📃Title: “Say My Name”: How MioLab is building MacOS Stealer Empire
📅Date: 2026-03-20
🔗References:
https://www.levelblue.com/blogs/spiderlabs-blog/say-my-name-how-miolab-is-building-macos-stealer-empire

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="tool-profile"
• TA-category="Cybercrime"
• target="broad-based"
• detection-rules="sigma-from-src"
• detection-rules="snort-from-src"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
mitre-attack-pattern=['T1113', 'T1539', 'T1114', 'T1555.001', 'T1204.002', 'T1566.002', 'T1119', 'T1059.002', 'T1005', 'T1140', 'T1555.003', 'T1552.001', 'T1041', 'T1056.002', 'T1059.004', 'T1078', 'T1027', 'T1567.002', 'T1564.003', 'T1027.002', 'T1204']

MISP event uuid: 5b7c96e9-0252-4c03-bdd3-240bf79ec517

📃Title: A rigged game: compromises gaming platform in a supply-chain attack
📅Date: 2026-05-05
🔗References:
https://www.welivesecurity.com/en/eset-research/rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack/

🔖Rectifyq Taxonomies:
Relevancy: 🟡 Somewhat Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="ESET"
• threat-actor="APT37"
• target-information="China"
mitre-attack-pattern=['T1585', 'T1046', 'T1497', 'T1480.001', 'T1083', 'T1082', 'T1555', 'T1005', 'T1587.001', 'T1056', 'T1140', 'T1584.004', 'T1070.004', 'T1195.002', 'T1112', 'T1113', 'T1090', 'T1608.001', 'T1027', 'T1059.003', 'T1115', 'T1420', 'T1532', 'T1429', 'T1481.002', 'T1636.002', 'T1474.003', 'T1636.003', 'T1533', 'T1407', 'T1646', 'T1541', 'T1430', 'T1406', 'T1636.004', 'T1513', 'T1426', 'T1422', 'T1437.001']

MISP event uuid: db7f9dfd-de5e-49e9-93c9-ad0a6887cd52

📃Title: Lorem Ipsum Malware: Trojanized MS Teams Installers
📅Date: 2026-05-04
🔗References:
https://www.bluevoyant.com/blog/lorem-ipsum-trojanized-microsoft-teams-installers-multi-stage-loader-backdoor

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• target-information="United States"
mitre-attack-pattern=['T1583', 'T1587.001', 'T1564', 'T1140', 'T1195', 'T1055', 'T1608.002', 'T1584', 'T1102', 'T1608', 'T1583.006', 'T1547.001', 'T1588.002', 'T1562.001', 'T1584.006', 'T1027.004', 'T1071.001', 'T1518', 'T1102.001', 'T1127', 'T1592.003']

MISP event uuid: 7f88d213-40af-4515-80ca-76c2c7e04ded

📃Title: Breaking the code: Multi-stage 'code of conduct' phishing campaign leads to AiTM token compromise
📅Date: 2026-05-04
🔗References:
https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Microsoft"
• target-information="United States"
mitre-attack-pattern=['T1557', 'T1539', 'T1204.002', 'T1588.006', 'T1566.002', 'T1598.003', 'T1566.001', 'T1583.005', 'T1071', 'T1583.001', 'T1090', 'T1608.005', 'T1204', 'T1566', 'T1078', 'T1027', 'T1598', 'T1071.001', 'T1078.004', 'T1557.001']

MISP event uuid: 8175eed5-358d-4fa1-8078-eb1ffbbb5bf9

📃Title: Four published versions of a fake "tanstack" package uploaded in 27 minutes that want to steal your .env files
📅Date: 2026-04-29
🔗References:
https://www.aikido.dev/blog/fake-tanstack-packages-steal-env-files

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
mitre-attack-pattern=['T1059.007', 'T1036.005', 'T1082', 'T1005', 'T1552.001', 'T1027', 'T1195.002', 'T1567.002', 'T1213', 'T1071.001', 'T1105']

MISP event uuid: e7c079a3-fcc8-49de-a399-d94d074031cc

📃Title: Popular DAEMON Tools software compromised
📅Date: 2026-05-05
🔗References:
https://securelist.com/tr/daemon-tools-backdoor/119654/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• topic="supply-chain"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Kaspersky"
• target-information="Belarus"
• target-information="Russia"
• target-information="Thailand"
• target-information="Brazil"
• target-information="China"
• target-information="France"
• target-information="Germany"
• target-information="Italy"
• target-information="Spain"
• target-information="Turkey"
mitre-attack-pattern=['T1033', 'T1218.011', 'T1071.004', 'T1573.001', 'T1082', 'T1140', 'T1016', 'T1057', 'T1059.001', 'T1547.001', 'T1055.012', 'T1027', 'T1195.002', 'T1001.003', 'T1518.001', 'T1059.003', 'T1070.004', 'T1071.001', 'T1105', 'T1055.001']

