Threat Intelligence Center

A recently analyzed AutoIT payload injector relies on the legitimate AutoIT3 interpreter to execute attacker-supplied script code and load follow-on malware, including MedusaHVNC and VIPKeylogger. MedusaHVNC supports hidden remote desktop control of a compromised machine, while VIPKeylogger captures credentials and keystrokes.

State-sponsored operators attributed to China, Russia, and Iran, including the group tracked as Salt Typhoon, have made telecommunications networks a standing intelligence target. This analysis argues the harder problem is not technical discovery but implementation.

Microsoft has tracked a campaign called CaptiveCrunch since early May, where attackers compromise hotel Wi-Fi gateways to push fake updates delivering CornFlake malware and ChocoShell, a PowerShell stealer targeting Microsoft 365 and Azure tokens.

Researchers have documented a spear-phishing attack against a law firm in which a loader tracked as HollowFrame was used to deploy a backdoor named Matryoshka. The pairing follows a familiar pattern: an email-delivered loader establishes the initial foothold, then unpacks a second-stage implant that gives the operator ongoing access.

Pluggable Authentication Modules are a core part of how Linux systems verify users, which makes them an unlikely place for analysts to hunt for cryptomining. Activity attributed to TeamTNT abuses Linux PAM to conceal XMRig, keeping mining processes out of the areas SOC teams routinely inspect. Here is what the technique means for Linux server monitoring and detection engineering.

Black Hat delivers more briefings, vendor pitches, and side events than any one attendee can reasonably absorb, which makes agenda planning the difference between a productive week and a blur of hallway conversations.