Insights, news, education and announcements from PolySwarm

ZionSiphon: OT-Focused Malware Highlights Emerging Risk to Water Infrastructure Systems

Apr 24, 2026 3:01:13 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Cobalt Strike, SystemBC, Emerging Threat, lateral movement, post-exploitation, enterprise compromise, GPO abuse, proxy malware, credential access, TheGentlemen

0 Comments

Verticals Targeted: Water, Critical Infrastructure
Regions Targeted: Israel

Executive Summary

ZionSiphon is an OT-focused malware sample designed to identify and interact with water treatment and desalination environments. It was used to target water treatment systems in Israel. Although the analyzed version appears partially non-functional, it demonstrates ICS-aware targeting, industrial protocol interaction, and politically motivated intent. The sample provides insight into evolving adversary interest in manipulating systems that underpin critical infrastructure operations.

Osiris Ransomware

Jan 30, 2026 12:41:59 PM / by The Hivemind posted in Threat Bulletin, Emerging Threat, Wasabi exfiltration, new ransomware family, Inc ransomware links, Poortry driver, BYOVD attack, Osiris ransomware, Rustdesk modification

0 Comments

Verticals Targeted: Food & Beverage
Regions Targeted: Southeast Asia
Related Families: Inc

SantaStealer

Dec 23, 2025 12:13:07 PM / by The Hivemind posted in Threat Bulletin, Infostealer, Malware-As-A-Service, Emerging Threat, Windows Malware, credential theft, information stealer, C language malware, SantaStealer

0 Comments

Verticals Targeted: Not specified
Regions Targeted: Not specified
Related Families: BluelineStealer, ChromElevator

Albiriox Android Malware

Dec 8, 2025 1:43:05 PM / by The Hivemind posted in Threat Bulletin, Emerging Threat, on-device fraud, overlay attacks, Android banking trojan, MaaS Malware, Mobile RAT, Android Overlay Attacks, Golden Crypt, Albiriox, Russian-speaking Threat Actors

0 Comments

Verticals Targeted: Financial, Cryptocurrency
Regions Targeted: Austria, Global
Related Families: None

AdaptixC2

Oct 20, 2025 4:00:36 PM / by The Hivemind posted in Threat Bulletin, Emerging Threat, PowerShell malware, AdaptixC2, post-exploitation framework, C2 framework, AI-generated malware

0 Comments

Verticals Targeted: Financial
Regions Targeted: Asia
Related Families: Fog Ransomware

Executive Summary

AdaptixC2, an open-source command-and-control framework, has emerged as a potent tool for threat actors, enabling file manipulation, data exfiltration, and covert network communication in attacks. Its modular design and AI-assisted deployment methods underscore the need for robust defenses to counter its evolving tactics.

CastleRAT

Sep 15, 2025 2:37:49 PM / by The Hivemind posted in Threat Bulletin, Malware-As-A-Service, Emerging Threat, Phishing Attacks, CastleLoader, Remote Access Trojan, TAG-150, CastleRAT, malware infrastructure, command-and-control, anti-detection services, network intelligence

0 Comments

Verticals Targeted: Not specified
Regions Targeted: US
Related Families: CastleLoader

PS1Bot Malware Framework

Aug 22, 2025 1:48:23 PM / by The Hivemind posted in Threat Bulletin, Emerging Threat, Evolving Threat, PS1Bot, malware campaign, information stealer, C# malware, malvertising, cryptocurrency wallet theft, keylogger, in-memory execution, persistence module

0 Comments

Verticals Targeted: Not specified
Regions Targeted: Not specified
Related Families: AHK Bot, Skitnet/Bossnet

Charon Ransomware Targets Middle East

Aug 18, 2025 1:56:06 PM / by The Hivemind posted in Threat Bulletin, Emerging Threat, Charon ransomware, Earth Baxia, APT techniques, process injection, anti-EDR, DLL sideloading, Middle East cyber attacks, public sector malware, aviation industry threats, ransomware defense

0 Comments

Verticals Targeted: Public Sector, Aviation
Regions Targeted: Middle East
Related Families: None

Executive Summary

Charon is a new ransomware family employing advanced APT-style techniques, targeting Middle Eastern public sector and aviation organizations with tailored ransom demands. Its sophisticated attack chain, including DLL sideloading and process injection, underscores the growing convergence of ransomware and APT tactics.

The PolySwarm Blog

ZionSiphon: OT-Focused Malware Highlights Emerging Risk to Water Infrastructure Systems

Executive Summary

Osiris Ransomware

SantaStealer

Albiriox Android Malware

AdaptixC2

Executive Summary

CastleRAT

PS1Bot Malware Framework

Charon Ransomware Targets Middle East

Executive Summary

Subscribe to Email Updates

Lists by Topic

Posts by Topic

Recent Posts

Join the Marketplace

For Enterprises and Businesses

For Security Experts and AV Companies