Threat Intelligence Directory

According to Elastic Security Labs, CASTLESTEALER is a .NET-based information-stealing malware family that is delivered in-memory by the OXLOADER loader using DonutLoader-generated shellcode. It is embedded as an encrypted and compressed .NET assembly that is decrypted, decompressed, and reflectively executed in memory to minimize on-disk artifacts. The family uses AES-encrypted communications with its command-and-control infrastructure, with a characteristic hard-coded key that has been reused across samples. As an infostealer targeting Windows environments, it is designed to collect sensitive data (such as user credentials and other information) and interacts with the system in memory to support discovery and data exfiltration while evading conventional detection.

Malware family tracked by Malpedia. ID: win.oxloader

Malware family tracked by Malpedia. ID: win.sisron

According to Proofpoint, SilentRunLoader is a Python-based stealer/loader used by TA4922 to quietly download and execute a next-stage payload. It is designed to harvest Chrome data and other browser artifacts and exfiltrate them to a C2 server. The Python code is relatively straightforward and often appears as vibe-coded, with rapid development of new Python-based tooling observed across campaigns. This reflects the actor’s use of Python-based malware to quickly deploy new payloads.

According to Proofpoint, RomulusLoader is a C-based loader whose purpose is to download and execute further payloads from a C2. It includes a custom PE loader, dynamic API resolution, and RC4 encryption for embedded payloads, and it sideloads legitimate components to blend into the environment. It operates in a multi-stage fashion, spawning workers that run in other processes to maintain persistence and facilitate C2 communications. As a first-stage loader, it is used to drop follow-on payloads, including remote-management software, enabling broader remote access capabilities for the operator.

According to Proofpoint, Atlas RAT is a modular backdoor used by the TA4922 actor, delivered in multiple stages with a core module and optional plugins. It can gather system information, enumerate and exfiltrate files, and perform surveillance such as audio/video capture, along with the ability to download and run additional payloads. The loader uses anti-analysis techniques and loads the core module through a shellcode-based process, with capabilities to inject into other processes as part of its operation. The overall toolset is aligned with a Chinese-speaking actor and is designed to be extended through modular plugins fetched from the C2.

According to HarfangLab, GammaLoad is a second-stage VBScript/HTA payload that serves as a persistent beacon and downloader for the next payload. It runs in a two-layer VBScript framework, with an outer installer enabling RunOnce-style persistence and the inner layer using MSXML2.XMLHTTP to beacon to its C2 over Cloudflare-proxied infrastructure.

According to HarfangLab, GammaDrop is a VBScript-based downloader that forms the first stage of a two-stage infection chain. It uses obfuscated VBScript stored in a stealthy data stream to fetch a second-stage HTA payload (GammaLoad) and execute it, achieving persistence via the Startup folder.

According to TeamT5, SoxAgent is a Linux backdoor that covertly converts compromised hosts into SOCKS5 relay nodes. It maintains a persistent reverse connection to a hardcoded C2 and negotiates AES-encrypted tunnels, enabling the attacker to forward TCP traffic through the victim to conceal their origin. It supports remote updates, self-deletion, and heartbeat reporting with falsified tunnel metrics to enhance stealth. The activity associated with SoxAgent is part of a campaign that deployed the backdoor to form an ORB network tracked as GOBLIN14.

According to Microsoft Incident Response, StilachiRAT is a sophisticated remote access trojan that uses stealth and persistence techniques to evade detection and enable data exfiltration. It performs extensive system reconnaissance, can target cryptocurrency wallet data, and steals browser credentials while monitoring clipboard contents for sensitive information. It maintains a flexible command-and-control channel over TCP with multiple ports, supports a broad set of commands including system manipulation and reboot, and uses Windows services with watchdogs to ensure persistence. It also monitors RDP sessions and can impersonate users.

According to its author, EDR-Freeze is a tool that exploits the software vulnerability of WerFaultSecure to suspend the processes of EDRs and anti-malware without needing to use the BYOVD (Bring Your Own Vulnerable Driver) attack method as EDR-Freeze operates entirely in user mode.

According to its author, defendnot uses an undocumented Windows Security Center (WSC) API that is meant for antivirus software to notify Defender of their presence, with the goal of getting Defender to disable itself.

According to Fox-IT, RemotePE is the final-stage in-memory RAT that operates across multiple threads to handle C2 communication and command execution. It exposes a range of capabilities via a structured command set, including configuration, console access, file and process operations, and plugin support to dynamically load additional payloads. The framework emphasizes memory-only execution and encrypted, compressed exchanges with the C2, aiming to minimize forensic traces and enable long-term, stealthy control managed by an operator.

According to Proofpoint, Overlord is an open-source RAT written in Go.

According to Fox-IT, DPAPILoader is a loader implemented as a DLL that decrypts an encrypted payload from disk using DPAPI and then loads it into memory, enabling persistence by starting at boot as a legitimate-appearing service. It uses environment-bound encryption and obfuscation (DPAPI keys tied to the user and a fixed XOR) to tie the payload to the victim and hinder static analysis. The loader then hands off to a second-stage loader, RemotePELoader, as part of a multi-stage chain designed to minimize on-disk artifacts and maximize stealth.

