NetamLoader hides in Windows 10 update packages aimed at Asian governments
Kaspersky saw one victim in the first half of 2026 and says Patch My PC itself was not compromised.
1
Stories per day · 30 days
2 RSS
Relatednik-c24openai4ransomware3infostealer2prince-of-persia2tonnerre2tornado2amsi1clamav1cloud-abuse1credential-dumping1foudre1identity1infy1iran1keylogging1living-off-the-cloud1netamloader1
12 stories, newest first · one card per story
Stories tagged #command-and-control
NIK C2 malware uses the OpenAI API for theft and remote control
Cisco Talos says the Go implant can bill a victim’s OpenAI key, log keys, and show a non-encrypting lock screen.
Talos finds NIK C2 Windows implant that spends victims' OpenAI keys
The Go implant dumps credentials, captures keystrokes, and can lock screens with ransomware while calling an OpenAI model on the host.
1
NIK C2 malware bills AI queries to victims' OpenAI keys
Cisco Talos says the Go implant offers more than 52 commands plus a screen-lock ransom module that encrypts no files.
1
Talos details NIK C2, an AI-enabled Windows implant seen live
Operators can dump credentials, log keystrokes, call OpenAI from the host, and deploy screen-lock ransomware.
7
Prince of Persia APT hosts C&C in US for first time since 2016
After a three-month pause, Tonnerre stole more than 1,800 files from one victim within a week of the May 27 restart.
2
Prince of Persia found hosting command-and-control servers in the US
Semperis traced Tornado malware to a US host after the group appeared quiet following February strikes on Iran.
2
Attackers hide command and control in trusted cloud services
Cited cases include Gridtide on Google Sheets, SesameOp via OpenAI APIs, and a reported Intune wipe at Stryker.
1
Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites
Casbaneiro hides its main command channel until Latin American victims open targeted banking sites.
2
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation
SOCRadar reports a large Citrix NetScaler exploitation operation around CVE-2026-88771.
The Domains Keep Disappearing, but the Malware Infrastructure Behind Them Never Moves
ActiveSOC found fake-CAPTCHA malware lures rotating domains while Seychelles hosting infrastructure stayed put.
2
Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic
Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.
4