في عالم الأمن السيبراني، ما يظهر على السطح ليس سوى جزء ضئيل من الحقيقة. خلف الكواليس، في أروقة المنتديات المغلقة، أسواق الويب المظلم، وقنوات التيليجرام السرية، تتطور أدوات التجسس، الاختراق، وسرقة البيانات بوتيرة متسارعة.
من هنا تنطلق CyberTrace (@CyberTrace20):
منصة متخصصة في استخبارات التهديدات السيبرانية (Cyber Threat Intelligence - CTI) وبحوث البرمجيات الخبيثة (Malware Research).
━━━━━━━━━━━━━━━━━━
🎯 فلسفتنا الثابتة:
> «نحن لا نروج للأداة، ولا نبيعها، ولا نوفرها. نحن نتتبعها، نفهمها، ونشرح أثرها.»
نحن نرفض نقل ادعاءات البائعين ومروجي البرمجيات الخبيثة كحقائق مسلم بها؛ دورنا هو تفكيك الادعاءات، استخراج الحقائق التقنية، وتحويلها إلى وعي دفاعي قابل للتطبيق.
━━━━━━━━━━━━━━━━━━
مصدر بيانات
يقتصر على مواقع أمنيه
متلا مكروسوفت .... و تحليلات فريقنا لا نرغب في ذكر مصادر بيانات كل ادات و مصادر حصول على نسخه التي قمنا بدراستها لأسباب أمنيه
01 |
سلسلة تحليلات مكثفة ترصد وتفكك أبرز 50 تهديداً وبرمجية خبيثة نشطة في عام 2026 (RATs, Infostealers, Loaders, Botnets, Ransomware)، من الكلاسيكيات المستمرة وحتى البرمجيات المستعينة بالذكاء الاصطناعي.
02 |
فصل كامل بين ما يزعمه المهاجمون، وما ترصده كبرى مراكز أبحاث التهديدات العالمية، وما تم التحقق منه فعلياً.
03 |
علامات الاشتباه، سلوك البرمجيات في الذاكرة، خطوات الاحتواء الفورية، وكيف تكتشف وتمنع اختراق أجهزتك ومؤسستك.
━━━━━━━━━━━━━━━━━━
هذه القناة تعليمية، بحثية، ودفاعية بحتة.
• لا نوفر روابط لتحميل برمجيات ضارة أو عينات حية.
• لا نوفر قنوات شراء أو تواصل مع مطوري الأدوات الخبيثة.
• لا ننشر شروحات تشغيلية لتنفيذ الهجمات.
هدفنا حماية الأنظمة ودعم الباحثين والمجتمع التقني بالمعرفة الدقيقة.
━━━━━━━━━━━━━━━━━━
للمناقشات التقنية، تبادل الآراء، وتحليل الحوادث، انضموا إلى مجموعتنا الرسمية:
[CyberTrace Accidents]
t.me/Discussion_Section10
━━━━━━━━━━━━━━━━━━
#CyberTrace20
Please open Telegram to view this post
VIEW IN TELEGRAM
👎1😁1
🔴 CYBERTRACE // THREAT FILE #001
🦠 AsyncRAT
[Remote Access Trojan (RAT) • Commodity Malware]
━━━━━━━━━━━━━━━━━━
⚠️ STATUS
Highly Active & Extensively Circulated in 2026
🧪 CYBERTRACE LAB ASSESSMENT
Status: ⚠️ Tested Previous Version
(The family was previously analyzed in our isolated lab; modern evasive variants remain under active surveillance)
━━━━━━━━━━━━━━━━━━
01 | TECHNICAL PROFILE
• Language: C# (.NET Framework)
• Architecture: Encrypted Client-Server model operating over TLS.
• Command & Control (C2): Custom or self-signed digital certificates (CN=AsyncRAT Server). Observed heavily exploiting trusted cloud tunnels (e.g., Cloudflare Tunnels, WebDAV) in 2026 campaigns to bypass firewall egress filtering.
• Core Capabilities: Keystroke logging, screen/webcam surveillance, audio eavesdropping, and process injection into legitimate system processes (e.g., explorer.exe).
• Modern Evasion: Leveraging embedded micro-Python environments and fileless PowerShell stagers to execute payloads entirely in-memory without touching disk.
02 | WHAT CAN IT DO?
• Credential Harvesting: Extracts saved browser passwords, session cookies, and login tokens from browsers and mail clients.