According to ESET Research, BirdCall is a Windows backdoor written in C++ that provides a wide range of spying capabilities, including taking screenshots, logging keystrokes and clipboard content, stealing credentials and files, and executing shell commands. It is typically deployed in a multistage loading chain with a downloader that fetches and executes shellcode, at times loaded by a RokRAT payload, and then replaces a trojanized library with a clean version to hinder analysis. For C2, BirdCall uses legitimate cloud storage services or compromised websites to enable bidirectional communication and data exfiltration.

According to CERT-UA, AGINGFLY is a C#-based remote-control tool that can execute commands, download files, capture screenshots, and run a keylogger, effectively enabling full remote control of an infected host. Its C2 communication uses WebSockets with AES-CBC encryption, and unlike typical implants, command handlers are not embedded in the binary; they are delivered from the C2 as source code and compiled at runtime. The malware also appears in a multi-stage loader chain, with a stager that establishes a remote connection and covert execution, and it can leverage process injection to hide in legitimate system processes.

According to CERT-UA, SILENTLOOP is a PowerShell-based component that coordinates command execution, automatic configuration updates, and discovery of the C2 address, with the main C2 address obtained from a Telegram channel. It supports fallback mechanisms for locating the C2 to maintain control if the primary channel changes. This tool operates as part of a broader attack toolset, enabling persistent management of compromised hosts and facilitating reconnaissance and lateral movement through the network.

According to WithSecure, PhantomRelay is a PowerShell-based RAT developed under the GREYVIBE activity cluster. It uses a two-stage execution chain (fingerprinting first, then the main RAT loaded in memory) with C2 communications over WebSockets, and its design is modular to enable additional post-compromise payloads. The family includes several variants, such as PhantomRelayLite and PhantomRelayV1/V2, which feature progressive obfuscation and persistence enhancements. The operators are Russian-speaking and Moscow-time aligned, with the tooling observed across GREYVIBE-related campaigns and related cybercrime activity.

According to WithSecure, LegionRelay is a lightweight PowerShell-based RAT that talks to its C2 via REST API. The client executes operator-issued PowerShell commands and relies on post-compromise scripts to extend capabilities, including file enumeration, exfiltration, screenshots, browser data theft, and remote access like RDP setup. The tooling is part of GREYVIBE’s broader loader/obfuscator ecosystem, with obfuscation and loader variants used to evolve the malware. Operators are Russian-speaking and Moscow-time aligned, indicating a Russia-nexus influence that coexists with wider cybercrime activity.

According to Trend Micro, Banana RAT is a Brazilian banking trojan linked to SHADOW-WATER-063. It employs a fileless, PowerShell-based client that runs in memory, with a polymorphic, AES-wrapped payload delivery pipeline and multiple obfuscation layers to evade detection. Once active, it provides remote fraud capabilities, including screen capture, remote input control, keylogging, overlays that mimic banking interfaces, and a Pix QR interception subsystem to manipulate payments. The operation targets Brazilian financial institutions, uses Brazilian Portuguese artifacts, and appears to operate as a malware-as-a-service style platform with per-victim builds to complicate detection.

Malware family tracked by Malpedia. ID: js.recjs

Malware family tracked by Malpedia. ID: elf.compood

According to FortiGuard Labs, C0XMO is a newly identified Gafgyt variant that propagates by exploiting CVE-2021-27137 in DD-WRT routers, enabling remote attackers to control vulnerable systems. Unlike traditional Gafgyt, C0XMO modularizes its lateral movement into a standalone Python script, allowing it to efficiently target multiple Linux architectures. The malware is written in both Python and compiled ELF binaries, and features persistence, competitor process termination, and a broad set of DDoS attack methods. Its architecture is more advanced than typical Gafgyt, with separate scanning and propagation components, extensive exploitation capabilities, and improved scalability for botnet deployment.

Malware family tracked by Malpedia. ID: js.proslikefan

According to Check Point Research, "MiniFast" is a 64-bit Windows DLL backdoor that appears to be under active development and shows multiple signs of AI-assisted coding, including verbose error handling, modular organization, and descriptive function naming. It is designed for long-term access and remote administration, using a structured command-and-control protocol with host registration, task polling, and result reporting capabilities. MiniFast performs basic system reconnaissance and supports a broad set of post-compromise functions, including file and directory management, command execution, process enumeration and termination, file transfer, archive creation, and dynamic loading of additional code modules. The malware can also modify its communication timing based on operator instructions and execute tasks through an opcode-driven command framework. It incorporates execution-chain validation and anti-analysis checks to ensure it is running in an expected environment before activating. It is commonly deployed through multi-stage infection chains that abuse legitimate .NET application functionality and trusted software execution flows to blend into normal system activity and establish persistence.

Spambot written in perl.

