Up first in this week's Cyber Threat Intelligence (CTI) roundup is a look at DarkCloud, a rapidly evolving information-stealing malware that uses advanced evasion techniques and multi-channel exfiltration to target sensitive data, including credentials, crypto wallets, and user files.
Next, Tanium’s CTI team looks at the newly formed alliance between LAPSUS$, ShinyHunters, and Scattered Spider, dubbed the "Trinity of Chaos."
Finally, we give an overview of the recent changes and updates to the WARMCOOKIE malware.
DarkCloud malware targets sensitive data
A recent eSentire post reveals new capabilities of the DarkCloud infostealer malware, including sandbox detection, VB6-based encryption, and phishing-based delivery.
According to eSentire, DarkCloud “targets browser passwords/credit cards/cookies, keystrokes, FTP credentials, clipboard contents, email clients, files, and cryptocurrency wallets.” The analysis urges organizations to strengthen email security and endpoint defenses.
DarkCloud’s phishing campaign
In September, eSentire’s Threat Response Unit (TRU) identified a spear phishing campaign targeting a manufacturing industry customer, designed to deploy DarkCloud. These phishing emails include a banking-themed subject line, body copy resembling a legitimate financial institution message, and a ZIP archive attachment purporting to contain an order message from the recipient’s partner.
How DarkCloud is distributed
DarkCloud was previously distributed through a now-defunct hacking forum. eSentire has since observed it being promoted via Telegram and a deceptive website maintained by the malware’s operators, which mimics a legitimate software vendor.
This website contains a list of targeted applications, including web browsers, email clients, and VPN tools. It also outlines many of the malware’s features, such as a smart logger, web panel, file grabber, and more.
DarkCloud analysis
In the report, eSentire provides the following details about DarkCloud malware:
- DarkCloud malware builder requires its users/operators to install VB6 IDE to “compile the malware stub from locally sourced VB6 source code.” This introduces a vulnerability that increases the likelihood of unauthorized versions spreading.
- The latest version, v4.2, collects system information via WMI queries and uses a VBScript object to match stolen credit card numbers with the appropriate card type. It also obtains contacts from victim machines for Thunderbird and other email clients.
- For evasion, the malware matches running processes against a blacklist of substrings and terminates if a sandbox is identified. It also terminates if there are fewer than 50 running processes and checks for specific files that indicate a virtual environment. For persistence, DarkCloud uses the RunOnce registry key.
- DarkCloud gathers files within a defined list of paths and file extensions. It also targets crypto wallets. eSentire discovered that DarkCloud supports exfiltration methods such as SMTP, Telegram, FTP, and Web Panel.
Analyst comments from Tanium’s Cyber Threat Intelligence team
DarkCloud’s use of VB6 for encryption and execution is a clever throwback. It leverages legacy tech to evade modern detection, highlighting the need for defenders to maintain visibility across both old and new threat vectors.
The malware’s multi-channel exfiltration strategy reveals how attackers are diversifying their data theft methods to bypass traditional network monitoring tools.
eSentire created two tools to help security researchers, including one that extracts DarkCloud’s malware configuration, and an “IDA Python-based script that decrypts encrypted strings and comments them in IDA Pro.”
New Trinity of Chaos alliance targets major sectors
According to a report from Resecurity, a newly formed alliance between LAPSUS$, ShinyHunters, and Scattered Spider is driving a global cybercrime spree targeting major sectors like airlines, retail, and telecom.
This collaboration marks a shift toward a fluid, youth-driven cybercrime ecosystem that blends ransomware, data theft, and psychological manipulation. The group has been observed using both advanced social engineering and extortion tactics.
How LAPSUS$, Scattered Spider, and ShinyHunters work together
LAPSUS$, Scattered Spider, and ShinyHunters are three notorious groups that have each experienced individual success. Each group emerged on its own, but researchers are now identifying connections, overlaps, and collaboration between them.
In August 2025, a Telegram channel was observed combining the branding and memberships of the three groups. This channel was used to tease data leaks and market a new ransomware as a service (RaaS) offering. ShinyHunters previously confirmed that Scattered Spider handed them initial access to various targets, with LAPSUS$ also believed to be a participant in this new alliance.
