🎣🧀 Since early September 2025, the Orange Cyberdefense CSIRT and CyberSOC teams have detected phishing campaigns impersonating Meta, AppSheet and Paypal, leading to malware delivery. Our team tracks this activity under the alias "Metappenzeller".
#CTI #ThreatIntel #Metappenzeller #phishing
23.09.2025 09:37 — 👍 0 🔁 1 💬 1 📌 0
🧀 Update on MintsLoader: a thread 🔽
MintsLoader is a JavaScript/PowerShell loader that was first detailed by OCD in 2024.
A new version has been around at least since early-June 2025.
#threatintel #cti #mintsloader
03.07.2025 07:43 — 👍 3 🔁 4 💬 1 📌 0
During our analysis, we noticed a surprising line, likely written by threat actors to prevent AI-powered file scanning
This is actually the first time we observed such an attempt, even though we found it to be unsuccessful with GPT-4o.
17.03.2025 15:56 — 👍 0 🔁 0 💬 1 📌 0
V3 features several changes including new mouse movements speed check.
Recent infection chains includes new intermediary stage (Powershell with AMSI bypass feature which loads a .NET stage) in charge of delivering #stealers.
17.03.2025 15:56 — 👍 0 🔁 0 💬 1 📌 0
🆕New version of #Emmenhtal loader actively distributed worldwide since early March, leading to #Lumma or #Rhadamanthys stealers.
Very low AV detection on VT for now.
Similarly to V2, Emmenhtal V3 masquerades as #mp3 or #mp4 files, including relaxation songs.🧘♀️
17.03.2025 15:56 — 👍 2 🔁 1 💬 1 📌 0
🆕New version of our #ransomware mapping is out on our GitHub!
➡️https://github.com/cert-orangecyberdefense/ransomware_map/blob/main/OCD_WorldWatch_Ransomware-ecosystem-map.pdf
V28 (!) includes latest newcomers and recent ecosystem evolutions.🔍
As always, feedback is welcome!
#cti #threatintel
05.03.2025 16:32 — 👍 2 🔁 3 💬 0 📌 0
Orange Cyberdefense CERT Threat Research: The hidden network map
📍For more than 8 months, our threat researchers from OCD
have worked on mapping China's civil-military–industrial complex when it comes to #cyberespionage operations.
⛯ Consult our newly published deep-dive report and interactive map here:
research.cert.orangecyberdefense.com/hidden-netwo...
25.11.2024 10:59 — 👍 5 🔁 2 💬 0 📌 0
