[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSe2y2DMMyCBmXuYi03L23Q0xVeKMEEA6ic0Qzizz-FI":3},{"article":4,"iocs":53,"watch_terms":102,"solutions":103,"lesson":205},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"93cb0392-6126-43cd-9670-642da8a4ab19","ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories","threatsday-ransomware-affiliate-betrayal-whatsapp-rat-exposed-hacker-tools-and-1-d4fcba","The crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion. Apparently, keeping things secure is a problem on both sides of the fence. The rest of the week isn't much more reassuring. Malicious code turned up in developer packages and extensions that","This week's ThreatsDay bulletin highlights several security concerns, including malicious VS Code extensions like 'Coca-Cola Christmas' and 'Aurora Borealis Studio Theme' that hide Windows downloaders and use Solana transaction memos for C2. A new Windows RAT, VulcanRAT207.A, is being distributed via WhatsApp using a financial document lure and employs a BYOVD technique to disable security software. Additionally, the BraZetsu malware framework's C2 infrastructure was mapped, revealing its connection to the Infected Marketplace.","Multiple threats emerge: malicious VS Code extensions, a new Windows RAT via WhatsApp, and exposed hacker tools.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fthreatsday-ransomware-affiliate.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgR_DE5ORKWCpLgZgXBuH-MFmuqfxFNnkGQxremc0ffY4dopMHnx-2HvgZTMh48BvVr8k22lGaM__jTS83DuXnLpF4NC9u4bsQF-8_K34gZU0kJS_-10pUSL7WNxecJG0pCiHyNFiqxXEqWP7NqUK2-uvwzo8-ETqwZkPWdNOjhNn5S1Y0uFQX2HGBE5_5J\u002Fs1600\u002Ft-day.jpg","2026-10-08T17:58:02+00:00","2026-10-08T20:00:10.507458+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"VS Code","product",{"name":21,"type":19},"Visual Studio Marketplace",{"name":23,"type":19},"Aurora Nocturne Night Theme",{"name":25,"type":19},"Cosmic Nebula Themes",{"name":27,"type":19},"Coca-Cola Christmas",{"name":29,"type":19},"Aurora Borealis Studio Theme","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,65,68,71,74,78,81,84,87,90,93,96,99],{"type":55,"value":56,"context":57},"domain","c2.installscenter[.]com","BraZetsu C2 infrastructure",{"type":55,"value":59,"context":60},"painel.installscenter[.]com","BraZetsu control panel",{"type":62,"value":63,"context":64},"ip","80.78.27[.]252","BraZetsu C2 IP address",{"type":34,"value":66,"context":67},"GlassWorm","Linked to malicious VS Code extensions",{"type":34,"value":69,"context":70},"BraZetsu","Python-based Windows malware framework",{"type":34,"value":72,"context":73},"VulcanRAT207.A","WhatsApp lure deployed Windows RAT",{"type":75,"value":76,"context":77},"mitre_attack","T1204.002","User Execution: Malicious File",{"type":75,"value":79,"context":80},"T1071.001","Application Layer Protocol: Web Protocols",{"type":75,"value":82,"context":83},"T1055.012","Process Injection: Process Hollowing",{"type":75,"value":85,"context":86},"T1574.002","Hijack Execution Flow: DLL Side-Loading",{"type":75,"value":88,"context":89},"T1555.003","Credentials from Password Stores: Web Browser",{"type":75,"value":91,"context":92},"T1027","Obfuscated Files or Information",{"type":75,"value":94,"context":95},"T1140","Deobfuscate\u002FDecode Files or Information",{"type":75,"value":97,"context":98},"T1211","Exploitation for Defense Evasion",{"type":75,"value":100,"context":101},"T1562.001","Impair Defenses: Disable or Modify Tools",[18,21,23],{"controls":104,"vendors":192},[105,134,163],{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":135,"name":136,"problem":137,"products":138},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[139,147,155],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"slug":164,"name":165,"problem":166,"products":167},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[168,176,184],{"vendor_slug":169,"vendor_name":170,"vendor_logo":171,"product_slug":172,"product_name":173,"url":174,"description":175},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":177,"vendor_name":178,"vendor_logo":179,"product_slug":180,"product_name":181,"url":182,"description":183},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":185,"vendor_name":186,"vendor_logo":187,"product_slug":188,"product_name":189,"url":190,"description":191},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[193,199],{"slug":194,"name":195,"logo_path":196,"roles":197},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[198],"affected",{"slug":200,"name":201,"logo_path":202,"roles":203},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png",[204],"reported_by",{"slug":206,"title":207,"body":208,"framework_refs":209,"framework_notes":221},"malicious-ide-extensions-whatsapp-rat-and-exposed-c2-infrastructure-highlight-diverse-threat-landsca","Malicious IDE Extensions, WhatsApp RAT, and Exposed C2 Infrastructure Highlight Diverse Threat Landscape","Attackers are increasingly weaponizing trusted developer tools and consumer platforms — such as VS Code extensions and WhatsApp — to deliver malware, bypassing traditional perimeter defenses by exploiting implicit user trust. The use of Solana blockchain transaction memos for command-and-control represents a sophisticated evasion technique that subverts conventional network monitoring. The BYOVD (Bring Your Own Vulnerable Driver) technique employed by VulcanRAT207.A demonstrates how threat actors actively disable security tooling before operating, reducing detection chances significantly. Organizations that treat software extensions and messaging apps as low-risk vectors remain especially exposed to these blended attack chains.",[210,211,212,213,214,215,216,217,218,219,220],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 9 – Email and Web Browser Protections","NIST SP 800-161 – Supply Chain Risk Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 CM-7 – Least Functionality","NIST SP 800-53 AC-3 – Access Enforcement","MITRE ATT&CK T1553.015 – BYOVD","MITRE ATT&CK T1071 – Application Layer Protocol (C2)","ITIL – Vulnerability and Change Management Practices",{}]