rolled-off - AlphaHunt Converge

stealth-falcon

Stealth Falcon’s Zero-Day Offensive, OilRig’s Supply Chain Escalation, and the Evolving Middle Eastern APT Landscape

Stealth Falcon, OilRig, Molerats, and Dark Caracal represent the most active and sophisticated Middle Eastern APT groups, each aligned with state or political interests and employing advanced tactics for espionage, surveillance, and disruption. Stealth Falcon’s exploitation of CVE-2025-33053..

badbox

BADBOX 2.0: Global Supply Chain Botnet Targeting Off-Brand Android Devices and Home Networks

BADBOX 2.0 represents a significant escalation in global supply chain cyber threats, infecting over 1 million off-brand AOSP devices—including TVs, smartphones, tablets, and car infotainment systems—via pre-installed firmware backdoors and malicious apps.

sandworm

Sandworm’s Evolving Playbook: Destructive Malware, BadPilot Subgroup, and the Escalating Threat to Global Critical Infrastructure

Sandworm, a Russian GRU-affiliated cyber threat group (Unit 74455), continues to escalate its offensive cyber operations, with a primary focus on Ukraine and Western allies. The group is notorious for high-impact attacks such as the 2015-2016 Ukrainian power grid blackouts...

void-blizzard

Void Blizzard: Russian State-Backed Cloud Espionage, AitM Phishing, and LOTL Tactics Targeting NATO and Allies

Void Blizzard, a Russian state-sponsored APT attributed to the GRU and tracked as Laundry Bear by Dutch intelligence, has rapidly emerged as a major cyber espionage threat since April 2024. The group targets government, defense, telecommunications, NGOs, and critical infrastructure across NATO...

venom-spider

Venom Spider’s Polymorphic More_eggs: Advanced HR-Targeted Intrusions and Evasion Tactics

Venom Spider (TA4557) is a financially motivated cybercriminal group specializing in spear-phishing campaigns against HR professionals, primarily in the U.S., U.K., Canada, Australia, and Germany. Their attacks exploit the HR function’s need to process external attachments..

bumblebee

Bumblebee Malware Supply Chain Attack: RVTools Compromise, Evolving Tactics, and Strategic Defenses

Bumblebee malware has escalated its tactics by compromising the supply chain of RVTools, a widely used VMware utility, to deliver trojanized installers containing a malicious version.dll loader. This attack, detected in May 2025, distributed malware via both official and typosquatted domains..

dragonforce

DragonForce Ransomware: BYOVD Weaponization, Affiliate Expansion, and EDR Evasion in 2025

DragonForce has rapidly evolved into a major RaaS operation, distinguished by its sophisticated use of BYOVD techniques to bypass EDR and escalate privileges. The group’s modular ransomware builder allows affiliates to select vulnerable drivers (notably TrueSight.sys, RentDrv.sys) for process ter...

russia

LOSTKEYS: COLDRIVER’s Next-Gen Social Engineering Malware and the Evolution of Russian State Espionage Tactics

LOSTKEYS, first observed in early 2025, marks a significant evolution in Russian cyber-espionage, attributed to the FSB-backed COLDRIVER group. Unlike traditional spear-phishing, LOSTKEYS employs a sophisticated multi-stage infection chain initiated by fake CAPTCHA lure websites (ClickFix)...

gunra

Gunra Ransomware: Conti-Derived Double-Extortion Threat Targeting Global Critical Sectors

Gunra ransomware is a newly emerged, highly sophisticated double-extortion threat, first detected in April 2025 and attributed to a financially motivated group leveraging the Conti ransomware codebase. It targets Windows environments...

golden-chickn

Golden Chickens’ Modular MaaS: TerraStealerV2, TerraLogger, and the Evolving Threat to Financial and Recruitment Sectors

Golden Chickens (aka Venom Spider) is a financially motivated Eastern European threat actor operating a modular malware-as-a-service (MaaS) platform since at least 2017..

wizards

TheWizards APT: IPv6 SLAAC Spoofing, Spellbinder Malware, and Advanced Lateral Movement in Asia and the Middle East

TheWizards is a China-aligned APT group, active since at least 2022, specializing in espionage and influence operations across Asia and the Middle East. Their hallmark is the use of IPv6 SLAAC spoofing to hijack legitimate software update mechanisms—most notably Tencent QQ..

purplehaze

PurpleHaze’s Dynamic ORB Networks: Advanced Tactics, Detection Challenges, and Mitigation Strategies

PurpleHaze, an emerging Chinese state-sponsored threat group, operates highly dynamic multi-hop ORB networks that blend compromised IoT devices (notably SOHO routers with vulnerable firmware) and provisioned VPS to obscure command-and-control (C2) infrastructure.