Trending Malware

SAWFLY is a lightweight, obfuscated PHP webshell used by ARMORY CASTLE, a suspected China-nexus cyberespionage actor formerly tracked as UNC5221 and also known as Warp Panda. It provides interactive remote access and command execution on compromised BeyondTrust Remote Support appliances. Observed deployment followed exploitation of CVE-2026-102764, an improper origin validation vulnerability permitting unauthenticated file operations, during zero-day attacks in August 2026. Installed in the appliance’s web-accessible application directory, SAWFLY processes requests containing a designated command parameter. It decodes and decrypts submitted data, executes PHP code, and encrypts and encodes the results for return to the operator. Requests lacking the expected parameter receive an HTTP 404 response, helping conceal the implant. Its bidirectional encrypted command-and-control communications support its role as an interactive post-exploitation foothold. ARMORY CASTLE used SAWFLY during operations that established root-level access and persistent administrative privileges on compromised appliances. Subsequent activity included attempted credential extraction, abuse of native remote-support capabilities to access downstream endpoints, collection of internal documents, and log deletion. The actor also deployed the separate BARECLAW tunneler to route traffic through compromised appliances.

PEERSTITCH is a memory-resident backdoor written in C for ARM64 Linux-based Fortinet FortiGate appliances running FortiOS. It is associated with the threat cluster CL-STA-0954, also tracked as UNC5820, and was deployed during a prolonged intrusion against a telecommunications managed service provider. The attackers initially compromised centralized FortiManager infrastructure through CVE-2024-47575, known as FortiJump, and subsequently exploited the FortiOS auto-script path traversal vulnerability CVE-2025-61624 to deploy the implant on selected firewalls. PEERSTITCH uses ptrace to inject code into legitimate FortiOS logging and VPN daemons. Its injector allocates executable memory, installs hooks, and redirects daemon execution to establish a covert inter-process communication bridge. The logging-process hook recognizes specially marked traffic and transfers an associated session identifier into the VPN process. Subsequent VPN traffic carrying the matching identifier follows an alternate execution path that bypasses normal FortiOS security checks. The implant communicates through traffic already handled by legitimate processes rather than opening a listening port or initiating outbound connections of its own. Its injector deletes its executable after deployment, leaving the operational implant in process memory without a persistent malware binary on disk. This design conceals malicious activity within trusted services and limits detection by integrity checks focused on on-disk files. A separate reverse-shell channel used during the intrusion was distinct from PEERSTITCH.

Raccoon Stealer, also spelled Racoon, is a Windows information stealer sold through a malware-as-a-service subscription model on cybercriminal forums. It harvests browser passwords, authentication cookies, autofill information, saved payment-card details, browsing history, and cryptocurrency wallet data. Its theft of authentication material can enable account takeover and session hijacking, while stolen credentials circulate through criminal marketplaces and support subsequent intrusions. Its subscription-based distribution enables use by multiple criminal operators rather than a single threat group. Raccoon Stealer 2.0, initially identified as RecordBreaker, emerged in June 2022 following the original operation’s March 2022 shutdown. The second version supports both 32-bit and 64-bit Windows systems. It retrieves configuration and legitimate supporting DLLs from command-and-control infrastructure, collects machine fingerprints and installed-application information, captures screenshots, and steals files across accessible disks. Its targets include cryptocurrency wallet applications and browser wallet extensions. Collected items are exfiltrated individually through HTTP POST requests, allowing theft to proceed incrementally. Observed distribution includes malvertising campaigns that redirected Internet Explorer users visiting adult websites through cloaked pages to the Fallout and RIG exploit kits. These chains exploited Internet Explorer and Adobe Flash Player vulnerabilities to install the malware. Smoke Loader has also downloaded Raccoon Stealer as an additional payload. Raccoon samples have been protected with Rex3Packer, demonstrating the use of third-party packing to hinder static detection and analysis.

