The Evolution of C2: Centralized to On-Chain

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

Part two of Wiz's Linux rootkit series: how loadable kernel modules (LKMs) work, how threat actors like TeamTNT and Winnti abuse them in the wild, and how to detect kernel-space rootkits.

Check Point reports a surge of COVID-19 themed domains and dark web sales, with malware campaigns (AZORult, Emotet, TrickBot) and APT36, BabyShark operations exploiting the pandemic.

An overview of ransomware as a criminal business model, tracing its economic lifecycle from ransom payments to RaaS toolkits, with guidance on prevention, detection, and attack simulation readiness.