These three groups are linked to the English-speaking cybercriminal ecosystem referred to as The Com, which is a “loosely organized network operating more as a cybercrime youth movement, encompassing a broad and constantly shifting range of actors, mainly teens and 20somethings.”
Overlaps in methods and membership
The groups are known for their advanced use of social engineering, particularly vishing, phishing, and impersonating IT support.
They also share overlapping techniques for SIM swapping, MFA bypass, data theft, and target selection. Most recently the groups have been jointly targeting organizations in specific sectors.
Resecurity believes that these overlapping tactics, techniques, and procedures (TTPs) and connections indicate some level of operational overlap or shared resources.
Recent activity
The most recent work of this trio is the attack against Jaguar Land Rover. Recent additional activities include attacks against airlines, retailers, telecoms, and law enforcement agencies.
ShinyHunters and collaborators are likely also responsible for recent attacks against Salesforce. These attacks involved exploiting OAuth tokens to access Salesforce environments. The attacks resulted in the actors sharing several data dumps, confirming the exploitation of multiple global Fortune 100 companies.
The Resecurity report includes more details about each attack for anyone looking for a deeper dive.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The convergence of LAPSUS$, ShinyHunters, and Scattered Spider signals a dangerous evolution in cybercrime, where traditional group boundaries are dissolving in favor of agile, collaborative ecosystems that can rapidly scale attacks across industries.
The alliance’s preference for cloud platforms like Salesforce and Snowflake underscore the growing threat in which actors are targeting the backbone of enterprise infrastructure, as opposed to just endpoints or networks. Their use of gamified extortion and public engagement tactics also reflects a shift toward psychological warfare, leveraging social media and public sentiment to pressure victims and amplify impact.
Recent activity on cybercrime forums suggests that the trio has announced the retirement of their operations, claiming they had met their goals. However, an account on the RAMP forum believed to be operated by ShinyHunters recently claimed credit for a new attack, making this claim appear to be fake.
WARMCOOKIE malware continues to evolve
Elastic Security Labs has been tracking ongoing changes and updates to the WARMCOOKIE malware. They have determined that the backdoor is actively being developed and distributed. One of their key findings is a default certificate that appears to be used by the malware’s backend, likely making it possible to track new C2 servers and infrastructure.
The WARMCOOKIE malware first emerged in mid-2024. The malware is deployed via phishing campaigns, which are often themed around recruitment and contain fake job offers. Since its initial emergence, Elastic Security Labs has seen development changes to the malware, which they have shared in the report.
New handlers
The latest WARMCOOKIE malware variant contains four new handlers which give the operator the ability to quickly launch executables, DLLs, and scripts.
Elastic notes that most of the recent builds use the DLL/EXE execution function, and that PowerShell is observed much less often. Regardless of which, they use the same function and pass arguments for each file type. The handler then can create a folder in a temp directory and write the file content to a file within a folder located in that new directory.
WARMCOOKIE’s string bank
Elastic Security Labs has also observed the updated malware using a string bank that leverages legitimate companies for both folder paths and scheduled task names. This defense evasion technique allows the malware to move into to more legitimate-looking directories.
Unlike previous variants that hardcoded the paths, the newer variants have a list of companies to be used as potential folder paths. Elastic determined that the string bank is “sourced from a website used to rate and find reputable IT/Software companies.”
Other changes to WARMCOOKIE
The new variant changes the command line parameter from /p to /u to determine if a task needs to be created. The variant also uses two mutexes instead of one and features improved code optimization.
WARMCOOKIE malware now includes a campaign ID field that can be used by the operators to help track campaigns.
Infrastructure overview
Elastic extracted the associated infrastructure from the identified configurations to reveal one SLL certificate that really stood out. This cert is believed to be a default certificate used by the malware’s back end.
While the date of the certificate appears to be expired, both new and reused infrastructure is still being initialized using the certificate. So, while this is not net new infrastructure, it is a “reconfiguration of redirectors to breathe new life into existing infrastructure.”
Analyst comments from Tanium’s Cyber Threat Intelligence team
Malware families often evolve, even when they don’t receive significant media attention. WARMCOOKIE is an excellent example of this.
The naming of scheduled tasks and folder paths as legitimate organizations isn’t novel, but it does increase the chances of the malware getting overlooked and may make it more challenging for defenders to identify it as malicious.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.