ThreatCure

ThreatCure Leading organizations rely on us to protect and empower their operations.

ThreatCure™, a Sigmatekk LLC subsidiary, is a trusted global cybersecurity partner providing outcome-based security for industries including IT, finance, healthcare, and technology.

Automated scanning. Stolen credentials. Hybrid tools for data theft.That is where Chinese state-linked cyber threat acto...
09/10/2026

Automated scanning. Stolen credentials. Hybrid tools for data theft.

That is where Chinese state-linked cyber threat actors become particularly dangerous.

Enabled by the Integrity Technology Group, the campaign combines automated vulnerability scanning, extensive botnets and hands-on exploitation to infiltrate critical infrastructure organizations and steal sensitive data.

The attack chain involves tools like MicroScan, Nmap and dirsearch to identify network weaknesses, followed by exploitation techniques such as cross-site scripting (XSS), password spraying against Microsoft Exchange, renamed VPN clients like SoftEther, and DCSync attacks to harvest Active Directory credentials. Once inside, attackers use custom scripts to collect, compress and exfiltrate email data to attacker-controlled infrastructure.

The impact goes beyond data theft. Persistent unauthorized access, widespread credential harvesting and Active Directory compromise can give attackers a foothold deep inside an organization's environment, making detection and containment significantly harder.

Our latest Cyber Threat Advisory breaks down the attack techniques, affected platforms, potential impact and defensive measures organizations should prioritize.

Read the full advisory:
https://threatcure.net/api/pdf/tc-ti-advisory-124-chinese-state-actors-hybrid-tools-for-data-theft.pdf

Read the full blog:
https://threatcure.net/blogs/article/?article=the-silent-exfiltration-how-chinese-state-actors-use-hybrid-tools-to-steal-enterprise-data

05/10/2026

POV: You came to work and accidentally got front-row seats to the office tea.

The tea was indeed very hot…

A trusted application. A malicious DLL. An encrypted payload.That is where NeedyMantis gets interesting.Tracked in the a...
02/10/2026

A trusted application. A malicious DLL. An encrypted payload.

That is where NeedyMantis gets interesting.

Tracked in the advisory as activity associated with the suspected China-nexus threat actor Storm-3069, NeedyMantis is designed to maintain persistent access inside already-compromised networks. Its attack chain uses post-compromise lateral movement, legitimate applications, DLL sideloading, encrypted payloads, HTTPS/WebSocket C2 communication and modular payload loading, allowing malicious activity to blend into trusted software and processes.

The threat has targeted telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors, with the activity also linked to the supply-chain compromise involving DAEMON Tools.

Our latest Cyber Threat Advisory breaks down the attack chain, network and file-based IOCs, impact and recommended defensive actions.

Read the full advisory:
https://threatcure.net/api/pdf/tc-ti-advisory-123-needymantis-malware-dll-sideloading-and-long-term-network-persistence.pdf

Read the full blog:
https://threatcure.net/blogs/article/?article=needymantis-malware-how-dll-sideloading-can-hide-long-term-network-persistence

A trusted security gateway can become the first step into an entire network.Our latest Cyber Threat Advisory examines a ...
28/09/2026

A trusted security gateway can become the first step into an entire network.

Our latest Cyber Threat Advisory examines a targeted campaign against broadband providers, including Thailand’s 3BB and Jasmine networks, involving FortiGate SSL VPN exploitation, privilege escalation, MeshCentral-based persistence, web shells, and lateral movement toward RADIUS authentication databases.

What makes this campaign especially concerning is the attack chain.

Initial access. Privilege escalation. Persistence. Internal reconnaissance. Lateral movement. Credential targeting.

Each stage created another opportunity for the attackers to expand their control.

The advisory breaks down how the attack unfolded, the technologies involved, the potential impact, and the indicators and defensive measures organizations should be watching for.

