Company
Cybersecurity firm providing threat intelligence, digital forensics, and incident response, tracking cybercrime groups and malware worldwide.
Group-IB found a public reference to a KGB RAT server at version 0.1 from January 2022, years before the trojan went on sale from $150 a month. Group-IB says the "administration tool" pitch covers a surveillance and control toolkit.
Reality
Hunt.io found that BraZetsu's servers had moved hosts months before Group-IB's August 31 report named them. Defenders who block only the published addresses are pointing at infrastructure the operators had already abandoned.
Reality
Group-IB found the Telegram channel in ASOS's October 6 rogue push alert was opened that day by an account once used for gaming-item trading. Until data surfaces, the Snowflake claim is unproven and the abused messaging platform is the lead to work.
Reality
Group-IB tied the Milk Dragon phishing kit to 258 phishing pages and victims in 66 countries, baited with fake discounts posted on Facebook and TikTok. An operator then relays the victim's own 3D Secure code to approve the fraudulent charge.
Reality
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishersReality
Investigators say KillSec, tied to about 1,000 suspected attacks, got in through software flaws, weak cloud storage and logins bought on the dark web. Those gaps sit in victims' own systems, beyond the reach of any server seizure.
Reality
Group-IB says the RemControl Android banking trojan reaches bank customers in six countries and the Middle East via Meta ads and fake Google Play pages. Its server address sits in a Telegram dead-drop, so the operator can move infrastructure without a new build.
Perspective Coverage
4 publishersReality
Group-IB says a 13-minute call ended with a loan in the victim's name and card data streaming to a fake merchant terminal, every transaction approved with the victim's own PIN.
Perspective Coverage
3 publishersReality
Group-IB says a second app sets up the work profile within minutes of infection and clones a fake bank app into it, so the malware check inside that app looks at an empty room while the trojan runs in the personal space.
Perspective Coverage
3 publishersReality
Group-IB says the Iran-linked leak-and-brag front Handala Hack runs HEAVYGRAM, a Python implant that takes orders from a Telegram bot, opens the microphone and lifts saved passwords after a loader writes Defender exclusions for it.
Perspective Coverage
9 publishersReality
The malware asks for accessibility, then has a second component build a work profile and copy the bank app into it. Group-IB says the clone registers with the bank as a new device while a black screen hides the transfer.
Reality
Group-IB puts the Qilin affiliate cut at up to 80 percent, and KELA logged a change that routes victim payments through affiliate wallets first, which says more about the operation's incentives than its thin public tradecraft record does.
Reality
Group-IB says the phishing kit Google sued over in June kept producing pages after the FBI seized its admin servers and wallets, which puts the durable detection signal in the kit's file names rather than its hosts.
Reality
Group-IB says the Exilware crew built BraZetsu to score compromised Iberian and Latin American machines by value and sell entry to whoever wants to run their own payload, which changes how a stealer alert should be triaged.
Reality
Sophos CTU reviewed 15 intrusions by GOLD SHERWOOD affiliates and found the same route each time: a working credential on a Fortinet SSL VPN with no MFA, then RDP into domain controllers within hours.
Reality
Group-IB says it found Tortoiseshell infrastructure on British IPs, plus Belgium, Saudi Arabia and the UAE. It also says the server names alone do not prove who was being targeted.
Perspective Coverage
3 publishersReality
Kaspersky says an Iranian-linked framework now picks its channel per transaction from a DNS record, and can swap the Google relay behind it. Allowlisted SaaS domains carry the traffic.
Reality