• Full Remote Control: Executes system shell commands (CMD / PowerShell), uploads/downloads sensitive files, and manages active processes.
• Covert Surveillance: Silently captures audio, webcam feeds, and desktop screenshots without alerting the victim.
• Secondary Malware Vector: Acts as a staging loader to drop ransomware, info-stealers, or cryptocurrency address clippers.
03 | HOW TO SPOT INFECTION?
• Abnormal Processes: Unsolicited background powershell.exe or python.exe instances consuming abnormal CPU resources.
• Suspicious Egress Traffic: Persistent outbound encrypted connections toward temporary cloud tunnel domains over unusual ports.
• Persistence Artifacts: Unrecognized scripts or shortcuts placed in the Windows Startup directory or Registry Run keys.
• EDR / AV Alerts: Security detections flagging memory tampering or unauthorized code injection into explorer.exe.
04 | MITIGATION & RESPONSE
• Immediate Isolation: Instantly disconnect the infected machine from local networks and the internet. While AsyncRAT lacks native self-spreading capabilities, attackers frequently deploy secondary tooling for internal lateral movement.
• Terminate Active Sessions: Force-revoke all active cloud and browser sessions immediately; stolen session cookies grant attackers instant access, effectively bypassing Multi-Factor Authentication (MFA).
• Credential Reset: Rotate all exposed passwords, API tokens, and access keys from a separate, clean, and trusted machine.
• Forensic Removal: Perform deep memory triage to eliminate injected payloads and persistence keys, or re-image the system for complete remediation.
05 | THREAT ACTOR PROFILE & OPERATIONAL SCOPE
AsyncRAT is predominantly deployed in direct, targeted campaigns and boutique intrusion operations. Operators typically favor smaller, stealthy botnet clusters—actively managing 30 to 40 infected targets per C2 panel at a time—allowing meticulous manual reconnaissance and high-value data harvesting without triggering broad threat hunting telemetry.
06 | WHY TRACK IT IN 2026?
Despite its age, AsyncRAT remains the go-to open-source RAT for cybercriminals due to its modular codebase and rapid adaptation to modern cloud-tunnel evasion tactics, consistently placing it at the top of SOC incident queues.
━━━━━━━━━━━━━━━━━━
#AsyncRAT
#CyberTrace20
#RAT
🦠 AsyncRAT
[Remote Access Trojan (RAT) • Commodity Malware]
━━━━━━━━━━━━━━━━━━
⚠️ STATUS
Highly Active & Extensively Circulated in 2026
🧪 CYBERTRACE LAB ASSESSMENT
Status: ⚠️ Tested Previous Version
(The family was previously analyzed in our isolated lab; modern evasive variants remain under active surveillance)
━━━━━━━━━━━━━━━━━━
01 | TECHNICAL PROFILE
• Language: C# (.NET Framework)
• Architecture: Encrypted Client-Server model operating over TLS.
• Command & Control (C2): Custom or self-signed digital certificates (CN=AsyncRAT Server). Observed heavily exploiting trusted cloud tunnels (e.g., Cloudflare Tunnels, WebDAV) in 2026 campaigns to bypass firewall egress filtering.
• Core Capabilities: Keystroke logging, screen/webcam surveillance, audio eavesdropping, and process injection into legitimate system processes (e.g., explorer.exe).
• Modern Evasion: Leveraging embedded micro-Python environments and fileless PowerShell stagers to execute payloads entirely in-memory without touching disk.
02 | WHAT CAN IT DO?
• Credential Harvesting: Extracts saved browser passwords, session cookies, and login tokens from browsers and mail clients.
• Full Remote Control: Executes system shell commands (CMD / PowerShell), uploads/downloads sensitive files, and manages active processes.
• Covert Surveillance: Silently captures audio, webcam feeds, and desktop screenshots without alerting the victim.
• Secondary Malware Vector: Acts as a staging loader to drop ransomware, info-stealers, or cryptocurrency address clippers.
03 | HOW TO SPOT INFECTION?
• Abnormal Processes: Unsolicited background powershell.exe or python.exe instances consuming abnormal CPU resources.
• Suspicious Egress Traffic: Persistent outbound encrypted connections toward temporary cloud tunnel domains over unusual ports.
• Persistence Artifacts: Unrecognized scripts or shortcuts placed in the Windows Startup directory or Registry Run keys.
