Netcrook
09 يوليو 2026
When Ransomware Borrows the Admin Desk: PsExec, Password Stores, and the Quiet Road to Encryption
A GodDamn ransomware incident highlights a familiar but dangerous pattern: legitimate Windows tooling, credential harvesting, and rapid internal spread.
PowerShell Under a Prompt Engine: The AD Recon Report That Changes the Defensive Lens
A June 3 incident tied to Huntress shows how AI-generated PowerShell can be used for Active Directory enumeration without introducing a new exploit chain.
Go Malware, Faster Bots, and the Quiet Threat Spilling Toward OT
Nozomi Networks Labs identified Apex2 and c2c/meow, two Golang-based malware families linked to faster IoT botnet attacks and a higher risk profile for OT environments.
RedHook Returns With a Stranger Trick: Android Debugging Turned Into Malware Control
A fresh look at RedHook suggests the threat is moving beyond ordinary permission abuse and into a more dangerous trust zone inside Android.
Android Malware Turns a Safety Feature into a Shell-Access Path
RedHook is being linked to a control-chain abuse pattern that uses Accessibility, Developer Options, and wireless debugging to reach Android shell-level privileges.
Fake VPN Lures Are Turning Trust Into a Malware Delivery Channel
A counterfeit VPN installer is being used to seed GoodPersonRAT, a Windows RAT tied to keylogging, proxy abuse, and Telegram theft in a classic trust-hijacking pattern.
Everest Sample Hides Its Tracks in .NET, Then Adds Wake-on-LAN to the Mix
A legacy .NET ransomware binary protected with ConfuserEx and featuring Wake-on-LAN capability highlights how modern malware can combine obfuscation with reach-related design choices.
Inside SNOW: A Phishing Chain That Hides in Chat, Browsers, and Web Traffic
A multi-stage intrusion pattern tied to SNOW shows how attackers can braid together collaboration abuse, browser persistence, and WebSocket tunneling to make a single intrusion look like ordinary office noise.
Fake SDKs, Real Risk: The Package Trap Lurking in Developer Workflows
A cluster of malicious packages in npm and PyPI shows how public registries can be turned into a delivery channel for software-supply-chain abuse.
The Fake 7-Zip Trap That Turns a Download Into a Proxy Network
A familiar utility brand, a lookalike domain, and a silent installer chain can be enough to turn a consumer PC into part of someone else’s network abuse.