Discover the latest articles and insights on Dark Atlas
October 14, 2026
27 min read
Qilin ransomware combines file encryption with an affiliate operation that manages victims, ransom negotiations, and stolen-data publication. Different intrusion teams deploy its payloads, so identifying Qilin does not automatically identify the attacker or the method used to enter a network. This analysis examines a Rust-based Windows encryptor and the wider Qilin affiliate ecosystem. It covers ...
September 21, 2026
25 min read
The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. The analyzed sample hides its main payload inside a malformed APK. Its recovered code reveals 135 command labels covering screen capture, messaging, overlays, and device control. Executive ...
September 08, 2026
23 min read
Executive summary Hagaseca is an Android malware cluster associated with exposed Android Debug Bridge (ADB) services. This analysis examines the Hagaseca Android RAT loader known as THost9. RAT stands for remote access trojan. A RAT can let an attacker control an infected device remotely. The loader hides executable code inside an Android application package (APK). ...
September 01, 2026
28 min read
DragonForce is more than a ransomware name. It is a ransomware service ecosystem that affiliates can use to deploy different lockers and intrusion tools. This analysis focuses on one verified DragonForce Windows locker. The sample is a 32-bit Windows executable. It can encrypt local files, encrypt accessible SMB shares, remove shadow copies, stop selected processes, ...
June 24, 2026
38 min read
Executive Summary LoaderClient is a Minecraft-based malware loader linked to the WeedHack Malware-as-a-Service campaign. It is distributed as a malicious Minecraft Fabric mod and is designed to steal Minecraft session data, including display name, account UUID, and live Microsoft OAuth access tokens. What makes LoaderClient especially notable is its command and control architecture. Instead of ...
June 09, 2026
32 min read
Overview The enterprise threat landscape in 2026 has been reshaped by the rapid ascent of “The Gentlemen” — a Ransomware-as-a-Service (RaaS) operation tracked by Microsoft Threat Intelligence as Storm-2697 and by other security research firms under the alias LARVA-368. Since its emergence in mid-2025, this financially motivated syndicate has scaled faster than any other ransomware group on record, ...
May 25, 2026
15 min read
Payload ransomware is a Windows ransomware family that appends the .payload extension to encrypted files, drops RECOVER_payload.txt ransom notes, and uses ChaCha20 encryption with per-file Curve25519 ECDH key exchange. The sample also includes anti-forensics features such as ETW patching, VSS deletion, Windows Event Log clearing, and process/service termination. Key Takeaways Overview On 15 February 2026, ...
May 18, 2026
13 min read
PlugX (KorPlug) is a modular remote access trojan delivered in this campaign through an MSI-based DLL sideloading chain. In this sample,The installer drops a legitimate G DATA executable, a malicious AVK.dll sideloader, and an XOR-encrypted AVKTray.dat payload that ultimately loads a reflective PlugX DLL and establishes persistence. Key Takeaways Introduction A PlugX DLL sideloading campaign ...
May 13, 2026
17 min read
Phantom Stealer is a two-layer Windows infostealer attack chain that uses a malicious pdh.dll loader, process hollowing into jsc.exe, aggressive anti-analysis checks, browser and wallet theft, and a cryptocurrency clipper to steal credentials, financial data, and crypto-related assets while maintaining stealth and persistence. Key Takeaways Introduction A threat actor recently deployed Phantom Stealer, a carefully ...
