Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor 2026-07-10 at 23:49 By Nathaniel Morales The LevelBlue Managed Threat Research team investigated a security alert in a customer environment involving a malicious ZIP file containing a Windows shortcut (.lnk) used for initial execution. When triggered, the LNK file executes a […]
Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor 2026-07-09 at 16:52 By Nathaniel Morales The LevelBlue Managed Threat Research team investigated a security alert in a customer environment involving a malicious ZIP file containing a Windows shortcut (.lnk) used for initial execution. When triggered, the LNK file executes a
From Phishing to Persistence: A CrySome RAT Infection Chain Analysis 2026-07-06 at 17:00 By Sean Shirley and Kyle Sopt During a recent security alert, the LevelBlue MDR SOC successfully triaged and contained a structured, multi-stage infection chain designed to deliver the CrySome remote access trojan (RAT). The incident was subsequently analyzed in depth by LevelBlue’s
From Phishing to Persistence: A CrySome RAT Infection Chain Analysis Read More »
AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign 2026-07-02 at 17:00 By LevelBlue SpiderLabs Over the past two weeks, LevelBlue SpiderLabs has been tracking an active phishing campaign distributing malicious spreadsheet attachments. What initially appeared to be a limited phishing attempt quickly evolved into a widespread campaign impacting multiple organizations across various industries, including manufacturing,
AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign Read More »
An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails 2026-06-30 at 17:04 By Hajime Takai Key points LevelBlue has identified two distinct attack vectors associated with ValleyRAT: campaigns leveraging fake installers and campaigns initiated through malicious emails. The malicious email-based attack campaign analyzed in this report appears to target both Chinese and
RoguePlanet and GreatXML: Detecting Local Privilege Escalation and BitLocker Security Boundary Abuse 2026-06-17 at 21:58 By Serhii Melnyk Following our previous research, LevelBlue SpiderLabs continued monitoring a series of Windows security component disclosures published under multiple online aliases, including Nightmare-Eclipse, Chaotic Eclipse, Dead Eclipse, and most recently MSNightmare. This article is an excerpt from LevelBlue SpiderLabs
AI Is Reshaping Cyber Risk Faster Than Most Boards Realize 2026-06-17 at 17:00 By Artificial Intelligence is no longer a future cybersecurity concern. It is actively reshaping how attacks are conducted, how organizations respond, and how business leaders must think about enterprise risk. This article is an excerpt from LevelBlue Blog View Original Source
AI Is Reshaping Cyber Risk Faster Than Most Boards Realize Read More »
The Device Code Phishing Tsunami: What We’re Seeing in the Wild 2026-06-09 at 20:08 By John Kevin Adriano With contributions from Cris Tomboc. This article is an excerpt from LevelBlue SpiderLabs Blog View Original Source
The Device Code Phishing Tsunami: What We’re Seeing in the Wild Read More »
ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery 2026-06-04 at 23:11 By King Orande and Cris Tomboc The LevelBlue OpsIntel CTI team examined the latest version of the ClickFix campaign, which emerged in early May 2026. The campaign employs a multi-stage phishing delivery chain that impersonates trusted employment and professional networking platforms,
ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery Read More »
macOS ClickFix Social Engineering Campaigns 2026-06-04 at 22:23 By Maor Gabay Overview The “ClickFix” threat landscape has undergone a significant architectural shift, transitioning from legacy Windows-based execution to sophisticated macOS-targeted campaigns. These operations prioritize social engineering over software vulnerability exploitation, systematically leveraging established user behaviors and professional workflows. By presenting deceptive “fixes,” “verifications,” or installation
macOS ClickFix Social Engineering Campaigns Read More »
The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP 2026-06-03 at 20:20 By Jose Martin In Brazil, Nota Fiscal eletrônica (NF-e) is the everyday name for an official electronic invoice. Real ones often arrive as a ZIP whose long number looks like paperwork. Criminals reused that habit: their email attachment can look
The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP Read More »
Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign 2026-05-28 at 17:00 By Maor Gabay We recently observed a multi-stage macOS intrusion campaign conducted by the North Korean state-sponsored threat group Sapphire Sleet (also tracked as BlueNoroff/UNC1069). This article is an excerpt from LevelBlue SpiderLabs Blog View Original Source
Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign Read More »
From WinRE to SYSTEM: Hunting the YellowKey and MiniPlasma Attack Chain 2026-05-22 at 22:53 By Since April 2026, LevelBlue SpiderLabs’ Cyber Threat Intelligence team has tracked a series of public zero-day disclosures targeting Microsoft Windows, attributed to an anonymous actor operating under the names Chaotic Eclipse and Nightmare Eclipse. The activity spans multiple areas of
From WinRE to SYSTEM: Hunting the YellowKey and MiniPlasma Attack Chain Read More »
AI-Driven Cyber Warfare Reshapes Global Defense Readiness 2026-05-19 at 17:33 By Ziv Mador This article was originally published inTechRadar Pro. This article is an excerpt from LevelBlue Blog View Original Source
AI-Driven Cyber Warfare Reshapes Global Defense Readiness Read More »
YellowKey and GreenPlasma: Two New Windows Zero-Days Unveiled 2026-05-19 at 17:33 By James Ballantyne and Pauline Bolaños Two novel Windows zero-day vulnerabilities dubbed YellowKey, which bypasses BitLocker drive encryption, and GreenPlasma, a local privilege escalation bug that targets a trusted Windows process called CTFMON, were recently publicly released. Nightmare-Eclipse (aka Chaotic Eclipse), a researcher who
YellowKey and GreenPlasma: Two New Windows Zero-Days Unveiled Read More »
A Closer Look at The Gentlemen’s Alleged Leak 2026-05-18 at 19:42 By Arthur Erzberger Executive Summary The Gentlemen is an active ransomware and extortion operation that emerged publicly in the second half of 2025 and rapidly scaled into a high-volume threat actor. Rather than a fully new group, it seems to be a continuation or
A Closer Look at The Gentlemen’s Alleged Leak Read More »
Threat Analysis: Backdoored Electron Apps Evading Defenses 2026-05-08 at 18:03 By Michael Morose This Threat Analysis report is part of the “Purple Team Series” in which the LevelBlue Global Security Operations Center (GSOC) provides a technical overview of some of the methods that threat actors are using to compromise their victims. This article is an
Threat Analysis: Backdoored Electron Apps Evading Defenses Read More »
Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication 2026-05-07 at 17:34 By Mahadev Joshi LevelBlue’s Security Services issues Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. This article is an excerpt from LevelBlue SpiderLabs Blog View
LevelBlue TTP Briefing Q1 2026: Trust Abuse Exposes Weaknesses 2026-05-05 at 17:00 By Explore the latest trends, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing with the TTP Briefing Q1 2026, a report built on frontline threat intelligence from our global incident response investigations across LevelBlue. This article is an excerpt
LevelBlue TTP Briefing Q1 2026: Trust Abuse Exposes Weaknesses Read More »
Inside Vect Ransomware-as-a-Service 2026-04-30 at 18:18 By Nathaniel Morales Vect ransomware, a new group that emerged in January 2026, has recently begun attracting attention in the cybersecurity space for its strategic partnerships, which are helping it expand. One notable collaboration is with TeamPCP, with evidence already surfacing as the latest victims on Vect’s leak site
Inside Vect Ransomware-as-a-Service Read More »