APT41's Expanding Arsenal: Google Calendar C2, Silver Dragon, and the Persistent Threat to U.S. Defense and HealthcareAPT41 deploys TOUGHPROGRESS malware with Google Calendar C2, launches Silver Dragon sub-cluster, and continues targeting U.S. defense and healthcare infrastr...29 min read·redsheeptrends.hashnode.devMar 18
CL-STA-1087: China-Linked Espionage Cluster Targets Southeast Asian Militaries with Custom BackdoorsUnit 42 exposes CL-STA-1087, a multi-year Chinese cyberespionage campaign using AppleChris and MemFun backdoors to steal military intelligence from Southeast...14 min read·redsheeptrends.hashnode.devMar 17
Handala Weaponizes Microsoft Intune to Wipe 200,000 Stryker Devices Across 79 CountriesIran-linked Handala group compromised Stryker admin accounts and abused Microsoft Intune to remotely wipe 200,000+ devices globally. Full technical breakdown...8 min read·redsheeptrends.hashnode.devMar 13
FortiGate Exploitation Campaign: How Stolen Service Accounts Enable Rogue Workstation Deployment and Full AD CompromiseActive exploitation of three FortiGate CVEs lets attackers extract LDAP credentials, join rogue workstations to Active Directory, and exfiltrate NTDS.dit files.9 min read·redsheeptrends.hashnode.devMar 12
North Korean Hackers Poisoned Polyfill.io Library to Target 100,000 WebsitesA massive supply chain attack compromised the popular polyfill.io JavaScript library, affecting over 100,000 websites with malicious code linked to North Korea.5 min read·redsheeptrends.hashnode.devMar 12
