ecrime - AlphaHunt Newsletter

weekly

SIGNALS WEEKLY: Taiwan Critical Infrastructure: Reports of China-Linked Probing and Prepositioning

🧭 Taiwan CI pressure looks like recon + access maintenance, not a one-off headline. 🩹 Patch Tuesday + KEV = attacker shopping list. ☁️ And Salesforce Aura/Experience Cloud exposure? No patch… just “surprise, it’s public.”

scam

Holiday Scam Survival Kit (2025): Delivery Texts, ‘Family Emergency’ Calls, Gift Card Traps

Holiday scammers are running peak-season ops 📦🎄 “Delivery problem” texts, AI “family emergency” calls, and “pay via gift card/Zelle” pressure. Rule: don’t click, hang up + call back, never gift cards/crypto/wires.

forecasts

Will RedNovember be publicly reported to exploit at least one zero-day vulnerability in 2026? Updated 2025-11-06

We’re at 29% that RedNovember will be publicly reported exploiting at least one zero‑day in 2026 under strict timing and attribution rules. The hinge is whether the group escalates beyond PoC‑driven N‑day edge exploits and whether attribution survives rebranding.

romance-scam

Kill the Lights, Fire Up Starlink: Scam Compounds Slide South

Thailand pulled the plug. The grift brought generators + Starlink. Shift north→south (Shwe Kokko/Myawaddy; Tachileik/Mae Sai). Squeeze OTC cash-outs + first-funding friction, or watch it respawn.

c2

Modular C2 Frameworks Quietly Redefine Threat Operations for 2025–2026

Attackers are rapidly shifting to modular, cloud-integrated C2 frameworks—Sliver, Havoc, Mythic, Brute Ratel C4, and Cobalt Strike—blurring lines between APT and cybercrime. These tools’ stealth, automation, and cloud API abuse are outpacing legacy detection, demanding urgent defensive adaptation.

poisonseed

PoisonSeed: supply-chain phish, seed-phrase theft, MFA bypass

If your bulk email or CRM gets popped, PoisonSeed rides your good reputation straight past filters and users’ instincts. Here’s the fast path to detect and blunt it—without boiling the ocean.

ecrime

SaaS Data Theft: How UNC3944, UNC6040, and UNC6395 Quietly Redefined Cloud Risk

Three financially motivated clusters—UNC3944 (“Scattered Spider”), UNC6040, and UNC6395—are driving a surge in SaaS and cloud data theft via social engineering, OAuth abuse, and supply-chain attacks. Their evolving TTPs and anti-forensics are raising the stakes for defenders..

shamos

Shamos macOS Infostealer: Malvertising Lures, BYOD Gaps, and Sector Expansion

Shamos, a new Atomic macOS Stealer (AMOS) variant attributed to COOKIE SPIDER, is targeting U.S. tech and education sectors via malvertising and fake support sites.

heartcrypt

HeartCrypt Packer-as-a-Service: Accelerating Malware Evasion and EDR Bypass in Ransomware Campaigns

In the last 90 days, HeartCrypt-packed ransomware has evaded initial SOC detection in up to 40% of targeted incidents. Attackers no longer waste time building stealth — they rent it. HeartCrypt’s PaaS delivers EDR-kill tools, sandbox evasion, and polymorphic payloads at industrial scale.

unc3944

Hypervisor Ransomware: CVE-2024-37085, AD Abuse, and the Escalating Threat to VMware ESXi Environments

Ransomware groups—including BlackCat/ALPHV, Black Basta, RansomHub, and Dark Angels—are increasingly targeting VMware ESXi and similar virtualization platforms using advanced hypervisor-level attack techniques. The exploitation of CVE-2024-37085..

dark-partners

Dark Partners: Multi-Platform Crypto Theft via Fake AI, VPN, and Software Sites

Dark Partners is a financially motivated cybercrime group active since at least May 2025, orchestrating large-scale cryptocurrency theft campaigns through a sophisticated infrastructure of fake websites mimicking AI tools, VPN services, crypto wallets, and widely used software brands.

venomrat

VenomRAT: Multi-Stage Phishing, Cloud C2, and Modular Malware in Financial and IT Sector Attacks

VenomRAT, first observed in 2020 as a fork of Quasar RAT, has evolved into a modular, service-based remote access trojan with advanced keylogging, stealth, and evasion capabilities. It is distributed primarily through phishing campaigns and fake antivirus websites (notably Bitdefender clones)...