• EDR / AV Alerts: Security detections flagging memory tampering or unauthorized code injection into explorer.exe.
04 | MITIGATION & RESPONSE
• Immediate Isolation: Instantly disconnect the infected machine from local networks and the internet. While AsyncRAT lacks native self-spreading capabilities, attackers frequently deploy secondary tooling for internal lateral movement.
• Terminate Active Sessions: Force-revoke all active cloud and browser sessions immediately; stolen session cookies grant attackers instant access, effectively bypassing Multi-Factor Authentication (MFA).
• Credential Reset: Rotate all exposed passwords, API tokens, and access keys from a separate, clean, and trusted machine.
• Forensic Removal: Perform deep memory triage to eliminate injected payloads and persistence keys, or re-image the system for complete remediation.
05 | THREAT ACTOR PROFILE & OPERATIONAL SCOPE
AsyncRAT is predominantly deployed in direct, targeted campaigns and boutique intrusion operations. Operators typically favor smaller, stealthy botnet clusters—actively managing 30 to 40 infected targets per C2 panel at a time—allowing meticulous manual reconnaissance and high-value data harvesting without triggering broad threat hunting telemetry.
06 | WHY TRACK IT IN 2026?
Despite its age, AsyncRAT remains the go-to open-source RAT for cybercriminals due to its modular codebase and rapid adaptation to modern cloud-tunnel evasion tactics, consistently placing it at the top of SOC incident queues.
━━━━━━━━━━━━━━━━━━
#AsyncRAT
#CyberTrace20
#RAT
❤2
🔴 CYBERTRACE // THREAT FILE #002
⚡️ Dolphin X
[AI-Powered RAT • Advanced InfoStealer (MaaS)]
━━━━━━━━━━━━━━━━━━
⚠️ Status
Active and commercially traded on dark web markets (first detected mid-2026).
🧪 CyberTrace Team Analysis
Status: ⚠️ Previous version tested
(The control panel and mutation engine were analyzed in a lab setting; cloud-based updates are under continuous monitoring). Reverse-engineering suggests this is a sophisticated tool—far more than just a typical Telegram post—so we are providing a concise summary here.
━━━━━━━━━━━━━━━━━━
01 | Technical Details
• Programming Language: C++ with advanced cloud architecture.
• Architecture: Desktop control panel (Operator Client) managing 329 features across 10 categories, powered by a Cloud Mutation Engine.
• Command & Control (C2): Encrypted HTTPS communication with a remote build server (e.g.,
• Targeting Scope: Built-in capability to steal data from over 300 applications and 165 digital wallets, as well as extract SSH keys, cloud tokens, and development environment variables (
• Standout Feature (AI Profiler): Integration of a behavioral AI model that analyzes installed software and browsing activity to assess "victim value" and generate daily reports ranking victims by priority. 02 | What can it do?
• Compromising corporate cloud infrastructure: Stealing AWS and Azure keys, GitHub data, and DevOps tokens from developers' machines to gain full access to the production environment.
• Draining cryptocurrency assets: Exfiltrating data from 65 desktop wallets and over 100 browser extensions (such as MetaMask and Phantom).
• Stealthy control (HVNC & RAT): Initiating hidden desktop control sessions, executing system commands, and extracting files without alerting the victim.
• Automated target triage: Using AI to automatically sort through thousands of infections to identify devices belonging to managers and engineers, as well as high-value trading accounts.
03 | How do I know if I might be a target?
• Suspicious scanning of code-related files: Sudden read and aggregation activity targeting sensitive directories like
• Outbound connections via non-standard ports: Detecting encrypted traffic leaving the system toward specific ports (e.g., 8443) and unfamiliar domains.
• Invisible execution indicators: Running the
• Temporary archive creation: Detecting the creation of a single temporary compressed archive within "Temp" directories—containing cookies and wallet data—prior to exfiltration.
04 | What should I do? hhhhhhh, it’s funny—especially when dealing with this type of malware. But here’s some advice: disconnect the device from the network, change all your account passwords, log out of all previous sessions, and wipe the device (format it).
05 | Operator Scope and Targeting Profile
The software is distributed via a Malware-as-a-Service (MaaS) model, with subscriptions starting at around €70 per month offered by the vendor "Kontraktnik." Operators specifically target developers, DevOps engineers, cloud administrators, and cryptocurrency traders, leveraging artificial intelligence to pinpoint high-value targets with extreme precision.