StealC is a Windows information-stealing malware family used by cybercriminals to harvest credentials, authenticated browser sessions, cryptocurrency-wallet data, and other sensitive application information. Its targets include browsers and their extensions, messaging applications, VPN software, and email clients. Stolen cookies and authentication tokens can enable account takeover without repeating normal login or multifactor-authentication challenges. StealC has been identified in compromises involving stolen Anthropic Claude sessions. StealC is distributed through multiple loader ecosystems, including SmartLoader, Amadey, and MintsLoader. The FakeGit campaign delivers SmartLoader through deceptive GitHub repositories that impersonate legitimate software projects, including AI skills and MCP servers, and direct users to malicious archives. Analyzed delivery chains culminate in StealC being injected into a legitimate-looking process. Other campaigns have exploited CVE-2023-7028 in self-hosted GitLab instances to distribute StealC through Amadey. StealC V2 has also been distributed through malicious Blender assets planted on 3D-asset sharing platforms. Embedded Python scripts execute when Blender's automatic script-execution setting is enabled and initiate a multistage download chain. The V2 variant targets data from numerous browsers, web extensions, cryptocurrency wallets, and communication applications. Meowsterio has distributed StealC through deceptive websites and weaponized Windows ClickOnce applications. Black Basta also used StealC as part of its initial-access operations. Its deployment spans consumer and enterprise endpoints, with developer-focused software lures representing a documented targeting pattern.

SmokeLoader, also known as Dofoil and Smoke Loader, is a modular Windows malware loader sold on underground markets since approximately 2011. Its primary function is to download and execute additional malware, including information stealers, banking trojans, ransomware, cryptominers, and point-of-sale malware. Observed payloads include QakBot, DarkVision, RedLine Stealer, and Laplas. Its functionality varies with the modules deployed, with documented capabilities including credential and confidential-information theft, system and network reconnaissance, persistence, and backdoor access. SmokeLoader conceals execution through process injection into legitimate Windows processes, including Windows Explorer and Internet Explorer. It employs code obfuscation, encrypted strings and payloads, anti-debugging, and sandbox and virtualization detection. Documented virtualization checks inspect registry-held hardware information for artifacts associated with common hypervisors. Versions have used RC4-based string encryption and encrypted payload responses delivered through HTTP command-and-control communications, including responses containing additional plugins. Distribution mechanisms include malicious spam, spearphishing attachments, malvertising, and deceptive software downloads. Document-based campaigns use malicious Word or PDF lures. A campaign observed in September 2024 exploited the 7-Zip Mark-of-the-Web bypass CVE-2025-0411, combining nested archives, Cyrillic homoglyphs, and document-disguised executables to infect Ukrainian government bodies and businesses. SmokeLoader is used by multiple criminal operators rather than being exclusive to one threat actor. Documented users include TA505 and Qilin ransomware affiliates. Its deployment spans countries and industries; targeted Ukrainian organizations have included government, manufacturing, transportation, insurance, and utilities.

PureCrypter is a commercial C#/.NET malware loader for Windows, sold as malware-as-a-service since at least 2021 by the developer known as PureCoder, also called PureTeam. It provides configurable payload obfuscation, delivery, and injection for unrelated malware families. Observed payloads include Agent Tesla, RedLine, FormBook, AsyncRAT, PureLogs, PureMiner, BunnyLoader, and Mallox ransomware. Its typical architecture combines a downloader with an injector that decrypts and executes the final payload. Downloaded components frequently masquerade as images or multimedia files. Payload protection includes byte reversal, compression, symmetric encryption, and .NET obfuscation. PureCrypter supports reflective loading and multiple process-injection methods, including process hollowing, allowing payloads to execute inside legitimate Windows processes. Configurable capabilities include registry-based and Startup-folder persistence, installed-antivirus discovery, hidden process windows, execution delays, debugger and virtualization checks, and sandbox detection. Observed variants can modify Microsoft Defender exclusions, patch AMSI and ETW, request elevated execution, and adjust process privileges. Some builds display misleading error messages or delete themselves when anti-analysis checks fail. PureCrypter has appeared in phishing and spam campaigns using malicious archives, cracked-software bundles, script-based delivery chains, and deployments following server compromise. Legitimate hosting services, including Discord, have been abused to distribute its components. Its users include 8220 Gang, APT-C-36, and Mallox ransomware operators. Documented deployments include attacks against Russian organizations and compromised Microsoft SQL Server systems. Its broad availability and support for arbitrary payloads make it a shared delivery component rather than a tool exclusive to one actor or industry.

