AnyDesk Clone Malware Drops Phemedrone Stealer Loader
On June 16, 2025, a suspicious domain impersonating AnyDesk — anydeske[.]icu — was reported on Twitter. The site served what appeared to…
Researches, News, and more
DeXpose Blog
Threat Actor Profile: Mustang Panda
Mustang Panda is a highly persistent and adaptive Chinese state-linked cyber espionage group operational since at least 2012. Known by…
Threat Actor Profile: APT27
Who is APT27? APT27 — also known as Emissary Panda, Iron Tiger, and LuckyMouse — is a Chinese state-sponsored cyber-espionage…
Inside Valkyrie Stealer: Capabilities, Evasion Techniques, and Operator Profile
What Is Valkyrie Stealer? Valkyrie Stealer is a C++ infostealer designed to collect credentials, system information, browser data, messaging-app sessions,…
Undetected .NET PE Injector Found on Archive Org
Introduction On February 11, 2025, Filescan.io shared a troubling discovery: a 6-month-old .NET PE injector had remained undetected on Archive.org, a platform widely used for archiving…
PureLogs malware analysis with data theft techniques
Introduction PureLogs is an advanced information stealer designed to extract credentials, session tokens, and system details while employing strong anti-analysis…
SalatStealer Malware Analysis and Data Theft Techniques
Introduction Salat Stealer is a stealthy malware developed in the Go programming language, designed to infiltrate systems and extract sensitive…
Uncovering Kimsuky APT Infrastructure | Threat Report
Summary Recently identified previously undetected Kimsuky (also known as Black Banshee) infrastructure through advanced pivoting techniques. Using HTTP header analysis,…
In-Depth Technical Analysis of Lumma Stealer
Introduction Lumma is a sophisticated information stealer, written in C/C++, that has been active in the wild since at least…
