Threat Advisories:

DarkCloud Uses Fileless Techniques Turning into a Nightmare for Windows CastleBot Rising: The Evolving Malware-as-a-Service Threat MedusaLocker Uses ThrottleStop.sys Flaw to Kill AV on Windows Malicious npm Packages Target WhatsApp Developers with Kill Switch Trend Micro Warns of Active Exploits in Apex One Console SafePay Ransomware’s Rapid Ascent to the Top of the Cybercrime Scene Adobe Patches Three Critical Flaws in AEM Forms on JEE Plague in the Shadows: Unmasking a Silent Linux Backdoor RoKRAT Resurfaces: APT37’s Fileless Shortcut to Espionage Secret Blizzard Strikes Moscow with ApolloShadow Alone Theme Vulnerability Puts WordPress Sites at Risk Scattered Spider’s Hypervisor Attack on VMware vSphere Operation GhostChat and PhantomPrayers Breach Tibetan Trust July 2025 Linux Patch Roundup Operation CargoTalon: Targeting Russian Aerospace & Defense Sector Greedy Sponge’s Stealthy RAT Attack in Mexico APT41 Targets African Government IT Services Critical Cisco ISE Flaws Actively Exploited in the Wild Ghost Crypt Delivers PureRAT in Accounting Firm Attack Zero Day Watch CVE-2025-53770 Turns SharePoint into a Pivot Point

Podcast: This Month's Threats in 10 Min! Emerging Threat Intel Audio Briefing - Listen & Defend Now →

Play Count: Loading...

Partner Program

Book a Demo Threat Digest - Subscribe

DarkCloud Uses Fileless Techniques Turning into a Nightmare for Windows

Amber | Attack Report

DarkCloud, a Windows-based information stealer first detected in 2022, resurfaced in 2025 with new delivery and obfuscation tactics, including ConfuserEx-protected files and a VB6 payload. Spread mainly via phishing emails with malicious RAR attachments, it uses JavaScript and PowerShell to deploy a fileless .NET DLL, gain persistence, and inject its payload into MSBuild.exe, stealing browser credentials and payment data for exfiltration via FTP or SMTP.

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox