Posts under the Adversary Intelligence

Articles in Blog Posts

October 8, 2026

NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL

CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams.

Written by

Vikas Kundu

October 5, 2026

Caught in 4K: The Gentlemen Files

A Russian-speaking Gentlemen ransomware affiliate called Azazel robbed two dozen victims across six countries, then double-crossed his own gang by publishing the loot on a private leak site and pocketing every dollar. CloudSEK traced 50TB of exposed infrastructure and a live AI-driven attack chain. Read how "Caught in 4K" cracked the operation.

Written by

CloudSEK TRIAD

September 30, 2026

MALFEX - A malicious npm postinstall no advisory has caught for fourteen months

CloudSEK uncovered MALFEX, a long-running npm supply-chain campaign linked to a single operator, using malicious packages to deploy RATs and credential stealers. Two packages remain installable, including one malicious postinstall that evaded advisories for 14 months.

Written by

Vikas Kundu

September 29, 2026

TOPHIT Part 2: Renting the Attack Surface

CloudSEK found an attacker's control panel targeting vast.ai, a GPU rental marketplace. It rents containers beside victims to scan their networks. It reached one unprotected notebook and planted no miners. The panel exposed its own source code.

Written by

Vikas Kundu

September 29, 2026

TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2

CloudSEK found 85 malicious npm packages, published in three minutes, likely named to surface in search when developers mistype popular libraries. They give attackers remote command access. The same server hosts a GPU-hijacking panel. No victims confirmed.

Written by

Vikas Kundu

September 20, 2026

GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign

CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. The report maps the wider infrastructure, links parts of the activity to the PolinRider campaign, and details indicators, attack flow and defensive actions.

Written by

Vikas Kundu

Adversary Intelligence

Articles in Blog Posts

NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL

Caught in 4K: The Gentlemen Files

MALFEX - A malicious npm postinstall no advisory has caught for fourteen months

TOPHIT Part 2: Renting the Attack Surface

TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2

GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign

Articles in Threat Intelligence

Critical CSRF Vulnerability in IBM CICS TX - CVE-2023-42027 Demands Immediate Action

CVE-2023-43792 baserCMS is a website development framework vulnerable to Code Injection attacks

CVE-2023-4197 Vulnerability in Dolibarr ERP CRM 18.0.1 Allows PHP Code Injection

Hoze shell script dropped along with XMRig miners on misconfigured SSH Servers by Brute Forcing

3,20,000+ Patient Records From Ayush Jharkhand Gov. In Shared On Dark Web Hacking Forums

Rogue Scripts Are Exploiting OTP Verification APIs To Send Heaps of OTP SMSes, Hold The Potential Of Triggering Service Disruptions.

Join 10,000+ subscribers