StealC-Stealer-RuntimeBroker-Hollowing-C2-Extraction-Payload-Extraction-Analysis

1. Hollowing de RuntimeBroker.exe y direcciones IP de C2 El análisis de memoria con Process Hacker revela que StealC Stealer realiza process hollowing sobre RuntimeBroker.exe y establece conexiones con múltiples servidores C2. Observaciones clave: Proceso objetivo: RuntimeBroker.exe PID 14900...

Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure

Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader , strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service MaaS model. The threat actor behind CastleLoader has been assigned the...