Amadey is a modular Windows malware loader and bot first observed in late 2018. Distributed commercially through underground cybercrime markets and used in pay-per-install operations, it collects host information, communicates with command-and-control infrastructure, and downloads and executes additional malicious payloads. It serves as an initial-access platform for information stealers, remote-access trojans, and ransomware. Observed secondary payloads include StealC, VectraRAT, and SeroRAT, and Amadey has been associated with TA505 activity and LockBit-affiliated operations. Amadey profiles infected systems by collecting operating-system version, architecture, computer and user names, domain membership, administrator status, and installed antivirus information. Its plugin ecosystem extends functionality with browser and application credential collection, cryptocurrency-wallet data collection, screenshots, clipboard monitoring, and proxying. Analyzed variants establish persistence through scheduled tasks and changes to the configured user Startup-folder location. Some samples request elevated execution through the Windows elevation mechanism, restrict permissions on their installed files to impede removal, and decode configuration strings at runtime. Command-and-control exchanges transmit host profiles and receive instructions for additional payload delivery; observed implementations include HTTP POST requests and RC4-encrypted data represented as hexadecimal strings. Infection vectors include phishing, bundling with pirated software, and exploitation. Amadey has also been distributed in ClickFix campaigns using fake Windows update prompts on counterfeit adult websites promoted through malvertising. Other observed chains abuse legitimate Windows scripting utilities and PowerShell to retrieve subsequent stages. Campaigns exploiting CVE-2023-7028 in self-hosted GitLab environments have used Amadey to distribute StealC. Its role as a shared criminal distribution platform exposes compromised Windows systems to multiple follow-on operators and payload families.

AsyncRAT is an open-source remote access trojan written in C# for the Windows .NET environment. It provides interactive remote control, command execution, remote desktop access, file access, screenshot capture, keylogging, clipboard collection, system-information gathering, and data theft. Its extensible architecture allows operators to retrieve additional plugins from command-and-control infrastructure. The codebase has also served as the basis for related RAT families, including DcRAT and VenomRAT. Analyzed clients collect victim metadata such as hardware identifiers, usernames, operating-system details, privilege status, and active-window titles. Keylogging uses a low-level keyboard hook to associate captured keystrokes with the active process. Configurations can be AES-encrypted, and clients can validate server certificates and use fallback connection logic. When installation is enabled, AsyncRAT can relocate itself and establish persistence through scheduled tasks and registry autorun entries. Anti-analysis checks can terminate execution when debugging, virtualization, or sandbox indicators are detected. AsyncRAT is distributed through phishing and spearphishing, malicious SVG attachments, fake browser updates, deceptive software downloads, and cracked-software delivery chains. Campaigns frequently use staged Visual Basic, batch, PowerShell, AutoIt, and .NET loaders, with obfuscation, reflective loading, DLL sideloading, and process hollowing used to conceal the final payload. Fileless variants have also been deployed. AsyncRAT has been used by Blind Eagle, also known as APT-C-36, in Spanish-language campaigns impersonating official institutions. Colombian campaigns use judicial and tax-authority lures to target individuals and organizations, while other distribution operations reach users seeking software, cryptocurrency tools, game cheats, and AI applications.

Donut is an open-source shellcode-generation and in-memory loading framework used in malicious payload-execution chains. It generates position-independent shellcode capable of loading and executing .NET assemblies, native Windows executables and DLLs, and VBScript or JScript payloads directly in memory. Its legitimate availability and broad adoption distinguish it from a malware family controlled by a single operator. Donut supports encrypted payloads and reflective loading, reducing the need to write decrypted executables to disk. For .NET payloads, it can use unmanaged CLR hosting interfaces to initialize the runtime, create an application domain, load an assembly, and invoke its entry point. Its DonutTest subproject provides shellcode injection into a target process, and modified injectors have been used to execute payloads inside legitimate Windows processes. Donut has appeared in phishing, spearphishing, recruitment- and tax-themed lures, and ClickFix infection chains, often following script loaders or DLL sideloading stages. Observed payloads include Atlantida, Phemedrone, Remus Stealer, PureRAT, VenomRAT, and PackClient. Void Banshee used Donut in an Atlantida delivery chain exploiting CVE-2024-38112, while TA4922 used it in tax-themed PackClient campaigns. Its role is payload loading and execution; credential theft, surveillance, persistence, and other subsequent behaviors depend on the surrounding components and loaded malware.