MISP event uuid: 21f675fc-977d-426a-9622-aed934c463c8

📃Title: CloudZ RAT potentially steals OTP messages using Pheno plugin
📅Date: 2026-05-05
🔗References:
https://blog.talosintelligence.com/cloudz-pheno-infostealer/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Cisco Talos Intelligence Group"
mitre-attack-pattern=['T1053.005', 'T1113', 'T1033', 'T1497.001', 'T1082', 'T1005', 'T1140', 'T1036', 'T1055', 'T1497.003', 'T1555.003', 'T1083', 'T1041', 'T1059.001', 'T1027', 'T1573', 'T1218.009', 'T1059.003', 'T1071.001', 'T1105']

MISP event uuid: 552c3029-2b75-4490-beb5-ef279efdd44e

📃Title: UAT-8302 and its box full of malware
📅Date: 2026-05-05
🔗References:
https://blog.talosintelligence.com/uat-8302/

🔖Rectifyq Taxonomies:
Relevancy: 🟡 Somewhat Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Cisco Talos Intelligence Group"
• target-information="Japan"
• target-information="Russia"
• malpedia="SNAPPYBEE"
• malpedia="DracuLoader"
• malpedia="SNOWLIGHT"
• threat-actor="Earth Estries"
• threat-actor="LongNosedGoblin"
• threat-actor="REF7707"
• threat-actor="UNC5174"
• malpedia="Vshell"
• malpedia="STOWAWAY"
• region="005 - South America"
• region="035 - South-eastern Asia"
• sector="Government, Administration"
• region="039 - Southern Europe"
mitre-attack-pattern=['T1053.005', 'T1003', 'T1069', 'T1071.004', 'T1087.002', 'T1087.001', 'T1135', 'T1190', 'T1055', 'T1090', 'T1482', 'T1083', 'T1059.001', 'T1078', 'T1027', 'T1570', 'T1071.001', 'T1018', 'T1574.002', 'T1105']

MISP event uuid: 8fc2d3cc-7ec3-45b7-84f8-38e23b894b54

📃Title: Iranian-Nexus Operation Against Oman's Government: 12 Ministries Hit and 26,000 Citizen Records Exposed
📅Date: 2026-05-05
🔗References:
https://hunt.io/blog/iranian-nexus-oman-government-intrusion

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="infra-profile"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Hunt.io"
• country="iran"
• target-information="Oman"
• sector="Government, Administration"
• threat-actor="MuddyWater"
• threat-actor="OilRig"
mitre-attack-pattern=['T1053.005', 'T1110.001', 'T1133', 'T1548.002', 'T1003.002', 'T1087.002', 'T1543.003', 'T1074.002', 'T1190', 'T1567', 'T1572', 'T1505.003', 'T1090', 'T1083', 'T1552.001', 'T1041', 'T1059.001', 'T1098', 'T1078', 'T1059.003', 'T1071.001', 'T1136']

MISP event uuid: 1d22e8ac-9b2e-42be-8bcc-f3e462b6f63a

📃Title: Malicious OpenClaw Skill Distributes Remcos RAT and GhostLoader
📅Date: 2026-05-05
🔗References:
https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="ai"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Zscaler"
• malpedia="Remcos"
mitre-attack-pattern=['T1059.007', 'T1539', 'T1555.001', 'T1204.002', 'T1497.001', 'T1218.007', 'T1005', 'T1552.004', 'T1056.002', 'T1059.004', 'T1562.001', 'T1027', 'T1195.002', 'T1059.003', 'T1071.001', 'T1574.002']

MISP event uuid: f4b731dc-f335-424d-883c-086d4f415791

📃Title: Operation Silent Rotor: Rust-Based Malware Targets Eurasian Unmanned Aviation Sector Ahead of Moscow Summit
📅Date: 2026-05-06
🔗References:
https://www.seqrite.com/blog/operation-silent-rotor-rust-malware-unmanned-aviation-sector/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Seqrite"
• target-information="Russia"
• target-information="Tajikistan"
• sector="Civil Aviation"
• region="143 - Central Asia"
mitre-attack-pattern=['T1033', 'T1204.002', 'T1566.001', 'T1082', 'T1106', 'T1140', 'T1016', 'T1083', 'T1036.004', 'T1041', 'T1027', 'T1059.003', 'T1071.001', 'T1105', 'T1090.001']

MISP event uuid: 879be2a3-1617-4328-910c-155eac2ec686

📃Title: OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI
📅Date: 2026-05-06
🔗References:
https://securelist.com/oceanlotus-suspected-pypi-zichatbot-campaign/119603/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Kaspersky"
mitre-attack-pattern=['T1132.001', 'T1195.001', 'T1036.005', 'T1204.002', 'T1574.001', 'T1106', 'T1140', 'T1055', 'T1547.001', 'T1059.004', 'T1027', 'T1102.002', 'T1059.006', 'T1070.004', 'T1027.002', 'T1071.001']

