ThreatFoXX

Hunt APTs, watch the dark web and track every CVE that matters.

[ThreatFoXX @_Dixit_]

Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment.

Analysis: https://t.co/HQuak0aO1E

@ElementalX2 @smica83 @AndreGironda @skocherhan @Cyberdost @IncomeTaxIndia @IndianCERT

[ThreatFoXX @_Dixit_]

Interesting sample from Vietnam !

Targeting Vietnam Social Security (Bảo hiểm xã hội Việt Nam).

QD_Kehoach_ATANM_BHXHVN_2026.pdf.rar: 2f06e2f14ee561c325b3495c749621bf7bc1c4e6c60118123a9e49bbe45a91f9

@smica83 @skocherhan @ElementalX2 @PrakkiSathwik @500mk500 @AndreGironda

[ܛܔܔܔܛܔܛܔܛ @skocherhan]

'Iranopasmigirim.lnk'
69bf3f4a472386d3f450fb78df97a91d
'umpdc.dll'
afd949746b510609714185dab7b2c1db

MAC address: de:c5:0d:37:9e:24
Machine id: DESKTOP-EE25554
Disk volume serial number: 4a2d-5e79
👇
https://t.co/pqoipOmIbi

[ThreatFoXX @_Dixit_]

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan Seems like dropping Go based Overlord RAT.

@ElementalX2 @smica83 @AndreGironda @PrakkiSathwik @malwrhunterteam @skocherhan

[ThreatFoXX @_Dixit_]

Interesting sample from Russian Federation,

Уведомление_№А40-10_05_08_2026: is a standardized technical filename or document ID generated by Russian state or judicial information systems on August 5, 2026.

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan

[ThreatFoXX @_Dixit_]

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan - Уведомление №: Official legal notice or summons.

- А40: Issued by the Arbitration Court of Moscow.

- 10: Court department or document serial number with 05_08_2026: Dated August 5, 2026.

[ThreatFoXX @_Dixit_]

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan Zip: 71fba4e47085dafc19b95c84454a4a1156e298f5b459c5276aa558538fa58ef0

Уведомление_№А40-10_05_08_2026.pdf.lnk: 885b624abf5fad3fb0e24f80726e4ea605a2f003d3bf5dbb1d0f8c55d0d133b0

[ThreatFoXX @_Dixit_]

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan Similar sample spotted ,

戦術的成果と戦略的不全.lnk: 6e6addf3e7287cf160054ef4647f8c67754f3cdc6efbdf21f117cb98c4c95534

https://t.co/Fh5N2oUeZ5: 67d21c04043be2ce744489a0be64290fcbb172310496ab05e0ad289d10d5dd30

@smica83 @ElementalX2 @PrakkiSathwik @skocherhan @malwrhunterteam

[ThreatFoXX @_Dixit_]

New phishing chain spotted: decoy PDF "Japan-India Strategic Relations" (.pdf.lnk double-extension trick) drops a payload via cmd.exe → curl from a VN-hosted IP (103.77.242.187), saved as bot.vbe in %appdata%.

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan

[ThreatFoXX @_Dixit_]

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan @500mk500 Similar sample,

ДСП Псих. тесты.docx.lnk: d90e686ddc1d288e29c1bceb68ffedccb3285f83be7eef4f50c45144f025a12d

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan @500mk500

[ThreatFoXX @_Dixit_]

Interesting sample from Poland with Zero Detection,

Target: Russian Ministry of Defence (MoD) personnel (Military Unit No. 27359), Volunteer organizations supporting the Russian military

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan @500mk500

[ThreatFoXX @_Dixit_]

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan @500mk500 АКТ приема передачи https://t.co/rAvmwte3bV: 1f479516c3ded8d827b83bea94ae14f3d8212552f107ccc548d572dd8334fcae

АКТ приема передачи 16.07.2026.docx.lnk: 7745290182b09c243b344b7d96511ff03d4638348be38865b926913c21cf0c21

[ThreatFoXX @_Dixit_]

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @skocherhan 新段階に入っ���日印の戦略的関係.pdf.zip: 0e1fcb0e29c132819fcb2a3f2aa188a398c96be5e1919266ae95a8ee99986347

新段階に入った日印の戦略的関係.pdf.lnk: 44dc1939dcaea681f5c39ed6f5f81a80ca5f59e72be7f938ac3afe5adb484042

[ThreatFoXX @_Dixit_]

@smica83 @skocherhan @malwrhunterteam @ElementalX2 Similar sample,

b5f4e1c142b5bcb472b30ab4428de4c891a7192c9687c471dabb93e85473b9fe: KẾ HOẠCH 80 NĂM TBLS.doc.lnk

@smica83 @skocherhan @ElementalX2 @500mk500 @malwrhunterteam

[ThreatFoXX @_Dixit_]

Interesting sample from Vieatnam,
Zip: 32391ce6eca836369cfd5b3948ba978b7982dd3a85b81bb33c973773adeaef01
Tin_buồn_PGĐ_Công_ty.pdf.lnk : 5b798cf328c17ecd6a2e759c9adc695b068640226f0d4fae049bcb6470d4ae56

@smica83 @skocherhan @malwrhunterteam @ElementalX2

[ThreatFoXX @_Dixit_]

@d1v35hresearch @RBI @IndianCERT @skocherhan @malwrhunterteam @smica83 SilverFox APT

[ThreatFoXX @_Dixit_]

New #VortexWolf activity observed.

Target: Russian defense personnel & military administration,

@smica83 @ElementalX2 @PrakkiSathwik @malwrhunterteam @500mk500 @skocherhan

ISKH_7565_Naznachenie_doshnost.zip: 1ed821fcc96cd12b94a7d4ab486d718416164e0ef8b607821b02b34c38f02674

[R3BELF0X @goldenjackel12]

#Found #ZIP #GG
Ukraine's National Agency for the Identification, Search, and Management of Assets Derived from Corruption and Other Crimes
bd80d61492ff48fb8bd64042f2918766

onedrive[.]itl-itd[.]com

probably targeting #Ukraine
@smica83 @500mk500 @PrakkiSathwik @ElementalX2

[ThreatFoXX @_Dixit_]

@Thisism23567356 @smica83 @skocherhan @malwrhunterteam @ElementalX2 Yes Right, Its Mustang Panda.

[ThreatFoXX @_Dixit_]

@NguynQu14458611 @smica83 @skocherhan @malwrhunterteam @ElementalX2 Yeah I know it

[ThreatFoXX @_Dixit_]

@smica83 @skocherhan @malwrhunterteam @ElementalX2 a3ee8569777f81a2cbce304d3ebe499e
30c62be8954504caabfd030a908b6799
15aaac1daf169572a96c2572fa1d5104
b791c416988d068a3e548a0f21cd3518
018dd859cbc0fe19c0b8055bb2aed481
f34e30934adb81667ebc1dc33776f302
137d8b79e5678d8438a8df0ad1d67fd2

Similar LNKs

[ThreatFoXX @_Dixit_]

@smica83 @skocherhan @malwrhunterteam @ElementalX2 Exploiting CVE-2025-9491 of LNK