Vidar is a Windows information-stealing malware family observed in circulation since late 2018. It harvests browser-stored passwords, session cookies, cryptocurrency wallet files, device information, and other sensitive data, then exfiltrates the collected information to remote servers. Stolen cookies can enable authenticated-session hijacking, while exposed credentials and wallet material support account compromise and financial theft. Vidar abuses legitimate services, including Telegram and Steam, to support and conceal command-and-control communications. Observed samples create remote threads in Chrome and Edge processes. Anti-analysis and cleanup behaviors include detecting analysis environments, terminating processes, and deleting files to reduce the malware’s footprint. Vidar is deployed through multiple distribution channels rather than a single operator or infection vector. Documented campaigns use ClickFix prompts on compromised WordPress websites, deceptive software repositories, and fake entertainment releases distributed through torrents. Operation Muck and Load, linked to the ischhfd83 persona, included Vidar among payloads staged through malicious software-development and cryptocurrency-tool lures. Other campaigns distributed Vidar through fake SubsPlease releases on Nyaa. Vidar is also delivered by malware loaders, including 2CLoader. Its victims include individual users, developers, and employees whose infected devices contain personal or corporate credentials.

Snake, also known as Uroburos, is a modular cyberespionage implant and rootkit developed and operated by the Russian state-affiliated Turla threat group, also known as Venomous Bear and Waterbug. It targets 32-bit and 64-bit Microsoft Windows systems, providing long-term persistence, arbitrary command execution, file theft, network-traffic capture, and concealment of malicious activity. Its architecture includes a kernel driver and an encrypted virtual file system that stores supporting components and data. Snake supports peer-to-peer communication between infected hosts, allowing operators to control systems without direct Internet access and relay stolen information through other compromised machines. This architecture supports lateral movement and covert exfiltration within segmented enterprise and government networks. Uroburos variants abuse a vulnerable signed VirtualBox driver to disable Windows Driver Signature Enforcement and PatchGuard, enabling unsigned kernel components to operate while bypassing platform protections. Snake has been used against government institutions and other high-value espionage targets, including a publicly reported compromise of Belgian government networks involving theft of documents concerning the Ukraine crisis. Its initial infection mechanism is not established. Snake/Uroburos is distinct from both the EKANS ransomware family and the unrelated .NET-based Snake Keylogger information stealer.

XMRig is legitimate, open-source cryptocurrency-mining software widely abused in cryptojacking operations to mine Monero using compromised computing resources. Malicious deployments are documented on Windows, Linux, and macOS, including enterprise endpoints, servers, and containerized workloads. Unauthorized mining consumes processing capacity and electricity and can degrade application performance and service availability. Attackers deploy XMRig after exploiting internet-facing applications, exposed or misconfigured infrastructure, and remote-access vulnerabilities. Documented entry points include vulnerable Ruby on Rails applications, Microsoft Exchange servers, React and Next.js deployments, AhsayCBS backup servers, and macOS Screen Sharing. XMRig has also been embedded in a compromised project's Docker image. It is used as a mining payload in campaigns involving Kinsing, PoeLLM, and ProxyShellMiner rather than being exclusive to a single threat actor. Malicious installation chains commonly rename the miner to resemble legitimate software or system services and maintain execution through Windows services, scheduled tasks, systemd units, cron jobs, or macOS LaunchDaemons. Some loaders inject XMRig into other processes through process hollowing, while companion scripts suppress mining when monitoring tools are open. Certain Windows deployments use a vulnerable hardware-access driver to improve RandomX mining performance. These persistence, concealment, and delivery mechanisms belong to the surrounding attack tooling and are not necessarily native XMRig capabilities.

Candiru is commercial surveillance spyware developed by the Israeli surveillance vendor of the same name, subsequently operating as Integrity Labs. Its Windows malware includes DevilsTongue, which supports theft of files, credentials, and messages. Candiru surveillance tools also enable extraction of emails and photographs and access to device microphones. Documented targets include journalists, activists, politicians, civil society members, and individuals associated with the Catalan independence movement. Candiru has been delivered through targeted phishing emails impersonating trusted organizations and through exploitation of Windows and Chrome vulnerabilities. Its attack chains have used Windows zero-day vulnerabilities CVE-2021-31979 and CVE-2021-33771, patched in July 2021. Observed Windows implants use COM hijacking for persistence and repeating-key XOR obfuscation to conceal strings. During 2024–2025, at least 45 Al Jazeera devices were targeted in an advertising-based campaign attributed with high confidence to Candiru. This delivery technique, called AdFection, used Discover-Tech’s Controlium advertising platform to reach selected devices and initiate an infection sequence when an advertisement rendered, without requiring a click. Traffic progressed from advertising infrastructure to Candiru validation servers and subsequently to spyware command-and-control infrastructure. A recovered Windows implant shared distinctive implementation characteristics with earlier Candiru samples. The initial browser or application exploit was not recovered, and the government responsible for the campaign was not identified. The broader distribution of advertisements through this infrastructure does not establish spyware infection on every exposed device.

