US Cyber Operations Group 🕵️🇺🇸 Vs 🕵️🇷🇺 Russia's Cyber Operations Group

TRIPAUL3: Anatomy of a modular Windows RAT that hides its configuration and six encrypted plugins in the overlay🐀🔍 TRIPAUL3 is a modular remote access trojan for Windows x64, written in C++, that conceals its configuration and six encrypted plugins in the executable’s overlay. 🧩 A fully capable modular implant. The six plugins are loaded straight into memory through manual PE mapping, without ever touching disk, and they cover the full lifecycle of an offensive RAT . 🔸 Keylogger 🔸 VNC and HVNC, with control over the visible desktop and a hidden desktop running its own browser 🔸 Stealer for browser credentials and cryptocurrency wallets 🔸 File manager 🔸 Shell and system information gathering 🛡️ An evasion arsenal, dormant in this sample but fully intact in the code 🔸 Anti-debug with five chained checks, including hardware breakpoints 🔸 Anti-VM against VirtualBox, VMware, Xen and Parallels 🔸 Anti-sandbox that hunts for Wireshark, x64dbg, IDA or Sandboxie 🔸 Anti-EDR through ntdll unhooking and patching of ETW and AMSI 🔸 Triple persistence disguised as “WindowsSecurity”, with a Run key, an ONLOGON scheduled task and a Startup shortcut ⚠️ The encryption looks solid on the surface, with AES-256-GCM and HMAC-SHA256 in encrypt-then-MAC mode. Yet the decryption key travels in cleartext inside the overlay header itself, and it is also the very same key that protects the six plugins. 🔐 VT : virustotal.com/gui/file/fd57… Any Run : app.any.run/tasks/7b654fd2-0… mihari-intelligence.blogspot…

🗡️ DarkSword · Fake Captcha · iOS 🔍 I analyzed a fake “verification” page (bogus Cloudflare CAPTCHA) that’s actually the delivery front-end for DarkSword/Coruna, the iOS exploit chains attributed to UNC6353. 🎭 The lure: It imitates Cloudflare and reCAPTCHA at once — a red flag in itself: no real challenge mixes both brands. While you “verify,” the real chain loads in the background. 👻 Invisible iframe: A 0×0 px