CERT-UA says attackers planted fake Cloudflare checks on more than 100 legitimate websites to get visitors to install Lunex Stealer themselves. Ontinue says its browser components can keep file access after the stealer is deleted, so cleanup has to reach the browsers.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 62%
- Investor
- Investor 8%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives25
- Confidence70
Warlock, the group Microsoft tracks as Storm-2603, hit four organizations in Spanish- or Portuguese-speaking countries in two months, Symantec says. It works like the Chinese state groups it first appeared beside and extorts like a ransomware crew.
Perspective Coverage
6 publishers
- Builder
- Builder 32%
- Operator
- Operator 59%
- Investor
- Investor 9%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives30
- Confidence68
Lunex sells a stealer that blinds security tools with a vulnerable AMD driver
Ontinue says the Lunex stealer-for-rent loads a flawed AMD driver, CVE-2023-20598, to switch off security tools before robbing seven browsers. That driver step is rarely used ahead of an info stealer, and Lunex is rented to multiple criminal groups.
Reality
- Evidence55
- Adoption40
- Hype gap+10
- Incentives
- Not scored
- Confidence55
Check Point's BTR Reforged turns a required Defender component into Ring 0 file and registry deletion on Windows 7 through 11 25H2. It cannot be blocklisted, so detection is the only lever left.
Reality
- Evidence60
- Adoption8
- Hype gap+10
- Incentives
- Not scored
- Confidence62
Acronis says the operator borrowed a security vendor's own uninstall driver to shut down Defender on Cambodian machines, and the loader keeps three further ways to blind an agent if the kernel route fails.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence60
Huntress worked two Settra intrusions, in July and September, and found MeshAgent installed for remote control, Windows event logs cleared and recovery partitions removed. SOCRadar counts 93 victims claimed since June.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence70
LastPass traced a fake Authenticator hosted on GitHub to a months-long impersonation campaign that spoofed at least 40 organizations, including its own brand. The server steering victims to the download was still being updated in September.
Perspective Coverage
4 publishers
- Builder
- Builder 27%
- Operator
- Operator 64%
- Investor
- Investor 9%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence70
Huntress rebuilt a 175-endpoint INC ransomware case from scheduled tasks and a driver fragment
Huntress reconstructed an INC intrusion from the logs that had survived. The tradecraft it found was ordinary operator work, the kind a name-based indicator list misses, and how the attackers first got in is still an open question.
Reality
- Evidence62
- Adoption28
- Hype gap−5
- Incentives65
- Confidence55
Open-source DeepZero hands an LLM the signed Windows drivers missing from loldrivers.io
DeepZero automates the hunt for exploitable Windows kernel drivers, discarding everything already on loldrivers.io before a language model rates what survives. Its maintainer reports multiple verified bugs in a driver installer corpus.
Reality
- Evidence47
- Adoption18
- Hype gap+15
- Incentives58
- Confidence52