New report revisiting Gamaredon, this time focusing on their phishing emails and first stage downloaders - GammaDrop and GammaLoad. Despite years of active campaigns, detailed public analysis of either has been lacking. So we fixed that. 1/5

Attribution to Dragonfly instead of Sandworm was quite a plot twist! cert.pl/en/posts/202...

Energy Sector Incident Report - 29 December 2025

CERT Polska presents a report on the analysis of an incident in the energy sector that occurred on 29 December 2025. The attacks were destructive in nature and targeted wind and photovoltaic farms, a ...

cert.pl

#BREAKING #ESETresearch provides technical details on #DynoWiper, a data‑wiping malware used in a data‑destruction incident on December 29, 2025, affecting a company in Poland’s energy sector. www.welivesecurity.com/en/eset-rese... 1/5

New research uncovering a new Iranian activity cluster - "RedKitten". Spreading with a lure revolving around the Iranian protests, we found a sample of a newly developed malware we dubbed "SloppyMIO", relying on Github, Google Drive and Telegram. Very heavy on the AI 1/

#BREAKING #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5

Recently, our team at HarfangLab had a look at samples of archives containing weaponized XLS spreadsheets which drop C# and C++ downloaders, and likely intended to be delivered to targets in Ukraine and in Poland.

Following our recent #Gamaredon publication, the actor upgraded their PteroLNK malware and expanded infrastructure. Key changes: - NTFS Alternative Data Streams (ADS) storage - Randomized HTTP headers breaking network sigs - Expanded tunneling services - More robust DDR approach

Dropping new research - this time on recent #XDSpy operations. Out of hundreds of LNK files leveraging ZDI-CAN-25373, we isolated a tiny cluster using an additional LNK parsing trick, leading us to uncover a multi-stage infection chain actively targeting government entities