PRODAFT

Proactive Defense Against Future Threats | Pioneering #CyberSec and #ThreatIntelligence in Europe & MENA since ’12.
CTI Platform: #USTA Risk Intel: #BLINDSPOT

[PRODAFT @PRODAFT]

🔎 The author of StealC is advertising a new RAT built around a familiar problem for cybercriminals: losing access to the victim.

Plymouth TA introduced Stadia today, pitching a modular toolkit for persistent access and browser-based control of compromised hosts.

The advertised modules include:

▪️ HVNC with shared and hidden desktop modes, controlled directly from the browser
▪️ A stealer based on StealC v3.5
▪️ A loader supporting execution from disk and memory
▪️ Remote CMD/PowerShell access
▪️ File browsing, uploads and downloads
▪️ Process management and termination

The sales pitch is explicit. It addresses operators who get logged out of email accounts or lose contact with a “cardholder.” Stadia is presented as a way to retain access to the victim’s environment and continue operating inside it.

The advertisement also reuses the Telegram, Tox and Jabber contact details associated with StealC, linking the new offering to plymouth’s existing presence.

#ThreatIntelligence #StealC #Stadia

[PRODAFT @PRODAFT]

🎯 File theft, served à la carte. Runtime-generated Python. PowerShell disguised as familiar Windows processes. Fallback paths if the first one fails.

This is Monty. An infostealer you probably haven’t heard of. Yet.

🔑 Steals browser credentials, session tokens and crypto wallet data
🎯 Lets operators customise which files it collects
⚙️ Executes additional payloads, with multiple fallbacks for PowerShell tasks

Our report traces Monty’s collection and execution logic, its link to SpectrePaste, and turns the findings into IOCs and hunting rules you can use today.

Read our full investigation into Monty and its association with SpectrePaste 👇

📄 Full investigation: https://t.co/ZHU28ExlaJ

#ThreatIntelligence #MalwareAnalysis

[PRODAFT @PRODAFT]

🎯 A fixed target set. A kernel service. Endpoint defenses taken offline before encryption. Because ransomware deployment is easier when the security software is no longer running.

This is PHANTOM MANTIS (a.k.a. The Gentlemen) before the ransom note. We have been tracking the operation for some time. In our previous report, we mapped its affiliate model, internal infrastructure, operational structure, and ransomware platform.

This time, we went back for the arsenal used to clear the way.

🕵️ Our latest report traces its evolution from repeated process termination to:
🔺 Blocking selected security drivers during initialization
🔺Overwriting writable memory inside running processes
🔺 Modifying kernel memory
🔺 Removing selected file-system filters
🔺 Abusing a historically signed security component

The killers continuously search for nearly 180 security and IT-management processes.

They are also supplied through the operation’s affiliate-support structure. Because apparently, ransomware affiliates need technical support too.

We pulled the arsenal apart. The indicators, defensive priorities, and hunting rules are in the report.

🔎 Previous investigation: https://t.co/ynWxNj6g0e

👇 Read the latest report: https://t.co/lIZytidBqZ

[PRODAFT @PRODAFT]

👇The Pareto Principle applies to Funky Mantis as well, where a successful extortion follow an 80-20% split.

[The Hacker News @TheHackersNews]

⚠️ DevMan RaaS now runs a full affiliate portal.

Experts (tracking it as Funky Mantis) say the platform handles payload builds, victim records, chat, teams, support, and payouts in one place. Affiliates get structured workflows, deadlines, and an 80/20 cut.

184 victims claimed so far.

Read: https://t.co/Eh0HwSpFEe

[PRODAFT @PRODAFT]

🎯 A target list. A schedule. A revenue model. A locker ready to deploy.

This is Funky Mantis (DevMan) behind the ransom note.

🕵 Our latest report reveals how the operation assigns access, schedules targets, divides responsibilities, and coordinates through https://t.co/NGcipbZran, private communications, and dedicated RaaS portals.

We trace the platform's evolution from December 2025 to its January 2026 v3 release, then dissect the Windows encryptor used to finish the job.

