🧵 Since March 2026, Orange Cyberdefense has been tracking a malware delivery cluster linking a fake FileZilla campaign with other software-themed lures, including LibreOffice and Google Drive Setup, as well as a ClickFix-based one. #CTI #ThreatIntel #STXRAT @asmalansari.bsky.social

🔎Our CERT is releasing a new technical report on 🇰🇵Operation #DreamJob, focusing on recent evolution in its tooling. Following an IR engagement at a large manufacturing client based in 🇪🇺, we investigated artefacts we attribute to #UNC2970. ➡️Full blog: ow.ly/V4mr50Xug1l

🎣🧀 Since early September 2025, the Orange Cyberdefense CSIRT and CyberSOC teams have detected phishing campaigns impersonating Meta, AppSheet and Paypal, leading to malware delivery. Our team tracks this activity under the alias "Metappenzeller". #CTI #ThreatIntel #Metappenzeller #phishing

🧀 Update on MintsLoader: a thread 🔽 MintsLoader is a JavaScript/PowerShell loader that was first detailed by OCD in 2024. A new version has been around at least since early-June 2025. #threatintel #cti #mintsloader

🆕New version of #Emmenhtal loader actively distributed worldwide since early March, leading to #Lumma or #Rhadamanthys stealers. Very low AV detection on VT for now. Similarly to V2, Emmenhtal V3 masquerades as #mp3 or #mp4 files, including relaxation songs.🧘‍♀️

🆕New version of our #ransomware mapping is out on our GitHub! ➡️https://github.com/cert-orangecyberdefense/ransomware_map/blob/main/OCD_WorldWatch_Ransomware-ecosystem-map.pdf V28 (!) includes latest newcomers and recent ecosystem evolutions.🔍 As always, feedback is welcome! #cti #threatintel

📍For more than 8 months, our threat researchers from OCD have worked on mapping China's civil-military–industrial complex when it comes to #cyberespionage operations. ⛯ Consult our newly published deep-dive report and interactive map here: research.cert.orangecyberdefense.com/hidden-netwo...