Netcrook
#UNC1549
The Recruiter Trap Behind a Familiar Espionage Name
A fake hiring site linked to Nimbus Manticore shows how job lures, impersonation, and cloud-friendly tradecraft can turn a simple message into a national-security risk.
Recruitment Became the Trap Door: Fake Job Lures Meet Malware Sideloading
A campaign tied to the Nimbus Manticore label shows how hiring themes can be turned into an execution path, using deception first and Windows loader abuse second.
When the Loader Betrays the App: A .NET Trick That Can Hide in Plain Sight
A campaign tied to Screening Serpens shows how AppDomainManager abuse can turn a trusted .NET startup path into an early-stage hiding place for malware.
Search Results Became the Bait in a New Software-Download Ambush
A lure built around SQL Developer shows how a threat cluster can turn user search intent into a delivery channel for malware, without relying on email at all.
Search Results as a Delivery Pipe: The Fake SQL Developer Lure Behind a New Poisoned-SEO Campaign
A suspected nation-state-linked operation used search manipulation and a fake developer tool as the bait, showing how software discovery can become the first step in compromise.
MiniUpdate, Big Message: How Cloud Hostnames Became Cover for a Spyware Run
Researchers linked a MiniUpdate RAT campaign to Azure-hosted command channels, showing how attackers can abuse cloud infrastructure to support espionage operations.