Estimated reading time: 6 minutes
A technical walkthrough from runtime preparation and network-share discovery to concurrent file encryption DragonForce is a Ransomware-as-a-Service (RaaS) operation that first surfaced in mid-to-late 2023. It initially presented itself as a hacktivist collective before shifting to a profit-driven model....Search Results
Estimated reading time: 8 minutes
Recently, Seqrite Lab saw a phishing campaign delivering formbook stealers through email attachments. Formbook, as seen since 2016, has evolved in many ways from stealth features to evasion techniques. Being sold on hacking forums as Malware as a Service,...
Estimated reading time: 5 minutes
Introduction: Attackers are continuously developing different techniques to infect systems and steal sensitive information. A recent campaign a multi-stage infection chain that starts with a LNK file, which lures the victim into opening an invoice in a web browser....Estimated reading time: 5 minutes
WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for...
Estimated reading time: 7 minutes
Malware can hide inside legitimate-looking files, exploit vulnerabilities, execute malicious scripts, or remain dormant until specific conditions are met. For security teams, identifying a suspicious file is only the beginning. They also need to understand what it does, how...
Estimated reading time: 11 minutes
Executive Summary MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model. In the attack chain, MacSync binaries are native stagers and multi-part exfiltration engines....
Estimated reading time: 9 minutes
Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Campaign Timeline Initial Findings Looking into the Decoy Document Technical Analysis Stage 1 – LNK-Based Initial Access Stage 2 – Split Payload Reconstruction via ftp Script Stage 3 –...
Estimated reading time: 11 minutes
Contents Introduction Campaign Overview Initial Access Infection Chain Technical Analysis Stage 1: Initial Delivery (Archive→JavaScript) Stage 2: PowerShell Loader1 Analysis Stage 3: PowerShell Loader2 Analysis Stage 4 – Phantom Stealer v3.5.0: Data Harvesting and Exfiltration Campaign Attribution Conclusion IOC’s...
Estimated reading time: 4 minutes
27 seconds. That’s the fastest time on record for an attacker to break into an endpoint and start moving laterally through a network. The average across all attacks in 2025 was 29 minutes, a 65% jump in speed over...
Estimated reading time: 8 minutes
Introduction Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase infection success rates. The threat actors impersonated legitimate government departments and distributed malicious emails disguised as official notifications related to taxation,...