ChocoShell is a PowerShell credential stealer associated with the CaptiveCrunch campaign. Its code targets browser credentials, session cookies, Microsoft TokenBroker artifacts, and saved Wi-Fi passwords. It also implements mechanisms for bypassing browser encryption protections, evading security controls, and retrieving additional payloads.

Our analysis identified a flaw in ChocoShell’s administrator detection. When executed under a split-token local administrator account, the malware failed to recognize the Administrators SID marked as deny-only. Consequently, it triggered a visible UAC prompt instead of selecting its silent privilege-elevation mechanisms.

In just over a year, Anonymous Sudan managed to create the image of a much larger and more technically sophisticated cyber operator than the available open-source evidence would suggest. The group targeted Microsoft services, ChatGPT, PayPal, government institutions, financial and healthcare organizations, and transportation infrastructure. Yet its core may have consisted of only a handful of individuals.

Charming Kitten, commonly tracked as APT35 and overlapping in public reporting with APT42, Mint Sandstorm, Magic Hound, and TA453, has repeatedly targeted researchers, journalists, diplomats, policy professionals, activists, and others whose accounts provide access to sensitive information or influential networks.

The most useful way to understand this activity is through the sequence that links target selection, relationship building, authentication, and collection.

Cadet Blizzard: When Cyber Espionage Becomes Cyber Sabotage

Some threat actors steal information. Others are built to disrupt, destroy, and support broader military objectives.

Cadet Blizzard (also tracked as Ember Bear and DEV-0586) belongs to the latter category. Widely linked by leading cybersecurity organisations to GRU Unit 29155, the group has become one of the key Russian cyber actors targeting Ukraine, NATO members, and organisations supporting Ukraine.

Our latest OSINT report focuses on KillNet.

KillNet has evolved far beyond a conventional hacktivist group. Our analysis shows that its campaigns consistently align with political developments and the geopolitical interests of the Russian Federation, while technical attacks are regularly combined with coordinated information and psychological operations.

Although most of its operations rely on relatively low-complexity techniques, KillNet remains one of the most influential pro-Russian cyber groups due to its ability to rapidly mobilize a broad network of supporters, coordinate large-scale DDoS campaigns, and amplify their impact through Telegram and other online platforms.