06 | Why Monitor It in 2026?
Dolphin X represents a genuine shift in the weaponization of cybercrime through AI in 2026. Instead of getting bogged down in managing thousands of random victims, the software automatically classifies and selects targets for compromise; this makes the risk of it infiltrating developer systems a catastrophic threat to any organization.
━━━━━━━━━━━━━━━━━━
#DolphinX
#CyberTrace20
#Spyware
⚡️ Dolphin X
[AI-Powered RAT • Advanced InfoStealer (MaaS)]
━━━━━━━━━━━━━━━━━━
⚠️ Status
Active and commercially traded on dark web markets (first detected mid-2026).
🧪 CyberTrace Team Analysis
Status: ⚠️ Previous version tested
(The control panel and mutation engine were analyzed in a lab setting; cloud-based updates are under continuous monitoring). Reverse-engineering suggests this is a sophisticated tool—far more than just a typical Telegram post—so we are providing a concise summary here.
━━━━━━━━━━━━━━━━━━
01 | Technical Details
• Programming Language: C++ with advanced cloud architecture.
• Architecture: Desktop control panel (Operator Client) managing 329 features across 10 categories, powered by a Cloud Mutation Engine.
• Command & Control (C2): Encrypted HTTPS communication with a remote build server (e.g.,
backend.thedolphinx[.]top:8443); configuration settings are sent to compile the executable and alter its cryptographic signature before delivery to the attacker.• Targeting Scope: Built-in capability to steal data from over 300 applications and 165 digital wallets, as well as extract SSH keys, cloud tokens, and development environment variables (
.env).• Standout Feature (AI Profiler): Integration of a behavioral AI model that analyzes installed software and browsing activity to assess "victim value" and generate daily reports ranking victims by priority. 02 | What can it do?
• Compromising corporate cloud infrastructure: Stealing AWS and Azure keys, GitHub data, and DevOps tokens from developers' machines to gain full access to the production environment.
• Draining cryptocurrency assets: Exfiltrating data from 65 desktop wallets and over 100 browser extensions (such as MetaMask and Phantom).
• Stealthy control (HVNC & RAT): Initiating hidden desktop control sessions, executing system commands, and extracting files without alerting the victim.
• Automated target triage: Using AI to automatically sort through thousands of infections to identify devices belonging to managers and engineers, as well as high-value trading accounts.
03 | How do I know if I might be a target?
• Suspicious scanning of code-related files: Sudden read and aggregation activity targeting sensitive directories like
.ssh and .aws, as well as software project paths.• Outbound connections via non-standard ports: Detecting encrypted traffic leaving the system toward specific ports (e.g., 8443) and unfamiliar domains.
• Invisible execution indicators: Running the
explorer.exe process within a virtual desktop that is not visible in the standard display environment.• Temporary archive creation: Detecting the creation of a single temporary compressed archive within "Temp" directories—containing cookies and wallet data—prior to exfiltration.
04 | What should I do? hhhhhhh, it’s funny—especially when dealing with this type of malware. But here’s some advice: disconnect the device from the network, change all your account passwords, log out of all previous sessions, and wipe the device (format it).
05 | Operator Scope and Targeting Profile
The software is distributed via a Malware-as-a-Service (MaaS) model, with subscriptions starting at around €70 per month offered by the vendor "Kontraktnik." Operators specifically target developers, DevOps engineers, cloud administrators, and cryptocurrency traders, leveraging artificial intelligence to pinpoint high-value targets with extreme precision.
06 | Why Monitor It in 2026?
Dolphin X represents a genuine shift in the weaponization of cybercrime through AI in 2026. Instead of getting bogged down in managing thousands of random victims, the software automatically classifies and selects targets for compromise; this makes the risk of it infiltrating developer systems a catastrophic threat to any organization.
━━━━━━━━━━━━━━━━━━
#DolphinX
#CyberTrace20
#Spyware
🔥2
CyberTrace pinned «⭐️ أهلاً بكم في CYBERTRACE // البداية في عالم الأمن السيبراني، ما يظهر على السطح ليس سوى جزء ضئيل من الحقيقة. خلف الكواليس، في أروقة المنتديات المغلقة، أسواق الويب المظلم، وقنوات التيليجرام السرية، تتطور أدوات التجسس، الاختراق، وسرقة البيانات بوتيرة متسارعة.…»