Exploits

The Gentlemen: How GentleKiller Clears the Path to Encryption

The Gentlemen turns ransomware, data theft, and defense evasion into a managed service for affiliates, with cross-platform encryptors and a 90 percent revenue share.

MedusaHVNC: A Hidden Desktop That Steals Live Windows Sessions

MedusaHVNC is a newly uncovered hidden desktop malware family that gives operators access to live, logged-in browser sessions on a victim’s Windows device.

Inside OnyxC2: The New Stealer Targeting 210 Apps

Discover OnyxC2, the new malware-as-a-service stealer targeting 210 apps. Learn how it evades detection, steals credentials, and enables data theft.

Oracle Breach: What Happened and Why It Matters

The 2025 Oracle breach exposed millions of records across three separate incidents. Learn how attackers got in, which industries were hit, and how to protect your organization.

Venom Stealer Turns ClickFix Into a Full Exfiltration Pipeline

BlackFog analyzes Venom Stealer, a new MaaS infostealer that uses ClickFix delivery to launch an automated exfiltration pipeline covering credential theft, wallet cracking, and fund sweeping.

LotAI: How Attackers Weaponize AI Assistants for Data Exfiltration

What happens when attackers use your approved AI tools as a data exfiltration channel? New research reveals how the LotAI technique turns Copilot and Grok into covert C2 relays.

Steaelite RAT Enables Double Extortion Attacks from a Single Panel

Steaelite is a newly emerging RAT that unifies credential theft, data exfiltration, and ransomware in a single web panel, accelerating double extortion attacks.

Lotus C2 – A New C2 Framework Sold as a Cybercrime Kit

Learn how Lotus C2 enables credential theft, data exfiltration, and mass attacks, blurring red team and cybercrime lines.

GTG 1002: Claude Hijacked For The First AI Led Cyberattack

Anthropic’s Claude was manipulated into a cyber espionage campaign. See how it happened, why it matters, and how ADX can block machine-speed data theft.

New Matrix Push C2 Abuses Push Notifications to Deliver Malware

Investigating Matrix Push C2, a browser based command and control system that uses push notifications to deliver malware, run phishing campaigns, and steal data across platforms.

Clop’s New Extortion Wave Hits Oracle E-Business Suite

Clop exploited an Oracle E-Business Suite zero-day to steal data from major organizations. Here’s how it happened and what it means for supply-chain security.

Microsegmentation: Strengthening Network Security Against Zero Day Exploits

Find out why microsegmentation is an increasingly popular option for supporting zero trust networking approaches.