32.dll

• HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm

  HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. According to Blackpoint

• From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat

  From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat Cisco Talos has uncovered a BadIIS variant — identifiable by its embedded "demo.pdb" strings — that functions as commodity malware, likely sold or shared among multiple Chinese-speaki

• Introduction to COM usage by Windows threats

  Introduction to COM usage by Windows threats Component Object Model (COM) is a fundamental Windows technology used by legitimate applications for object activation, inter-process communication, automation and language-independent component reuse. Those same qualities make it use

• FishMonger’s arsenal upgraded: SprySOCKS for Windows

  FishMonger’s arsenal upgraded: SprySOCKS for Windows ESET researchers have discovered SprySOCKS for Windows, FishMonger’s backdoor weaponizing a kernel driver for advanced stealthiness FishMonger’s arsenal upgraded: SprySOCKS for Windows Award-winning news, views, and insight f

• Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

  Cavern Manticore: Exposing Iran-Linked Modular C2 Framework Key Points Introduction Since early 2026, Check Point Research (CPR) has tracked a new modular command-and-control framework used by Cavern Manticore, an Iran-nexus APT group primarily targeting Israeli organizations, w

• Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation

  Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation A cybercrime campaign combined a loader-as-a-service framework and DLL sideloading via a Go-compiled fake MpClient.dll, a novel evasion layer combination. The post Vidar Stealer Unmasked: Code Signing Abus

All reports →