CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain 2026-08-10 at 16:55 By Rodel Mendrez This post is the result of an investigation into a case we worked on, in which we traced a loader chain that ended where we didn’t expect. This article is an excerpt from LevelBlue SpiderLabs Blog View Original […]
CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain Read More »
Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems 2026-08-04 at 16:20 By Nikita Kazymirskyi In light of the water-sector activity described below, we’ve increased monitoring for related indicators of compromise across our client environments. Please contact your LevelBlue account team with questions specific to your environment. This article is an excerpt
Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems Read More »
Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux 2026-06-25 at 17:00 By Remote access trojans (RATs) are legacy threats that continue to evolve alongside an expanding and ever-changing threat landscape. Following our recently published articles about novel and notable RATs, including KarstoRAT, the latest version of ClickFix, and ClickFix’s macOS variant, we analyzed QuimaRAT, a
Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux Read More »
LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign 2026-06-24 at 16:43 By Dawid Nesterowicz In Norse mythology, Loki, the god of mischief, has powerful and deceptive transformation abilities. True to its namesake, the malware LokiBot has appeared in numerous variants and payload formats since its discovery more than a decade ago. In
LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign Read More »
A Closer Look at The Gentlemen’s Alleged Leak 2026-05-18 at 19:42 By Arthur Erzberger Executive Summary The Gentlemen is an active ransomware and extortion operation that emerged publicly in the second half of 2025 and rapidly scaled into a high-volume threat actor. Rather than a fully new group, it seems to be a continuation or
A Closer Look at The Gentlemen’s Alleged Leak Read More »
SpiderLabs Ransomware Tracker Update January 2025: Qilin Continues as Dominant Threat Group 2026-02-03 at 17:02 By The January 2026 edition of LevelBlue SpiderLabs ransomware tracker noted a sharp fall in the number of attacks launched compared to December 2025. Qilin remained the top attacker, but there was a reshuffling of the remaining top five attackers
LevelBlue SpiderLabs: Ransomware Attacks Up 17% in 2025 2025-12-30 at 17:07 By Global Ransomware Surges in 2025: Total ransomware attacks rose by 17.2% year-over-year, with LevelBlue SpiderLabs tracking approximately 7,400 incidents compared to 6,017 in 2024. Qilin and Akira Lead the Threat Landscape: Following the disappearance of Ransomhub and the disruption of Lockbit3, Qilin emerged
LevelBlue SpiderLabs: Ransomware Attacks Up 17% in 2025 Read More »
A Year in Review: Taking a Look Back at LevelBlue SpiderLabs’ 2025 Predictions 2025-12-19 at 17:05 By At this time last year, LevelBlue asked its experts to offer up some thoughts on what the coming year, 2025, would bring. This article is an excerpt from LevelBlue Blog View Original Source
A Year in Review: Taking a Look Back at LevelBlue SpiderLabs’ 2025 Predictions Read More »
Threat Intelligence News from LevelBlue SpiderLabs December 2025 2025-12-15 at 13:48 By LevelBlue SpiderLabs is the threat intelligence unit of LevelBlue and includes a global team of threat researchers and data scientists who, combined with proprietary technology in data analytics and machine learning (ML), analyze one of the largest and most diverse collections of threat
Threat Intelligence News from LevelBlue SpiderLabs December 2025 Read More »
SpiderLabs Ransomware Tracker Update November 2025: Qlin, Cl0p, and Akira Vie for Top Attacker 2025-12-03 at 16:04 By Trustwave SpiderLabs ransomware tracker noted a slight dip in the overall number of attacks that took place in November 2025, but the research team saw the threat group Cl0p surge, conducting 98 attacks during the month, up
The Cat’s Out of the Bag: A ‘Meow Attack’ Data Corruption Campaign Simulation via MAD-CAT 2025-11-07 at 19:39 By Karl Biron In 2024, I published Feline Hackers Among Us? (A Deep Dive and Simulation of the Meow Attack), which explored the notorious Meow attack campaign that had plagued unsecured databases since 2020. That article focused
Dissecting and Understanding APT Threat Group Activity 2025-11-06 at 16:45 By Trustwave SpiderLabs CTI APT Groups Prioritize Espionage and Data Theft: Approximately two-thirds of all Trustwave SpiderLabs-tracked APT group activity is motivated by espionage, targeting government, defense, and telecom sectors primarily in the US, Ukraine, and Russia. Top Attacker Nations: China (41%), Iran (12.5%), and
Dissecting and Understanding APT Threat Group Activity Read More »
SpiderLabs Ransomware Tracker Update October 2025: Qlin Doubles Down on Attacks 2025-11-04 at 17:18 By The worldwide ransomware landscape saw a dramatic shift in attacks in October 2025, jumping 41% month over month, with the most prolific attacker, Qlin, more than doubling the number of attacks it launched, according to Trustwave, A LevelBlue Company, research.
SpiderLabs Ransomware Tracker Update October 2025: Qlin Doubles Down on Attacks Read More »
Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand 2025-11-04 at 16:27 By Trustwave SpiderLabs’ Cyber Threat Intelligence team is tracking the recent emergence of what appears to be the consolidation of three well-known threat groups into a “federated alliance” that offers, among its activities, Extortion-as-a-Service (EaaS). This article is an excerpt from SpiderLabs Blog
Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand Read More »
The Rise of Phantom Cyber Firms: How to Spot Them and What to Verify Before you Engage 2025-10-23 at 17:11 By Grant Hutchons It’s bad enough that organizations must worry about threat actors launching phishing attacks, injecting ransomware, or exploiting vulnerabilities; now, there is a new attack variant on the loose. Legal scammers. This article
The Rise of Phantom Cyber Firms: How to Spot Them and What to Verify Before you Engage Read More »
SocGholish: Turning Application Updates into Vexing Infections 2025-10-16 at 17:45 By Cris Tomboc This blog is the latest in a series that delves into the deep research conducted daily by the Trustwave SpiderLabs Threat Operations team on major threat actor groups and malware currently operating globally. This article is an excerpt from Trustwave Blog View
SocGholish: Turning Application Updates into Vexing Infections Read More »
Notepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0? 2025-10-04 at 01:35 By A vulnerability on a popular source-code editor has been recently released along with a proof-of-concept (POC) exploit, but the security community isn’t so sure that it’s a legitimate flaw. This article is an excerpt from SpiderLabs Blog View Original Source
Notepad++ DLL Hijacking (CVE-2025-56383): CVSS 8.4 or CVSS 0.0? Read More »
SpiderLabs Ransomware Tracker Update September 2025: Qilin, Akira Top Ransomware Attackers 2025-09-30 at 16:00 By The threat groups Qilin and Akira together conducted about one-quarter of the 402 ransomware attacks tracked by Trustwave SpiderLabs in September, with the manufacturing and technology sectors receiving the brunt of these efforts. This article is an excerpt from Trustwave
From Folding to Folded: Hacking High Volume Mailer Machines 2025-09-30 at 16:00 By John Jackson The Quadient DS-700iQ is a high-volume folder-inserter machine designed for automating the process of assembling, folding, and inserting mail into envelopes for large mailing operations. It features a modular design that can handle complex mailing jobs, supports multiple feeders and
From Folding to Folded: Hacking High Volume Mailer Machines Read More »
REDCap: Multiple Cross-Site Scripting (XSS) Vulnerabilities 2025-09-26 at 20:23 By Harold Zang REDCap, developed by Vanderbilt University, is a secure platform designed for data collection in research studies and operations. This article is an excerpt from SpiderLabs Blog View Original Source
REDCap: Multiple Cross-Site Scripting (XSS) Vulnerabilities Read More »