Inside the Windows Trapdoor: A Shortcut, a Public Folder, and a Memory-Resident RAT

A lure built around a geopolitical theme masked a loader chain that leaned on user execution, writable paths, and trusted Windows components to keep the final payload off disk.

When a Windows Helper Becomes the Hideout

A legitimate Microsoft binary, a sideloaded DLL, and a memory-resident RAT show how attackers can turn normal loader behavior into a stealth delivery path.

Dropping Elephant’s Quiet Pivot: A China-Themed Loader, GitLab Pages, and a Memory-Resident RAT

A seven-week campaign tied to Dropping Elephant mixed trusted web services with fast-changing infrastructure, showing how attackers can turn ordinary publishing and chat-link features into malware delivery paths.

Elephant Group Launches Defense Sector Attacks Using MSBuild-Delivered Python Backdoor