MISP event uuid: 25b75e79-d053-4462-b023-07d0549f2905

📃Title: Data Extortion Groups Intensify Pressure On Global Aerospace Supply Chains
📅Date: 2026-05-06
🔗References:
https://cyberpress.org/aerospace-supply-chains-targeted/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• TA-category="Ransomware"
• target="broad-based"
• topic="supply-chain"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• ransomware="lockbit5"
• sector="Aerospace"
mitre-attack-pattern=['T1583', 'T1133', 'T1082', 'T1071', 'T1562', 'T1195', 'T1190', 'T1567', 'T1589', 'T1021', 'T1070', 'T1041', 'T1199', 'T1566', 'T1078', 'T1027', 'T1486', 'T1598', 'T1588', 'T1213']

MISP event uuid: a7d2cb24-3c7b-4553-9fea-d3228368f8a1

📃Title: Threat Actors Weaponize Tiflux RMMs in Malspam Attacks
📅Date: 2026-05-07
🔗References:
https://www.huntress.com/blog/tiflux-rmm-install

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Huntress"
mitre-attack-pattern=['T1113', 'T1036.005', 'T1204.002', 'T1543.003', 'T1566.002', 'T1082', 'T1219', 'T1112', 'T1070.001', 'T1552.001', 'T1547.001', 'T1562.001', 'T1078', 'T1068', 'T1027', 'T1573', 'T1071.001', 'T1574.002']

MISP event uuid: 66e683a8-e077-43de-b903-1a8d01c2429d

📃Title: PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
📅Date: 2026-05-07
🔗References:
https://www.sentinelone.com/labs/cloud-worm-evicts-teampcp-and-steals-credentials-at-scale/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• topic="cloud"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="SentinelOne"
mitre-attack-pattern=['T1613', 'T1132.001', 'T1552.005', 'T1053.003', 'T1021.004', 'T1190', 'T1525', 'T1552.004', 'T1087', 'T1609', 'T1083', 'T1552.001', 'T1041', 'T1212', 'T1059.004', 'T1078', 'T1027', 'T1570', 'T1059.006', 'T1071.001', 'T1543.002', 'T1046', 'T1105', 'T1552.007']

MISP event uuid: 695fc11f-d4b5-4df4-8563-1b8a8a3a8c7d

📃Title: Custom Attack Tooling Including Undisclosed C2 Infrastructure Targeting Malaysian Organizations
📅Date: 2026-05-15
🔗References:
https://oasis-security.io/blog/malaysian-government-with-undisclosed-c2-infrastructure

🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: ⚔ Threat
• sub-category="infra-profile"
• target="targeted"
• mitre-att&ck="none-from-src"
• action-taken="VT-comment"

🔖MISP Galaxies:
• target-information="Malaysia"
• sector="Government, Administration"
• online-service="8206e5d7-9189-4d8b-855d-339fa45e9c47"
mitre-attack-pattern=['T1100', 'T1505.003', 'T1552.001', 'T1567.002', 'T1190', 'T1587.001', 'T1003.003', 'T1059.001', 'T1059.006', 'T1003.002', 'T1071.001', 'T1021.006']

MISP event uuid: a30d2c51-b056-4b55-ad4d-971722af82d8

📃Title: 5 Malicious NuGet Packages Impersonate Chinese UI Libraries to Distribute Crypto Wallet and Credential Stealer
📅Date: 2026-05-06
🔗References:
https://socket.dev/blog/5-malicious-nuget-packages-impersonate-chinese-ui-libraries

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="crypto-related"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
mitre-attack-pattern=['T1056.001', 'T1539', 'T1204.002', 'T1497.001', 'T1082', 'T1106', 'T1005', 'T1140', 'T1055', 'T1560', 'T1555.003', 'T1055.013', 'T1059', 'T1083', 'T1552.001', 'T1041', 'T1027', 'T1195.002', 'T1071.001']

MISP event uuid: fd4d5ee1-41ff-493f-bb7b-8f5a25b1c947

📃Title: Donuts and Beagles: Fake Claude site spreads backdoor
📅Date: 2026-05-07
🔗References:
https://www.sophos.com/en-us/blog/donuts-and-beagles-fake-claude-site-spreads-backdoor

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="ai"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Sophos"
mitre-attack-pattern=['T1573.001', 'T1106', 'T1140', 'T1059', 'T1083', 'T1204', 'T1041', 'T1547.001', 'T1566', 'T1027', 'T1132', 'T1070.004', 'T1071.001', 'T1574.002', 'T1105']

MISP event uuid: 7865b246-7bcb-4626-aabe-c50b31d21a89