Read the full Cyber Threat Advisory:

https://threatcure.net/api/pdf/tc-ti-advisory-122-thai-broadband-3bb-breach-fortigate-ssl-vpn-exploitation.pdf

Read the detailed analysis:

https://threatcure.net/blogs/article/?article=thai-broadband-3bb-breach-how-fortigate-ssl-vpn-exploitation-could-enable-network-takeover

WHAT IF A WEBSITE YOU VISIT COULD REACH INTO YOUR WHATSAPP WEB SESSION?That sounds impossible.Your WhatsApp messages are...
25/09/2026

WHAT IF A WEBSITE YOU VISIT COULD REACH INTO YOUR WHATSAPP WEB SESSION?

That sounds impossible.

Your WhatsApp messages are protected. Your browser has security boundaries. You haven’t downloaded malware. You haven’t given anyone your password.

So how could a malicious website potentially access information from an already authenticated WhatsApp Web session?

A recently disclosed vulnerability in the Adobe Acrobat Chrome extension, tracked as CVE-2026-48294, showed exactly why browser extensions deserve more attention.

The vulnerability, dubbed HermeticReader by Guardio Labs, could allow a malicious webpage to abuse the extension’s privileged browser access and reach data associated with a victim’s WhatsApp Web session. The affected versions were 26.5.2.2 and earlier, and Adobe has since released a fix.

What makes this case particularly interesting isn't just the vulnerability itself.

It's the attack path.

The attacker doesn't necessarily need to break WhatsApp.

They can target something sitting between the browser and the services you already trust.

That raises a much bigger security question:

How much access do the browser extensions on your device actually have?

And what happens when one of those trusted extensions becomes the bridge between a malicious webpage and sensitive information?

We've broken down the vulnerability, how the attack chain worked, who could be affected, and what organizations and users should do about it.

Read the full Advisory:

https://lnkd.in/dD-UB8qe

Read the full Blog:

https://lnkd.in/dGpMgk-u

Because sometimes the weakest link isn't the website you're visiting.

It's the trusted software already sitting inside your browser.

A website can look completely legitimate and still be the first step into something malicious.You click a familiar link....
24/09/2026

A website can look completely legitimate and still be the first step into something malicious.

You click a familiar link. The page loads normally. Nothing looks suspicious.

But what happens behind that page can be very different.

Attackers can use traffic distribution systems, compromised websites, malicious advertisements, and other techniques to identify visitors and selectively redirect them to fake login pages, financial scams, malicious downloads, or other harmful destinations.

The important lesson is simple:

What you see is not always where your traffic is actually going.

Cybersecurity is not just about blocking obviously malicious websites. It is about understanding what happens behind trusted-looking activity and detecting when normal behavior starts telling a different story.

Swipe through the carousel to see how this attack chain works and what you can do to reduce the risk.

You deleted the file. But did you actually destroy the data?One of the easiest cybersecurity assumptions to make is that...
21/09/2026

You deleted the file. But did you actually destroy the data?

One of the easiest cybersecurity assumptions to make is that once a file disappears from your screen, the information is gone with it.
It isn't always that simple.

Deleting a file and securely sanitizing storage media are two different things. NIST's current media sanitization guidance, SP 800-88 Rev. 2, defines sanitization as a process intended to make access to the target data infeasible at an appropriate level of effort.

CISA makes the distinction even more directly: simply deleting a file does not completely erase it.

This becomes particularly important when devices containing sensitive business information are being reused, transferred, retired, or disposed of.

The bigger lesson?

Visibility isn't the same as destruction.
A file disappearing from a folder tells you what the operating system is showing you. It doesn't, by itself, establish that the underlying information has been securely sanitized.

A browser extension can be more than a convenience. It can become an access point.A malicious Twitch browser extension w...
17/09/2026

A browser extension can be more than a convenience. It can become an access point.

A malicious Twitch browser extension was found exposing authentication tokens belonging to nearly 31,000 users, sending them to proxy servers controlled by the extension operator.

Authentication tokens are particularly sensitive because they can allow applications to access an account without repeatedly asking for a password.


