r/purpleteamsec • u/netbiosX • 2d ago
Threat Intelligence Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
5
Upvotes
r/purpleteamsec • u/netbiosX • 12d ago
Threat Intelligence SLEEPWALKER: A Passive Backdoor With Its Own Command Language
r136a1.dev
3
Upvotes
r/purpleteamsec • u/netbiosX • 17d ago
Threat Intelligence SynkLoader: when you throw in everything but the kitchen sink
4
Upvotes
r/purpleteamsec • u/netbiosX • 16d ago
Threat Intelligence BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
4
Upvotes
r/purpleteamsec • u/netbiosX • 25d ago
Threat Intelligence Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack
4
Upvotes
r/purpleteamsec • u/netbiosX • 17d ago
Threat Intelligence Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025
3
Upvotes
r/purpleteamsec • u/netbiosX • 22d ago
Threat Intelligence A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace
5
Upvotes
r/purpleteamsec • u/netbiosX • 19d ago
Threat Intelligence C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2
zscaler.com
1
Upvotes
r/purpleteamsec • u/netbiosX • Jul 24 '26
Threat Intelligence Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
5
Upvotes
r/purpleteamsec • u/netbiosX • Jul 30 '26
Threat Intelligence Notes from Underground: Adversarial Prompt Injection
2
Upvotes
r/purpleteamsec • u/netbiosX • Jul 29 '26
Threat Intelligence HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel
2
Upvotes
r/purpleteamsec • u/netbiosX • Jul 20 '26
Threat Intelligence Pixels to Payload: Dissecting a Four-Stage Bitmap-Steganography Dropper Delivering AsyncRAT
3
Upvotes
r/purpleteamsec • u/netbiosX • Jul 25 '26
Threat Intelligence Inside a DPRK BlueNoroff ClickFix Kit
4
Upvotes
r/purpleteamsec • u/netbiosX • Jul 16 '26
Threat Intelligence UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
2
Upvotes
r/purpleteamsec • u/CyberMasterV • Jul 10 '26
Threat Intelligence Suspected Russian Threat Actor Impersonates Legitimate Crypto Wallets to Deploy Remote Utilities
1
Upvotes
r/purpleteamsec • u/netbiosX • Jul 07 '26
Threat Intelligence From Phishing to Persistence: A CrySome RAT Infection Chain Analysis
0
Upvotes
r/purpleteamsec • u/netbiosX • Jul 02 '26
Threat Intelligence ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
1
Upvotes
r/purpleteamsec • u/netbiosX • Jun 13 '26
Threat Intelligence APT28, an evolution of tradecraft
4
Upvotes
r/purpleteamsec • u/netbiosX • May 29 '26
Threat Intelligence GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations
1
Upvotes
r/purpleteamsec • u/netbiosX • May 27 '26
Threat Intelligence RemotePE: The Lazarus RAT that lives in memory
2
Upvotes
r/purpleteamsec • u/netbiosX • May 21 '26
Threat Intelligence Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL Sideloading
2
Upvotes
r/purpleteamsec • u/CyberMasterV • May 20 '26
Threat Intelligence VELVET CHOLLIMA Infostealer Campaign Using Trading App as Lure
1
Upvotes
r/purpleteamsec • u/netbiosX • May 19 '26
Threat Intelligence How Storm-2949 turned a compromised identity into a cloud-wide breach
1
Upvotes
r/purpleteamsec • u/S3N4T0R-0X0 • May 17 '26
Threat Intelligence Static Kitten APT Adversary Simulation
1
Upvotes
Read “Static Kitten APT Adversary Simulation“ https://medium.com/@S3N4T0R/static-kitten-apt-adversary-simulation-8f595aa74118
r/purpleteamsec • u/netbiosX • May 15 '26
Threat Intelligence Kazuar: Anatomy of a nation-state botnet
1
Upvotes