Stuxnet is a sophisticated Windows worm discovered in 2010 that was designed to sabotage industrial control systems, specifically Siemens programmable logic controllers used in Iran’s uranium-enrichment centrifuges. Widely attributed to the United States and Israel, it demonstrated how compromise of Windows-based engineering and supervisory systems could enable physical disruption of industrial processes. Its industrial payload inserts or modifies controller program blocks, including on Siemens SIMATIC CPU 315-2 and CPU 417 systems, to alter control-system execution. Stuxnet propagates through removable USB media, network shares, and exploitation of Windows vulnerabilities. It exploits the Windows shortcut vulnerability CVE-2010-2568, allowing malicious code execution when Windows displays a crafted shortcut’s icon, and spreads between networked systems through Print Spooler and Windows Server Service vulnerabilities addressed by MS10-061 and MS08-067. It also infects Siemens WinCC systems using a hardcoded database password and inserts malicious code into database views. Local privilege-escalation exploits include vulnerabilities in Windows kernel functionality and Task Scheduler. An embedded RPC server supports file transfer and peer-to-peer payload-version updates among infected computers within a victim network.

WannaCry, also known as WannaCrypt, WanaCrypt0r, and WCry, is Windows ransomware with self-propagating worm functionality. It encrypts user files and demands Bitcoin payments for decryption. Its May 2017 outbreak infected more than 200,000 computers worldwide, disrupting hospitals, manufacturing operations, businesses, and critical infrastructure. The campaign has been attributed to North Korean actors. WannaCry scans local networks and the internet for reachable SMB services, exploiting the SMBv1 remote code execution vulnerability CVE-2017-0144 through EternalBlue to compromise vulnerable systems and copy itself to additional computers. Its propagation component can also use an existing DoublePulsar backdoor to execute the malware. Microsoft addressed the exploited vulnerability through MS17-010 in March 2017, before the outbreak; unpatched systems enabled its rapid spread. WannaCry uses Tor for command-and-control communications. A prominent outbreak variant checked a kill-switch domain before continuing execution. Security researcher MalwareTech registered and sinkholed that domain, substantially curtailing propagation of that variant. WannaCry infections have also continued to appear in legacy operational technology environments, where aging Windows systems and restrictions on patching complicate eradication.

NotPetya, also known as Nyetya and ExPetr, is destructive Windows malware with worm-like propagation that caused a major international outbreak on June 27, 2017. It masquerades as ransomware but functions as a wiper: its encryption design does not provide a reliable recovery mechanism linking victims’ installation identifiers to their encryption keys. The operation is attributed to Sandworm, a unit associated with Russia’s military intelligence agency, the GRU. The outbreak began through a software supply-chain compromise of M.E.Doc, a Ukrainian accounting application, whose legitimate update mechanism was used to distribute malicious code. NotPetya harvests Windows credentials using a modified Mimikatz component and uses stolen credentials with PsExec and Windows Management Instrumentation to execute on other systems. It also scans for vulnerable SMB services and propagates through the EternalBlue and EternalRomance SMBv1 exploits. Credential-based propagation allows it to compromise reachable systems even when the exploited SMB vulnerabilities have been patched. It disguises its dropped PsExec utility through renaming. NotPetya encrypts selected user files with dynamically generated AES keys. With administrator privileges, it modifies the master boot record to initiate encryption of critical disk structures, including the master file table, and reboots the host, rendering it unusable. Although the malware displays ransom demands, payment does not offer a dependable means of restoring affected data. Initially directed at Ukrainian organizations, NotPetya spread internationally and caused billions of dollars in damage across shipping, logistics, energy, manufacturing, finance, and healthcare. Its impact at Maersk included the loss or incapacitation of nearly all Active Directory domain controllers and major disruption to global shipping and port operations.