YARA rule detects orphaned VBA projects inside DWG files
A VirusTotal retrohunt with the rule returned only two matching samples.
28
Organization
VirusTotal
- Mentions · 7d0
- Mentions · 30d3
- All mentions6
- First seenSep 16, 2026
- Last mentioned14d ago
Timeline
6 articles · newest firstVirusTotal Adds Scanning for Public IPv4 Space to Expose C2 Servers and Malware Infrastructure
VirusTotal now scans public IPv4 daily, recording ports, banners, and fingerprints to surface C2 infrastructure.
54
Hackers Allegedly Selling VirusTotal API Keys on the Dark Web
An unverified dark-web listing offers a claimed VirusTotal Enterprise API key for $350 in Bitcoin or Litecoin.
32
Weaponizing Ground Truth: Data Poisoning Attacks by Exploiting Boundary Misalignment Between Antivirus Software and Learning-Based Detectors
Bi-Iocane poisons ML malware detectors by flipping antivirus labels with tiny byte edits.
61
Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
Squatted placeholder domain third-party.com now serves a Windows ClickFix lure referenced in over 1,700 repositories.
76
BambooToken: The Malware That Speaks MQTT to Stay Under the Radar
Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.
56
Appears with
- VirusTotalvendor · 2
- Kingsoft Officeproduct · 1
- GitHuborganization · 1
- BambooTokenmalware · 1
- Lumenorganization · 1
- Googleorganization · 1
- Tendyronvendor · 1
- NOX Stealermalware · 1
- Black Lotus Labsorganization · 1
- Manifold Securityorganization · 1
- macOSproduct · 1
- APT28threat actor · 1
- BOMBAY Stealermalware · 1
- DrayTekvendor · 1
- MikroTikvendor · 1
- Havocmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.