BlueTeamCoolTeam

Malware analysis and detection engineering for defenders

HOME
CATEGORIES
TAGS
ARCHIVES
ABOUT

Home Tags threat-actor

Tag

threat-actor 1

Your RMM Has a Second Owner: Inside a Rogue ScreenConnect Credential Theft Campaign Jun 19, 2026

Recently Updated

No File, No Fixed C2: Inside NetCon, a WMI Backdoor That Reads Its Command Server Off the Blockchain
Reading the ledger: how one Polygon smart contract exposed three ClickFix crews and 153 confirmed hacked websites
feintnet: I got tired of FakeNet-NG not running on my ARM box, so I built my own
Five layers deep for a stealer: reversing the "PuppetKing" ClickFix chain that ended in StealC
Your RMM Has a Second Owner: Inside a Rogue ScreenConnect Credential Theft Campaign

Trending Tags

application-control lolbin c2 defense-evasion powershell clickfix obfuscation persistence infostealer amsi-bypass

© 2026 Luke Wilkinson. Some rights reserved.

Using the Chirpy theme for Jekyll.

Trending Tags

application-control lolbin c2 defense-evasion powershell clickfix obfuscation persistence infostealer amsi-bypass

New content available