iiinova — where your digital self keeps evolving

World Watch OCD

@ocdworldwatch.bsky.social

World Watch CTI team from Orange Cyberdefense www.orangecyberdefense.com/global/o…

World Watch OCD @ocdworldwatch.bsky.social · 05/05/2026

🧵 Since March 2026, Orange Cyberdefense has been tracking a malware delivery cluster linking a fake FileZilla campaign with other software-themed lures, including LibreOffice and Google Drive Setup, as well as a ClickFix-based one. #CTI #ThreatIntel #STXRAT @asmalansari.bsky.social

Scheme showing overlaps between payloads and infrastructure elements.

122 0

World Watch OCD @ocdworldwatch.bsky.social · 23/09/2025

☣ The main lure deploys a full Python environment and runs a Python script responsible for fetching the next stage from a remote C2. Then it opens a decoy file in Word. C2 are now inactive but have been tied to Pure malware family.

This is a scheme describing the infection chain.
1. Email received.
2. Download a ZIP file from an actor-controlled website.
3. User clicks on an executable that sideloads a malicious DLL.
4. The malicious DLL unpacks an archive contained in the ZIP file, opens a Word document, and executes a Python script or a BAT file to fetch the final payload.

110 0

World Watch OCD @ocdworldwatch.bsky.social · 20/02/2025

Written in C++, #NailaoLocker is relatively unsophisticated and poorly designed. The ransomware uses the “.locked” extension. It is loaded through DLL search-order hijacking.

000 0