06-January-2026
Welcome to the weekly threat detection update report from Stamus Networks. Each week, you will receive this email with a summary of the updates.
Current Stamus Threat Intelligence (STI) release version: 1536
This week, in addition to daily ruleset and IOC updates, we provided Stamus Security Platform customers with the following improved defense(s):
Note: a "method" as referenced below, is a discrete detection vector for a given threat.
The following detections were added to your Clear NDR this past week:
The following detections were updated this past week with changes to kill chain phase(s) or MITRE ATT&CK tactic(s)/technique(s):
APT33 is an Iranian threat group targeting organizations in the US, Saudi Arabia, and South Korea since 2013, with a focus on aviation and energy industries.
In April 2024, researchers found compromised sites leading to an iframe on pley[.]es showing an error message. The payload domain was taken offline, preventing infection. Later, the iframe was replaced with the ClearFake inject.
GachiLoader is obfuscated Node.js malware used to deploy additional payloads. A new tracer tool helps analyze and deobfuscate this type of malware more efficiently, useful for researchers dealing with such threats.
Glupteba is a trojan virus distributed by cyber criminals through malicious ads on legitimate websites. It can install other malicious programs and should be removed immediately.
Lumma is a C-based information stealer sold on Russian underground forums and Telegram by LummaC since August 2022. It targets cryptocurrency wallets and has file grabber capabilities.
Mustang Panda is a China-based cyber threat actor observed since 2017, possibly operating since 2014. It targets government and non-government organizations in multiple countries like the U.S., Germany, and Myanmar.
Adversaries can abuse PowerShell for execution, discovery, and code running. Examples include Start-Process and Invoke-Command cmdlets, requiring administrator permissions for remote connections.
Added kill chain phase(s): delivery
Previously supported kill chain phase(s): actions on objectives, command and control, delivery, installation
MITRE ATT&CK added: T1105, T1027
Previously existing MITRE ATT&CK: T1071, T1027, T1105, T1041
Methods added: 3
Malwarebytes found a new social engineering toolkit that uses compromised websites to perform advanced fingerprinting checks and deliver the NetSupport RAT payload.
Stealc, introduced by actor Plymouth on underground forums, written in C, can steal data from web browsers, crypto wallets, email clients, and messaging apps, built on Vidar, Raccoon, Mars, and RedLine.
Info stealers gather sensitive data on infected computers to send to attackers, typically targeting online banking, social media, email, and FTP accounts. They use various methods including hooking browsers and keylogging.
Cyble research labs found a malware developer advertising a powerful Windows RAT on the dark web during a threat-hunting exercise.
The following threat detection(s) were improved this past week with new or updated threat methods.
| Name of threat | New coverage | Total coverage | Last updated | ||||
|---|---|---|---|---|---|---|---|
| New Detection methods | Kill chain phases | Protocols involved | Detection methods | Kill chain phases | Protocols involved | ||
| APT33 | 3 | command and control | dns, tls, http | 146 | command and control, delivery | dns, http, tcp, tls | 2025-12-31 |
| ClickFix | 5 | delivery | dns, tls, http | 251 | command and control, delivery, exploitation | dns, http, tls | 2026-01-01 |
| GachiLoader | 1 | delivery | http | 1 | delivery | http | 2025-12-31 |
| Glupteba | 2 | command and control | tls | 124 | command and control | dns, http, tcp, tls | 2025-12-31 |
| Lumma | 87 | command and control, actions on objectives | dns, tls, http | 7270 | actions on objectives, command and control, delivery, installation | dns, http, tls | 2026-01-03 |
| Mustang Panda | 3 | command and control | dns, tls, http | 265 | command and control, delivery | dns, http, tcp, tls | 2025-12-30 |
| Powershell | 3 | delivery | http | 70 | actions on objectives, command and control, delivery, installation | dns, http, tcp, tcp-pkt, tls | 2025-12-31 |
| SocGholish | 3 | command and control | dns, tls, http | 1984 | actions on objectives, command and control, delivery, exploitation, reconnaissance | dns, http, tcp, tcp-pkt, tls | 2026-01-01 |
| Stealc | 2 | delivery, command and control | http | 41 | command and control, delivery, exploitation | http | 2026-01-03 |
| Stealer and Exfiltration | 3 | actions on objectives | dns, tls, http | 503 | actions on objectives, command and control, delivery, exploitation, installation | dns, ftp, http, smtp, tcp, tcp-pkt, tls | 2025-12-31 |
| XWorm | 16 | command and control | tcp-pkt | 4313 | command and control, delivery | dns, http, tcp, tcp-pkt, tls | 2025-12-30 |
Technical support
Join the conversation on Discord
Follow us Twitter
Follow us on LinkedIn
Subscribe to our YouTube channel
Stamus Networks website
ABOUT STAMUS® NETWORKS
Stamus Networks is the global leader in Suricata-based network security and the creator of the innovative Clear NDR® system. Designed to close visibility gaps and reduce alert fatigue, Clear NDR transforms raw network traffic into actionable security insights with unmatched transparency, customization, and effectiveness. Trusted by leading financial institutions, government agencies, and battle-tested over 9 years in NATO’s largest cybersecurity exercises, Stamus Networks delivers proven, high-performance network detection and response solutions. Stamus empowers security teams – delivering clarity amidst complexity – with greater control, fewer false positives, faster response times, and a more responsive, open approach than legacy vendors.
© 2014-2025 Stamus Networks, Inc. All rights Reserved.
