World Watch (OCD)

World Watch CTI team from @CERTcyberdef (@OrangeCyberDef)

[CERT Orange Cyberdefense @CERTCyberdef]

Orange Cyberdefense has been tracking a modular PowerShell-based stealer-loader framework we call #Runster, active since Nov 2025.

2 main delivery methods, 2 PowerShell modules + a related EXE with a DGA, dropping a malicious DLL.

#ThreatIntel #CTI #RUNSTER

See 🧵 below:

[World Watch (OCD) @WorldWatch_OCD]

@asma_lansari Bottom line: different lures, similar staging, same malware outcome. We published a full advisory for our customers on the infection chain, overlaps, and malware analysis. Related IoCs are also available in our public GitHub repository:

https://t.co/tp1ph8PFsr

[World Watch (OCD) @WorldWatch_OCD]

🧵 Since March 2026, Orange Cyberdefense has been tracking a malware delivery cluster linking a fake FileZilla campaign with other software-themed lures, including LibreOffice and Google Drive Setup, as well as a ClickFix-based one.

#CTI #ThreatIntel #STXRAT

@asma_lansari

[World Watch (OCD) @WorldWatch_OCD]

@asma_lansari Notably, credential theft is only activated after successful C2 interaction.

[Seongsu Park @unpacker]

These guys published a great report on Operation DreamJob by the DPRK threat actor, and I can relate to how hard it is to build that malware relationship table. Kudos to the team!

[CERT Orange Cyberdefense @CERTCyberdef]

🔎Our CERT is releasing a new technical report on 🇰🇵Operation #DreamJob, focusing on recent evolution in its tooling.
Following an IR engagement at a large manufacturing client based in 🇪🇺, we investigated artefacts we attribute to #UNC2970.
➡️Full blog: https://t.co/o8px0jZmfc

[CERT Orange Cyberdefense @CERTCyberdef]

Last week, our International CyberSOC team detected a wave of #phishing emails sent to several customers in Germany🇩🇪. Designed for Microsoft 365 credentials harvesting, the campaign relies on #bubbleapps subdomains spoofing company names.

[CERT Orange Cyberdefense @CERTCyberdef]

🧀🎣Since early September 2025, the Orange Cyberdefense CSIRT and CyberSOC teams have detected phishing campaigns impersonating Meta, AppSheet and PayPal, leading to malware delivery. Our team tracks this activity under the alias "Metappenzeller" #CTI #ThreatIntel #Metappenzeller

[World Watch (OCD) @WorldWatch_OCD]

The new version has removed these notable behaviours and is seen in campaign with fake invoice lures. New indicators of compromise (IoCs) are available on our GitHub:
https://t.co/8vig1nADhD

[World Watch (OCD) @WorldWatch_OCD]

🧀 Update on MintsLoader: a thread 🔽
MintsLoader is a JavaScript/PowerShell loader that was first detailed by OCD in 2024.
A new version has been around at least since early-June 2025.
#cti #ThreatIntel #mintsloader

[World Watch (OCD) @WorldWatch_OCD]

The associated infrastructure could be tracked thanks to specific patterns and campaign IDs in the C2 URLs. These detection opportunities were presented during the Botconf 2025: https://t.co/tvkXutDbGw