North Korean hackers exploit React2Shell flaw in EtherRAT malware attacks

Published on December 9, 2025

A new malware implant called EtherRAT, deployed in a recent React2Shell attack, runs five separate Linux persistence mechanisms and leverages Ethereum smart contracts for communication with the attacker. [...]

Continue reading on website
Other news

Ransomware IAB abuses EDR for stealthy malware execution

December 9, 2025
An initial access broker tracked as Storm-0249 is abusing endpoint detection and response solutions and trusted Microsoft Windows utilities to load malware, establish communication, and persistence in preparation for ransomware attacks. [...]

Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure

December 9, 2025
Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader, strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service (MaaS) model.The threat actor behind CastleLoader has been assigned the name GrayBravo by Recorded Future's Insikt Group, which was previously tracking it as TAG-150.