The locker:
- Terminates processes and services
- Searches network shares
- Supports lateral movement
- Disables Microsoft Defender
- Clears event logs
- Deletes shadow copies
- Removes itself after execution.

The report also includes defensive priorities, response guidance, and four behavior-focused threat hunting rules.

👇 Read the full report:

https://t.co/7W3kwLgq0F

#PRODAFT #ThreatIntelligence #Ransomware #FunkyMantis #DevMan

[The Hacker News @TheHackersNews]

A #ransomware gang broke away from the pack.

The Gentlemen started as an affiliate using LockBit, Qilin, and Medusa resources.

Now it runs its own RaaS program, claims 478 victims, offers affiliates a 90% cut, uses AI to maintain its tools, and can spread across networks when enabled.

Read the full story: https://t.co/X7BWiNMym6

[PRODAFT @PRODAFT]

🚨 PHANTOM MANTIS (a.k.a. The Gentlemen): They only hold the door open to exfiltrate your data.

Meet Phantom Mantis, the ransomware crew that went from total unknown to one of the most prolific operations. 💀

🔥 HUNDREDS of victims on their leak site
🌍 Confirmed hits across 20+ countries
📈 Explosive growth that nobody saw coming

We are tearing the operation wide open.🕵️

🔴 TLP:RED version: the full deep-dive: affiliate intel, victimology, the usual PRODAFT stuff.

⚪ TLP:CLEAR: Open to everyone, right here:
👉 https://t.co/ynWxNj6g0e

#TheGentlemen

[PRODAFT @PRODAFT]

This is what happens when you put an ex-hacker on a stage in front of 750 students. 👨‍🎓👩‍🎓

Last week, we had the privilege of being part of two remarkable events and we're still feeling the energy.

We participated in the Leiden 2026 Youth Security Conference, where the next generation of cybersecurity talent gathered to learn, connect, and take their first steps into the industry. @euhorizons

At the same time, @mdisec took the stage with his talk "A Hacker's Diary". Over 750 students registered for his solo talk, making it an all-time record. 🚀#CyberTEDU

These young minds show up with boundless energy, remarkable patience, and a curious mindset that is impossible to ignore.

To every student we crossed paths with last week -- a big THANK YOU. Keep pushing. 💙

[PRODAFT @PRODAFT]

🛡️ Showcasing cyber intelligence expertise at #FIC2026 (@INCYBER_Europe , Lille)

We were proud to contribute to the Expertise France track, presenting our CTI and supply chain risk intelligence solutions to international delegates.

🤝 We had the pleasure of engaging with partners from Africa, Europe, Central Asia, and the Asia Pacific region, highlighting the truly global nature of today's cyber challenges.

✨ Key message: across all regions, there is a shared urgency to strengthen cyber resilience, capacity building, and trusted digital ecosystems. These discussions also reaffirm the importance of strategic autonomy and diversified partnerships in shaping a balanced and sovereign approach to cybersecurity.

A big thank you to all participants for the rich discussions. Looking forward to building impactful collaborations ahead.

#Cybersecurity #InCyber #FIC2026 #ExpertiseFrance #DigitalCooperation #CyberResilience

[PRODAFT @PRODAFT]

🛡️ Executive Exposure is an Enterprise Risk

Senior executives and high-trust, business-critical leaders are prime targets for cyber criminals due to their access, visibility, and decision authority.

Our VIP Protection module in U.S.T.A. continuously monitors personal and corporate account exposure of key executives and VIPs in your organization.

🚨 When early signs of leakage appear, we alert in real time before personal exposure turns into business, legal, or reputational impact.

📌 Board-level takeaway:
Protecting leadership identity is no longer optional. It’s a core part of enterprise risk management.

Explore more:
https://t.co/bruTt2rhJC

#CyberSecurity #ExecutiveRisk #BoardGovernance #DigitalRisk #ThreatIntelligence

[PRODAFT @PRODAFT]

Our SYS initiative continues to accept tips regarding cybercrime. If you have information about any threat actor group, you can reach us directly through our TOX anonymously:

D0E5B14B166D8440E3F54CDFC0F38E5080645F728F02AADFB7B978F9D579EE5A6D38A29DD307

P.S. Our graphic designer is away this week, but since posts with images receive better engagement, we did our best. Thank you for your understanding.

