Insights, news, education and announcements from PolySwarm

SOLYXIMMORTAL: A Python-Based Infostealer

Jan 23, 2026 1:25:13 PM / by The Hivemind posted in Threat Bulletin, credential theft, information stealer, keylogger, Python stealer, Discord C2, SolyxImmortal, screenshot capture

0 Comments

Verticals Targeted: None specified
Regions Targeted: None specified
Related Families: None

Executive Summary

SolyxImmortal is a Python-based information-stealing malware that functions as a persistent implant on Windows systems. It combines multiple surveillance capabilities into a single continuously running process. Collected data stages locally, compresses, and exfiltrates to Discord webhooks using HTTPS, with cleanup to reduce forensic traces while maintaining long-term access.

VoidLink: An Emerging Cloud-Focused Linux Malware Framework

Jan 20, 2026 1:03:14 PM / by The Hivemind posted in Threat Bulletin, C2 framework, Linux malware framework, cloud-native malware, Zig programming language, Linux rootkit, adaptive stealth, VoidLink malware, Chinese threat actors, container escape

0 Comments

Verticals Targeted: None confirmed
Regions Targeted: None confirmed
Related Families: None

Executive Summary

VoidLink represents an advanced, modular Linux malware framework developed with apparent Chinese affiliation, emphasizing cloud and container environments for stealthy, persistent access. Designed as a comprehensive post-exploitation tool with adaptive evasion and a plugin-based architecture, it remains in active development with no observed real-world deployments to date.

RustyWater: Muddy Water’s Rust-Based Implant

Jan 16, 2026 1:42:59 PM / by The Hivemind posted in Threat Bulletin, APT, Muddy Water, Spear Phishing, Rust Malware, Middle East targeting, RustyWater, RUSTRIC, Rust implant, Archer RAT

0 Comments

Verticals Targeted: Diplomatic, Maritime, Financial, Telecom
Regions Targeted: Middle East
Related Families: Archer RAT / RUSTRIC

Executive Summary

A spear-phishing campaign linked to the Muddy Water APT group was observed deploying a new Rust-based implant called RustyWater against organizations in the Middle East. This evolution from legacy PowerShell and VBS tooling introduces enhanced modularity, anti-analysis features, and asynchronous command-and-control capabilities.

Transparent Tribe Evolves Tradecraft With Multi-Stage LNK Malware

Jan 12, 2026 1:55:19 PM / by The Hivemind posted in Threat Bulletin, APT36, Spear Phishing, Remote Access Trojan, cyber espionage, LNK Malware

0 Comments

Verticals Targeted: Government, Academia
Regions Targeted: India
Related Families: None

Executive Summary

APT36, also known as Transparent Tribe, a Pakistan-aligned threat actor, has launched a targeted cyber espionage campaign against Indian governmental, academic, and strategic entities using sophisticated deception techniques. The operation delivers a multi-stage Remote Access Trojan (RAT) through a weaponized LNK file disguised as a PDF, enabling persistent access, surveillance, and data exfiltration with minimal detection risk. The campaign has targeted government, academic, and strategic entities in India.

Kimwolf Botnet Targeting Android TV Devices Worldwide

Jan 9, 2026 9:46:08 AM / by The Hivemind posted in Threat Bulletin, Evolving Threat, Android Malware, DDoS Attacks, Kimwolf botnet, IoT vulnerabilities, Aisuru variant

0 Comments

Verticals Targeted: Consumer Electronics, Residential Networks
Regions Targeted: Brazil, India, United States, Vietnam, Saudi Arabia, Russia, Argentina, South Africa, Philippines, Mexico, Thailand, Indonesia, Morocco, Turkey, Iraq, Pakistan, China
Related Families: Aisuru

Executive Summary

Security researchers have detailed the Kimwolf botnet, a massive Android-based network exceeding 1.8 million infected devices, primarily TV boxes, enabling DDoS attacks, proxy services, and other malicious activities through exploitation of residential proxy networks and device vulnerabilities. This threat demonstrates rapid growth and resilience, leveraging advanced evasion techniques to maintain control and monetize infections.

PolySwarm’s 2025 Year in Review

Jan 5, 2026 1:04:00 PM / by The Hivemind posted in Threat Bulletin, RedLine Stealer, Akira Ransomware, AsyncRAT trojan, VShell backdoor, 2025 malware trends, ransomware 2025, Cl0p ransomware, Qilin ransomware, SocGholish downloader, LummaStealer infostealer

0 Comments

Verticals Targeted: Multiple
Regions Targeted: Multiple
Related Families: Cl0p, Qilin, SocGholish, Akira, AsyncRAT, LummaStealer, RedLineStealer, VShell

Executive Summary

PolySwarm's 2025 Year in Review spotlights resilient malware that dominated the threat landscape and nation-state espionage from the Big Four. React2Shell (CVE-2025-55182) emerged as the top vulnerability, while AI-driven attacks defined the year's paradigm shift.