The bigger takeaway for organizations and individuals is simple:

Trusting an application also means trusting what it can access.

Before installing a browser extension, consider more than its features. Review its permissions, understand what data it can access, and question whether those permissions are actually necessary.

Because sometimes, the weakest link isn't the website.

It's what we've allowed into the browser.

TukTuk is more than another piece of malware. It is built to help attackers take control of an environment before ransom...
14/09/2026

TukTuk is more than another piece of malware. It is built to help attackers take control of an environment before ransomware ever gets deployed.

ThreatCure’s latest Cyber Threat Advisory examines TukTuk, a command-and-control remote-control framework associated with “The Gentlemen” ransomware operators.

What makes it particularly concerning is how many stages of an attack it can support.

TukTuk can infiltrate systems through DLL sideloading, including the abuse of the legitimate Greenshot.exe application to load a malicious log4net.dll.

Once active, it provides threat actors with remote monitoring capabilities through a centralized operator panel. It can also display a spoofed Windows Security prompt designed to harvest user credentials.

But the bigger concern comes before the ransomware.

TukTuk is described as a staging ground for ransomware operations, incorporating defense-evasion capabilities such as EDRKiller and WarsawKiller, alongside Bring Your Own Vulnerable Driver (BYOVD) techniques that can be used to shut down security protections.

That creates an important defensive lesson:

Ransomware detection cannot be the only objective.

The activity leading up to ransomware matters too.

A trusted application loading an unexpected DLL.

A suspicious authentication prompt.

An attempt to terminate security processes.

A vulnerable driver appearing where it shouldn't.

An endpoint communicating with unfamiliar infrastructure.

These signals may look separate at first.

Together, they can reveal an attack taking shape.

The advisory includes the identified IPs, domain, file hashes, filenames, and recommended hunting and remediation actions for defenders investigating TukTuk-related activity.

The question isn't only whether you can detect ransomware.

Can you detect what happens before it?

Read the full Cyber Threat Advisory:

→https://threatcure.net/pdfs/TC-TI%20Advisory%20-%200120%20-%20Malware%20IOCs%20-%20TukTuk.pdf

THE PASSWORD WASN’T STOLEN. THE LOGIN PATH WAS.This Dropbox breach is a good example of why cybersecurity isn't always a...
10/09/2026

THE PASSWORD WASN’T STOLEN. THE LOGIN PATH WAS.

This Dropbox breach is a good example of why cybersecurity isn't always about cracking passwords.

Around 5,000 Dropbox accounts were accessed between August 4 and August 21 after attackers exploited a weakness involving Lenovo ID and a legacy Dropbox login integration. Files were viewed or downloaded from fewer than one-third of the affected accounts.

But what actually happened?

First, attackers could register a Lenovo ID using a victim's email address because of an issue with Lenovo's email-verification process.

Then came the important part.

Dropbox had a legacy integration that allowed users to sign in through Lenovo ID.

SSO — Single Sign-On — is designed to make login easier. Instead of entering separate credentials for every service, a trusted identity provider can authenticate you and tell another service that you've already been verified.

That's convenient when the trust is legitimate.

In this case, that trust was abused.

The fraudulent Lenovo identity could be used through the Lenovo login path to reach the corresponding Dropbox account without requiring the Dropbox password.

And that's the part worth remembering.

The attacker didn't have to defeat Dropbox's password.

They found another identity that Dropbox already trusted.

This is why third-party authentication deserves the same attention as passwords, MFA, and access controls.

Organizations need to know:

Which identity providers can access their systems?

Which applications trust them?

Are those relationships still necessary?

And what exactly does one system accept as proof from another?

Because a secure login isn't just about who you trust.

It's also about what you trust them to prove.

Would your organization know every trusted path into its most important systems?

Address

Gulistan E Johar Nisar Manzil
Karachi

Website

Alerts

Be the first to know and let us send you an email when ThreatCure posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category