According to PwC Threat Intelligence, JFMBackdoor is a Windows DLL backdoor written in C++ that uses the CppServer library for communication. It is delivered via DLL side-loading and supports extensive capabilities including remote shell access, file system manipulation, network proxying, screenshot capture, registry operations, and self-removal. The malware relies on encrypted configuration files and supports dynamic behavior updates through these configurations. It interacts with system processes generically for actions like shell launching and service management, and uses GDI+ for screenshot capture.

Go-based Windows remote-access trojan with credential/browser-theft modules. Capabilities: * screen capture/H.264 streaming * keyboard/mouse control * hidden desktop * file upload/download/run * clipboard access * process listing * Chrome profile cloning * cookie extraction/injection * Chrome App-Bound protection bypass logic Embeds ChromElevator tool.

According to Acronis, LOTUSLITE is a custom C++ backdoor delivered via DLL sideloading, where a simple loader executable is used to load a malicious DLL that acts as the primary implant. It establishes persistence through filesystem changes and user-run registry entries, and communicates with a hard-coded command-and-control server over HTTP(S) using the Windows HTTP APIs and a custom binary protocol. The malware supports espionage-focused capabilities including system and user enumeration, spawning an interactive command shell with redirected I/O, directory listing, and file read/write operations. Its code shows relatively low development maturity and limited evasive features, emphasizing rapid deployment and operational reliability over sophisticated stealth.

According to Elastic Security Labs, TCLBANKER is a Brazilian banking trojan comprised of a native code loader and .NET-based payloads that targets financial institutions in Brazil. Its core capabilities include monitoring browser addresses via UI Automation to trigger WPF full-screen overlays for credential harvesting and operator-driven social engineering, as well as self-propagating worm modules that hijack WhatsApp Web sessions and abuse Outlook through COM automation to send phishing messages. The malware employs robust anti-analysis techniques, such as environment-gated payload decryption that silently fails in sandboxes or incorrect environments, and a comprehensive watchdog subsystem that actively monitors for debuggers, analysis tools, and instrumentation frameworks throughout execution.

According to BlueVoyant, Lorem Ipsum is a multi-stage malware family written in PowerShell for its loader components, with later stages transitioning to shellcode and DLL-based payloads. The loader chains multiple PowerShell stages that use AES decryption for embedded payloads, followed by gzip decompression and reflective memory loading, with newer versions employing substitution cipher decoding and XOR-encrypted shellcode stubs. The malware achieves persistence via Windows registry Run keys and evolved to use DLL sideloading, where a legitimate executable sideloads a malicious DLL that decodes embedded ciphertext to launch the core loader. Communication with C2 servers is conducted through JFIF image files where additional data is appended beyond image boundaries, allowing bidirectional exchange disguised as image traffic.

According to IBM X-Force, Slopoly is a likely LLM-generated PowerShell-based command-and-control framework that functions as a fully functional backdoor, collecting system information and sending it as JSON data to a C2 server via HTTP POST heartbeats while polling for commands to execute through the system shell. The malware includes extensive comments, logging, error handling, and accurately named variables, which are characteristic indicators of AI-generated software, though it lacks advanced techniques and cannot actually modify its own code despite being labeled as polymorphic. It establishes persistence by creating a scheduled task and maintains a rotating log file, allowing the threat actor to retain access to the infected server for an extended period. The malware's quality suggests it was generated by a less advanced large language model, and it was deployed by the Hive0163 threat actor during the later stages of a ransomware attack.

Malware family tracked by Malpedia. ID: win.lalia_ransomware

Malware family tracked by Malpedia. ID: win.yahoyah

According to Mitre, StrongPity is an information stealing malware used by PROMETHIUM.

Snake Ransomware is a Golang ransomware reportedly containing obfuscation not typically seen in Golang ransomware. This malware will remove shadow copies and kill processes related to SCADA/ICS devices, virtual machines, remote management tools, network management software, and others. After this, encryption of files on the device commences, while skipping Windows system folders and various system files. A random 5 character string is appended to encrypted files. According to Bleeping Computer, this ransomware takes an especially long time to encrypt files on a targeted machine. This ransomware is reported to target an entire network, rather than individual workstations.

According to PCrisk, Truebot, also known as Silence.Downloader, is a malicious program that has botnet and loader/injector capabilities. This malware can add victims' devices to a botnet and cause chain system infections (i.e., download/install additional malicious programs/components). There is significant variation in Truebot's infection chains and distribution. It is likely that the attackers using this malicious software will continue to make such changes.

Malware family tracked by Malpedia. ID: win.redcurl

RSA describes PlugX as a RAT (Remote Access Trojan) malware family that is around since 2008 and is used as a backdoor to control the victim's machine fully. Once the device is infected, an attacker can remotely execute several kinds of commands on the affected system. Notable features of this malware family are the ability to execute commands on the affected machine to retrieve: machine information capture the screen send keyboard and mouse events keylogging reboot the system manage processes (create, kill and enumerate) manage services (create, start, stop, etc.); and manage Windows registry entries, open a shell, etc. The malware also logs its events in a text log file.