DOUBLECUP LaaS Uses ClickFix and PNG Steganography to Drop RAT

Tue, 04 Aug 2026 13:07:50 +0000

Engineer — Learn: Novel multi-stage delivery abusing browser cache for steganographic PNG staging is worth understanding when evaluating endpoint controls and browser security policies, but no patch or configuration change is required today.
SOC/IR — Plan: Build or tune detections for ClickFix PowerShell execution patterns and anomalous PNG writes to browser cache directories; the CountLoader → DeviceManager RAT chain provides new TTPs to add to hunt playbooks this quarter.
Leader — Skip

China-Nexus JadeProx Deploys New TriBack Loader Against Gov/Healthcare

Fri, 24 Jul 2026 12:43:46 +0000

Engineer — Learn: A newly documented Windows loader from a China-nexus cluster, but no specific vulnerable software, patch, or configuration action is identified — useful for understanding adversary tradecraft in government and healthcare environments.
SOC/IR — Learn: Group-IB’s exposure of the JadeProx cluster and TriBack Loader provides actor-profile and malware-family context, but the summary lacks published IOCs or ATT&CK-mapped TTPs needed to build or tune detections immediately.
Leader — Learn: China-nexus targeting of government and healthcare sectors in Asia and Latin America is worth tracking for sector-risk awareness, but no vendor breach or imminent regulatory trigger warrants same-week leadership action.