Upatre Continued to Evolve with new Anti
Unit 42 analyzes an undocumented Upatre downloader variant with VM detection via process hashing, packed code, disabled Windows defenses and Namecoin .bit C2 domains.
28
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
5 articles · newest first"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Unit 42 profiles the Blank Slate malspam campaign: blank emails with double-zipped attachments delivering Cerber ransomware while cycling abused hosting provider domains.
26
Locky Ransomware Installed Through Nuclear EK
Unit 42 reports Locky ransomware delivered through the Nuclear exploit kit using Flash exploits, adding a drive-by path to existing malspam distribution.
24
Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Unit 42 reports the Afraidgate campaign switched from Nuclear EK delivering Locky to Angler EK delivering CryptXXX via the Bedep downloader.
38
Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
The Afraidgate exploit kit campaign stopped distributing CryptXXX and now delivers the .zepto Locky variant exclusively through Neutrino EK since July 2016.
15
Appears with
- Palo Alto Networksvendor · 4
- CryptXXXmalware · 2
- Nuclear EKmalware · 2
- Afraidgatethreat actor · 2
- AutoFocusproduct · 2
- Palo Alto Networksorganization · 2
- Dridexmalware · 1
- Cerbermalware · 1
- Sage 2.0malware · 1
- Upatreproduct · 1
- Proofpointvendor · 1
- Pseudo-Darkleechthreat actor · 1
- Wiresharkproduct · 1
- Blank Slatethreat actor · 1
- Unit 42organization · 1
- Zeptomalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.