#cybercrime #cyberthreatintel #proactivedefense

[PRODAFT @PRODAFT]

📈Statistically speaking, thanks to the SYS initiative, there are now more "good guys in disguise" running cybercrime forums as moderators and administrators than actual criminals.

#cybercrime #proactive #cyberintelligence

[3xp0rt @3xp0rtblog]

As part of the SYS initiative, @PRODAFT is notifying users affected by the RAMP forum database leak. Threat actors are being encouraged to assist with the de-anonymization of some of the most active cybercriminals and ransomware operators — developments that are expected to make headlines. Choose a better path for yourself.
https://t.co/DjAfNKOw09

[PRODAFT @PRODAFT]

RAMP Forum User Intelligence Available for Our Platform (U.S.T.A. & Catalyst) Members

🫶Our SYS initiative remains highly active, as a well-known forum member voluntarily contacted us. We are grateful for their contribution. Even when admins attempt to dox each other for 10 BTC, it's good to see some members doing it voluntarily for us.

🔍As a result, our team has acquired intelligence associated with 7,709 RAMP forum users, including the following high-value investigative datasets:

📧Private messages exchanged between threat actors, enabling reconstruction of operational planning and coordination;

👾Attachments sent and received between threat actors, supporting malware, tooling, and infrastructure attribution;

🔐Authentication and login activity, facilitating access-pattern analysis and operational security assessment;

🌌Forum search history, providing insight into intent, targeting, and operational focus;

🧐Profile information, including but not limited to registered email addresses, supporting identity correlation and cross-platform attribution;

🗣️Chat room and group communication metadata, indicating collaboration structures and coordinated activity across specific operations and campaigns.

We will be correlating these datasets to support and advance multiple previously unsolved investigations.

#cyberintelligence #ramp #LockBitSupp <3

[PRODAFT @PRODAFT]

Our managing partner @mdisec took the stage at a fully packed Meetup series (#58) organized by @teknasyon

🐦‍⬛The room was packed wall to wall as hundreds of hackers gathered to listen to his energetic and educational talk titled Hacker’s Diary: A Product Security Tale.

Huge thanks to @teknasyon for hosting such an incredible event and big respect to the passionate audience whose curiosity and engagement filled the room 🔥

#zeroday #vulnerability 👋#chat

[PRODAFT @PRODAFT]

For all the malware devs out there 🦠🧑‍💻

Every infostealer uses a different timestamp format. Some of you even invent new ones.

Analysts everywhere are crying while parsing those logs.

Please.
Just use ISO8601. (One of our clients advised that)

Make it a standard among whatever nasty thing you're coding.

If you don't know how, please contact us.

#ISO8601 #CyberThreat #MalwareDev

[PRODAFT @PRODAFT]

🚨 Hidden Risk: Unattended or Forgotten Social Media Links

A single social media link on a website can open the door to:
🎭 Brand impersonation
🎣 Phishing campaigns
💸 Fraud and reputation damage

Attackers actively search for unclaimed or abandoned social media accounts linked from official websites, then take them over to exploit user trust or re-register to sell them.

Only thing worse than a breach is explaining to the board that it started with a forgotten Twitter link from 2016 🤦‍♂️

#CyberSecurity #ThreatIntelligence #BrandProtection

[PRODAFT @PRODAFT]

🔧Our open source tool Cradle is built for the threat intelligence community and shared openly with everyone. What started as a public project is now being used by many major organizations to manage complex internal cases and critical knowledge at scale.

We are pushing Cradle forward with new powerful features coming soon !🤫.

Follow our GitHub to see what is next and be part of the future of case management
https://t.co/SP91gcmArx

[PRODAFT @PRODAFT]

Our seasoned manager, ACK, represented us at MaTeCC in Morocco as a speaker, sharing insights on AI-driven cyber threats and the latest cases we investigate.

From Morocco's strong support for cybersecurity to the high-quality technical sessions and an inspiring student community shaping the future of cyber resilience, MaTeCC truly showcased the region's growing capability in cyber domain.

#Morocco #MaTeCC