ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
A ThreatsDay roundup covers GlassWorm VS Code themes, VulcanRAT207, a Qilin extradition, and a rogue Gentlemen affiliate.
Socket reported malicious Visual Studio Marketplace and Open VSX themes, including Coca-Cola Christmas and Aurora Borealis Studio Theme, that reuse GlassWorm's Solana dead-drop loader and skip Russian-language systems. Morphisec described a WhatsApp "Statement.exe" lure that delivers VulcanRAT207 using PoolParty process injection, the signed GoFly64.sys BYOVD driver, and Vulkan DLL side-loading. A 28-year-old Russian alleged Qilin member was extradited from Japan to Germany over a September 2024 logistics-company encryption and more than $160,000 in crypto extortion. Forescout found only 6% of IoMT devices among 2.5 million surveyed can support a post-quantum SSH transition.