[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPcTW-UAaK0zKDbfTeDt0muN9su8qtryXqYalIAdbffE":3},{"article":4,"iocs":48,"watch_terms":70,"solutions":71,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"1550d647-ee7b-4d54-90f6-77e489fd49d0","Active HanGhost Loader Campaign Targets Enterprise Payment and Logistics Workflows","active-hanghost-loader-campaign-targets-enterprise-payment-and-logistics-workflo-dfd10a","Active HanGhost Loader campaign targets enterprise payment and logistics workflows with fileless attacks, multi-stage execution, and stealthy malware delivery.","A new HanGhost loader campaign is actively targeting corporate environments, specifically employees in payments, logistics, and contract operations. The attack uses obfuscated JavaScript and PowerShell to execute a .NET loader in memory, delivering multiple malware families including PureHVNC, XWorm, Meduza, AgentTesla, and Phantom without writing artifacts to disk. The campaign deliberately targets finance and operations roles to gain access to financial processes, transaction systems, and operational workflows.","HanGhost loader campaign actively targets enterprise payment and logistics workflows with fileless attacks.","https:\u002F\u002Fhackread.com\u002Factive-hanghost-loader-payment-logistic-workflow\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002Factive-hanghost-loader-payment-logistic-workflow-5.jpg","2026-04-15T08:36:40+00:00","2026-04-15T10:00:19.17026+00:00",9,[17,20,23],{"name":18,"type":19},"HanGhost Loader Campaign","campaign",{"name":21,"type":22},"PowerShell","technology",{"name":24,"type":22},".NET","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,52,55,58,61,64,67],{"type":29,"value":50,"context":51},"HanGhost","Multi-stage fileless loader used as primary attack vector",{"type":29,"value":53,"context":54},"PureHVNC","Remote access malware delivered via HanGhost",{"type":29,"value":56,"context":57},"XWorm","Remote access and credential stealing malware deployed in campaign",{"type":29,"value":59,"context":60},"Meduza","Malware family delivered through HanGhost loader",{"type":29,"value":62,"context":63},"AgentTesla","Credential stealer deployed via HanGhost campaign",{"type":29,"value":65,"context":66},"Phantom","Malware payload delivered in HanGhost attacks",{"type":29,"value":68,"context":69},"UltraVNC","Deployed for persistent remote access in some HanGhost cases",[],{"controls":72,"vendors":155},[73,102,131],{"slug":74,"name":75,"problem":76,"products":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":103,"name":104,"problem":105,"products":106},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":132,"name":133,"problem":134,"products":135},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[136,141,148],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":137,"product_name":138,"url":139,"description":140},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":142,"product_name":145,"url":146,"description":147},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":132,"product_name":152,"url":153,"description":154},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":167},"hanghost-loader-campaign-exploits-employee-trust-in-finance-operations","HanGhost Loader Campaign Exploits Employee Trust in Finance Operations","The HanGhost loader campaign demonstrates how attackers strategically target specific employee roles to maximize impact and access to critical business systems. By focusing on finance, logistics, and operations personnel, attackers gain direct pathways to payment systems and transactional workflows that could result in significant financial losses. The use of obfuscated scripts and fileless execution techniques makes detection more challenging while exploiting human vulnerabilities through social engineering. This targeted approach emphasizes that security awareness training must be role-specific and that access controls should follow strict least-privilege principles.",[161,162,163,164,165,166],"CIS Control 4 (Controlled Use of Administrative Privileges)","CIS Control 14 (Security Awareness and Skills Training)","NIST AC-2 (Account Management)","NIST AC-6 (Least Privilege)","NIST SI-3 (Malicious Code Protection)","PCI DSS Requirement 7 (Restrict Access by Business Need-to-Know)",{}]