Ukraine wrecked Russia's best data centers and idled all three AI supercomputers. Then the internet decided that had also killed the bots. It hadn't and the way we know is
read post →f4n6.co.uk - October 2026 - TLP:CLEAR. All indicators are defanged. Hash: f745c2d897ad6f16cb5c0428ba74a7f041f7c3e94f52cc3727532577fe12507d 0:00 /2:34 1× TL;DR * A 9 MB, 64-bit Windows
A 12 MB batch file that unpacks a genuine, signed ScreenConnect client wired to an attacker's relay, disables every user-visible indicator, survives reboot and Safe Mode — and what it looks like on a real infected host.
The first detonation gave us nothing. No DNS, no sockets, no drops, no persistence 8.6 MB of Go binary that ran, yawned, and went back
A loader disguised as libcurl refuses to run on VMs and dies silently in sandboxes. We patched its six anti-VM checks out and captured its WebSocket C2 on port 406.
A 3.5 KB Windows loader with one import, a split-up C2 address, and a forty-byte handshake it repeats until somebody answers. We answered
A 15 KB DLL that silently rewrites cryptocurrency addresses on your clipboard. I pulled it apart statically, confirmed it in a sandbox, recovered all nine of
1. Executive summary Email bombing, also called form bombing, list bombing or subscription bombing, floods a target mailbox with hundreds or thousands of automated
1. Executive summary A credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was used on 2026-10-15 to authenticate as the application itself
1. Executive summary A malicious npm package named imgdecode, uploaded on 30 September 2026 by the account malfexteste8, is part of the MALFEX software
1. Executive summary Citizen Lab has documented a campaign, AdFection, in which ads brokered by Israeli adtech firm Discover-Tech were used to fingerprint
1. Executive summary A credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was used to authenticate into customer Microsoft 365 tenants and obtain Microsoft