followed by extensive use of red-team tools and custom EDR evasion techniques to deploy their cross-platform ransomware.
Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response The article details a defensive architecture using Elastic Security to detect web server probing and directory fuzzing against Traefik reverse proxies. By analyzing HTTP 403 and 404 error thresholds, security teams can trigger automated workflows that dynamically update Cloudflare WAF rules to block malicious source IPs at the edge.
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook Elastic Security Labs identified TCLBANKER, a new Brazilian banking trojan distributed via DLL sideloading that features robust anti-analysis mechanisms and environment-gated payload decryption. The malware deploys a full-featured banking trojan with a WPF-based social engineering overlay framework, alongside worm modules that self-propagate by hijacking WhatsApp Web sessions and Microsoft Outlook accounts.
Donuts and Beagles: Fake Claude site spreads backdoor A malvertising campaign is leveraging a fake Claude AI website to distribute a malicious MSI installer. The infection chain employs DLL sideloading via a legitimate G DATA executable to execute DonutLoader, which ultimately deploys a novel backdoor dubbed 'Beagle' for remote command execution and file manipulation.
Token Bingo: Don’t Let Your Code be the Winner A widespread phishing campaign is leveraging the Kali365 Live Phishing-as-a-Service (PhaaS) platform to execute device code phishing and AiTM attacks. By tricking users into authorizing legitimate Microsoft device login requests, threat actors steal OAuth access and refresh tokens, bypassing traditional credential-based defenses and MFA to gain persistent access to Microsoft 365 environments.
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT Threat actor REF6598 is targeting the financial and cryptocurrency sectors using social engineering to trick victims into opening a malicious Obsidian vault. The attack leverages Obsidian's community plugins to execute cross-platform attack chains, culminating in the deployment of the PHANTOMPULSE RAT on Windows and an AppleScript dropper on macOS.
How Phishing Is Targeting Germany’s Economy: Active Threats from Finance to Manufacturing German critical industries are facing coordinated, highly targeted phishing campaigns utilizing Phishing-as-a-Service platforms like EvilProxy and FlowerStorm. These attacks leverage Adversary-in-the-Middle (AitM) techniques to intercept session cookies, effectively bypassing traditional Multi-Factor Authentication (MFA) to compromise Microsoft 365 and Okta accounts.
Major Cyber Attacks in March 2026: OAuth Phishing, SVG Smuggling, Magecart, and More March 2026 saw a surge in sophisticated, multi-stage cyber attacks designed to evade early detection. Key threats included OAuth device code phishing (EvilTokens) for M365 account takeover, registry-hidden RAT staging (RUTSSTAGER), macOS backdoors delivered via ClickFix lures, and resilient botnets utilizing Dead Drop Resolvers.
The Unintentional Enabler: How Cloudflare Services are Abused for Credential Theft and Malware Distribution Threat actors are actively abusing legitimate Cloudflare services, specifically Workers and Tunnels, to conduct adversary-in-the-middle (AiTM) phishing and distribute malware. By leveraging Cloudflare's trusted infrastructure and free tiers, attackers successfully bypass traditional security controls to deliver remote access trojans like Xeno RAT and XWorm RAT via obfuscated WebDAV connections.
Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure Threat actors are leveraging the EvilTokens Phishing-as-a-Service platform hosted on Railway.com to conduct large-scale device code phishing campaigns against Microsoft 365 users. By abusing legitimate cloud infrastructure and multi-hop redirect chains, attackers successfully bypass email filtering and MFA to harvest persistent OAuth tokens.
Tycoon2FA Phishing-as-a-Service Platform Persists Following Takedown Following a major law enforcement takedown of its infrastructure on March 4, 2026, the Tycoon2FA Phishing-as-a-Service (PhaaS) platform has quickly reconstituted its operations. The platform continues to enable cybercriminals to bypass multifactor authentication (MFA) using Adversary-in-the-Middle (AiTM) techniques, leading to cloud account takeovers and Business Email Compromise (BEC).
2025 Year in Review: Malicious Infrastructure In 2025, Insikt Group observed the continued dominance of Cobalt Strike, AsyncRAT, and infostealers like Vidar, alongside the rise of new offensive tools such as RedGuard, Ligolo, and CastleLoader. The report highlights the critical role of Threat Activity Enablers (TAEs) and the abuse of legitimate infrastructure services, such as CDNs, in sustaining cybercriminal and APT operations.
Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale Tycoon2FA is a widespread Adversary-in-the-Middle (AiTM) Phishing-as-a-Service platform operated by the threat actor Storm-1747. It enables cybercriminals to bypass standard multifactor authentication (MFA) at scale by intercepting session cookies and credentials using spoofed sign-in pages, custom CAPTCHAs, and complex redirect chains.
Abusing .arpa: The TLD That Isn’t Supposed to Host Anything Threat actors are utilizing a novel phishing technique that abuses the implicitly trusted .arpa top-level domain and IPv6 tunnels to bypass standard security controls. By registering reverse DNS domains for IPv6 blocks and creating A records instead of PTR records, attackers host malicious content on infrastructure that evades reputation-based blocking and policy filters.
