Curated Cyber Threat Intelligence & Malware Dossiers
Technical intelligence dossiers covering 25 landmark malware families, state-sponsored cyber espionage implants, Ransomware-as-a-Service (RaaS) operations, and high-velocity infostealers. Each dossier is cross-referenced with MITRE ATT&CK tradecraft, weaponized CVE zero-days, and verified IOCs.
Mercenary Spyware & Zero-Day State Espionage
Candiru (operating under corporate entities Saito Tech Ltd, Taveta Ltd, and Grindavik Solutions) is an Israeli commercial cyber-surveillance contractor specializing in advanced zer...
Pegasus is the most invasive, sophisticated, and technologically formidable commercial mobile spyware platform in contemporary cybersecurity, developed and licensed exclusively to ...
Enterprise Ransomware-as-a-Service (RaaS) Syndicates
Conti is arguably the most aggressive and professionally structured ransomware syndicate in cybersecurity history, operated by the Russian cybercrime group Wizard Spider from early...
LockBit (first identified in September 2019 as 'ABCD' ransomware) is the most prolific, industrialized Ransomware-as-a-Service (RaaS) operation in cybersecurity history, responsibl...
REvil (also universally known as Sodinokibi and Sodin) was one of the most prolific and technically sophisticated Ransomware-as-a-Service (RaaS) cartels in cybercrime history, oper...
DarkSide is a notorious Ransomware-as-a-Service (RaaS) operation that surfaced in August 2020, achieving global infamy in May 2021 following its catastrophic cyberattack against Co...
Clop (stylized as Cl0p) is a notorious Russian-speaking ransomware and extortion syndicate operated by threat group FIN11 (also tracked as TA505 and Lace Tempest) that fundamentall...
Ryuk is one of the most destructive and lucrative enterprise ransomware families in cybersecurity history, first identified in August 2018 and operated by the Russian cybercriminal...
High-Velocity Commodity Infostealers
RedLine Stealer (cataloged across threat research as RedLine, RedLineStealer, and Trojan:Win32/RedLine) is the most ubiquitous and commercially successful information stealer of th...
Lumma Stealer (also tracked in threat telemetry as LummaC2, LummaStealer, and Trojan:Win32/Lumma) is a premier C-language information stealer that emerged in late 2022 and rapidly ...
Stealc is a lightweight, fully featured information stealer written in C that emerged in January 2023 on Russian-language cybercrime forums, rapidly gaining adoption as an affordab...
Raccoon Stealer (also tracked as RecordBreaker, Trojan:Win32/Raccoon, and Race Stealer) is a premier commercial information stealer written in C/C++ that emerged on Russian-languag...
Modular Access Loaders, Botnets & Post-Exploitation Frameworks
Bumblebee is a sophisticated, enterprise-grade modular malware loader first discovered in March 2022 by Google Threat Analysis Group (TAG) and Proofpoint researchers. Authored in C...
BazarLoader (also known in threat intelligence telemetry as BazarBackdoor, BazaLoader, and Trojan.BazarLoader) is a high-stealth, enterprise-focused malware loader and backdoor fir...
Cobalt Strike (specifically its Beacon payload component) is the world's most ubiquitous commercial adversary simulation and post-exploitation framework. Originally authored by Rap...
AsyncRAT is an open-source remote access trojan (RAT) developed in C# (.NET) that has emerged as one of the most widely deployed commodity backdoors by cybercriminals, initial-acce...
Quasar (broadly tracked as Quasar RAT, QuasarRAT, Backdoor:MSIL/Quasar, and Trojan.MSIL.Quasar) is a high-performance open-source remote access trojan (RAT) developed in C# (.NET) ...
njRAT (also tracked as Bladabindi, Njw0rm, and Backdoor:MSIL/Bladabindi) is a notorious, widely disseminated remote access trojan (RAT) developed in Microsoft Visual Basic .NET by ...
Bifrost (also documented across threat research as Bifrose, Backdoor:Win32/Bifrose, and Trojan.Bifrose) is a resilient, long-standing remote access trojan (RAT) that first surfaced...
Historic Titans, Banking Progenitors & Self-Propagating Worms
Stuxnet is widely recognized in military and cybersecurity history as the world's first true cyber weapon, uncovered in June 2010 by VirusBlokAda and subsequently determined to be ...
Sasser (classified across antivirus vendors as W32.Sasser, Worm.Win32.Sasser, and Win32/Sasser) is one of the most disruptive self-replicating computer worms in the history of the ...
Blaster (also widely cataloged as MSBlast, Lovsan, and Poosan) is one of the most famous and destructive self-propagating computer worms in internet history, first detected on Augu...
Allaple (also cataloged in threat research as Rahack, Net-Worm.Win32.Allaple, and W32/Allaple) is an infamous, self-propagating polymorphic computer worm first detected in 2006. En...
Dridex (also known as Bugat v5, Cridex, and Dridex Banking Trojan) is an infamous, highly sophisticated banking trojan and modular malware framework first documented in 2014 by sec...
Zbot (universally known as Zeus, and documented under variants such as Zeus Panda, GameOver Zeus, and Wsnpoem) is arguably the most influential banking trojan and crimeware toolkit...