Peaklight malware deep dive, peaklight, emmenhtal, in-memory malware, lnk, mshta, powershell, bunnycdn, webdav, cryptbot, lumma, shadowladder, hijackloader, threat hunting, incident response, mitre att&ck 1. Executive Summary Peaklight (also tracked as…
Tags: Payload ransomware, data broker extortion, double extortion, Tor leak site, ESXi ransomware, RECOVERY-xx0001.txt, IOCs, incident response Published: 21 February 2026 (Europe/London) 1. Executive Summary Payload is an emerging ransomware…
APT33, Elfin, Peach Sandstorm, HOLMIUM, Refined Kitten, Iran, aerospace, energy, petrochemical, spearphishing, password spraying, Outlook Home Page, Ruler, TurnedUp, DropShot, ShapeShift, StoneDrill 1. Executive Summary APT33 is a suspected Iranian…
1. Executive Summary APT28 is a long-running Russian state-aligned cyber espionage actor widely attributed to the GRU’s 85th Main Special Service Center (GTsSS), military unit 26165, active since at least…
1. Executive Summary LAPSUS$ is an extortion-focused cybercriminal collective best known for high-tempo intrusions against large enterprises and service providers, frequently leveraging social engineering and identity compromise rather than exploiting…
Introduction In September 2024, JPCERT/CC released a detailed blog post uncovering how Windows Event Logs can be a powerful tool for identifying human-operated ransomware campaigns. The research focuses on notable…
A recent analysis of the LummaC2 (LUMMAC.V2) malware reveals its use of advanced obfuscation techniques, specifically leveraging indirect control flow manipulation to make reverse engineering significantly more challenging. This type…
As we approach the final quarter of 2024, the cyber threat intelligence (CTI) landscape continues to evolve, driven by a combination of emerging threats, geopolitical factors, and the maturation of…
Microsoft’s June 2024 Patch Tuesday brought important security updates addressing 78 vulnerabilities across a range of products, including Windows, Microsoft Office, Azure, and Microsoft Edge. Among these, six vulnerabilities were…
CVE-2022-38028 is a critical vulnerability in the Windows Print Spooler service that allows for arbitrary code execution with elevated privileges. The exploit was addressed by Microsoft in a security update…