🔗 Related IoCs could be found on GitHub:
github.com/cert-orangec...

☣ The main lure deploys a full Python environment and runs a Python script responsible for fetching the next stage from a remote C2. Then it opens a decoy file in Word. C2 are now inactive but have been tied to Pure malware family.

✉ The campaigns are initiated from the legitimate noreply[@]appsheet.com address and deliver various payloads, with lures targeting corporate sales, marketing, and legal teams. We advise to hunt for emails from this sender.

✨ AppSheet is a Google platform that enables no-code development of mobile, tablet, and web applications. Knowbe4, RavenMail, and MalwareHunterTeam have also previously mentioned such campaigns.
x.com/i/web/status...
ravenmail.io/blog/appshee...
blog.knowbe4.com/impersonatin...

The new version has removed these notable behaviours and is seen in campaign with fake invoices lures. New indicators of compromise (IoCs) are available on our GitHub: github.com/cert-orangec...

🤖These detection opportunities were presented during the Botconf 2025: www.botconf.eu/wp-content/u...

⛪🔎Historically, new MintsLoader JS samples were easy to find because the obfuscation strings consistently used text from a book, Andrew Melville by William Morison.
The associated infrastructure could be tracked thanks to specific patterns and campaign IDs in the C2 URLs: archive.org/details/cu31...

Written in C++, #NailaoLocker is relatively unsophisticated and poorly designed. The ransomware uses the “.locked” extension. It is loaded through DLL search-order hijacking.

➡️The full article on the Green Nailao cluster is available here: orangecyberdefense.com/global/blog/...
➡️IOCs and Yara can be found on our GitHub: github.com/cert-orangec...

We provide a #Yara Rule to hunt for Edam Dropper, as well as related #Iocs and technical details, available on GitHub.
🤝The infection chain was also analyzed by @strikereadylabs.com last week, and could be tied to 🇷🇺 #Sandworm APT (low confidence).

strikeready.com/blog/ru-apt-...