Thanos

Iranian APT: New Methods to Target Turkey, Arabian Peninsula

Iranian state-linked threat group MuddyWater targeted governments, ministries, universities, telecommunications providers, and other organizations in Turkey, the Arabian Peninsula, Pakistan, Armenia, and nearby countries with evolving espionage malware campaigns. Researchers said the group delivered malicious Excel and Office documents through phishing, using macros and the Office exploit CVE-2017-0199 to launch multi-stage infections that dropped Windows Script Files, persistence components, and remote access tools including SloughRAT—also tracked as Canopy—along with additional Visual Basic and JavaScript implants. The intrusion chains used compromised or attacker-controlled infrastructure, regional decoy themes tied to Tajikistan, Pakistan, and Kurdistan, and fallback behavior that sometimes redirected victims to benign sites when command-and-control failed. Cisco Talos and Clearsky reported that MuddyWater combined PowerShell, living-off-the-land binaries, DNS and HTTP command-and-control, token-tracking mechanisms, and staged payload retrieval to execute arbitrary commands on victim systems, underscoring a broader shift toward more flexible and advanced tradecraft aligned with Iranian intelligence objectives.

EternityTeam: A New Prominent Threat Group

EternityTeam has emerged as a prominent malware seller on Russian-speaking underground forums and Telegram, marketing a modular malware-as-a-service toolkit that includes an infostealer, worm, miner, clipper, botnet/dropper, and ransomware. Researchers said the group has been active since at least 2022 and has paired aggressive advertising with customer support, release notes, and builder-style customization that lets buyers assemble malware binaries from separately sold components, lowering the barrier to entry for less-skilled attackers. The group's flagship offering, Eternity Stealer, is a .NET infostealer sold on subscription that targets browser data, cryptocurrency wallet information, application credentials, and Growtopia accounts. Observed samples masqueraded as Growtopia-related tools, exfiltrating stolen data over HTTPS to EternityTeam-controlled servers before forwarding it to operators through a Telegram bot. Researchers also reported samples in the wild and noted that parts of the stealer may reuse code from earlier public or criminal projects, but assessed the broader Eternity ecosystem as a credible and scalable threat because of its active distribution, modular design, and ransomware-capable tooling.

Eternity malware kit offers stealer, miner, worm, ransomware tools

Iranian Hackers Targeting Turkey and Arabian Peninsula in New Malware Campaign

Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups

Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks

New in Ransomware AlumniLocker Humble Feature Different Extortion Techniques | Trend Micro (US)

Researchers identified two ransomware families, AlumniLocker and Humble, that pair file encryption with increasingly coercive pressure on victims. AlumniLocker, described as a Thanos variant, was delivered through a malicious PDF invoice lure and a downloader chain, then demanded 10 bitcoins while threatening to publish stolen data on a “wall of shame” site within 48 hours if payment was not made. Humble used a batch-file-based execution chain packaged with Bat2Exe, blocked explorer.exe access to local drives, and reported successful infections through a Discord webhook. Trend Micro said some Humble variants also threatened to rewrite the Master Boot Record (MBR) or delete files if victims refused to pay, underscoring how ransomware operators were expanding beyond encryption into data-leak threats and destructive intimidation.

Шифровальщики-вымогатели The Digest "Crypto-Ransomware": RedRum, Tycoon

Tycoon, also tracked as RedRum, Grinch, and in some reporting alongside Thanos-linked variants, emerged as a manually deployed ransomware threat against enterprise environments on both Windows and Linux. Operators were reported to gain access through vulnerable or exposed RDP services, then encrypt files with AES-256-GCM while protecting encryption keys with RSA-1024. The malware appended extensions including .redrum, .grinch, .thanos, .eruption, and .magneto, and dropped a ransom note named decryption.txt using contact addresses such as moncler@tutamail.com and moncler@cock.li. Reporting also tied the activity to broader Thanos ransomware development, a .NET-based RaaS ecosystem that enabled extensive customization, persistence, anti-analysis, and defense-evasion features across multiple later variants. The malware was described as deleting shadow copies and disabling recovery and firewall protections while avoiding some system files and directories to keep infected systems operational. Historical tracking indicates some early Hakbit-identified and RedRum samples could be decrypted, including with an Emsisoft decryptor, while later corrected Thanos-derived variants adopted stronger RSA-based encryption that generally prevented recovery without the attackers' private key.