Weekly Threat Advisory: Beyond Ransomware — 11 RATs, 7 APTs, 1 WIPER, HASH Still Leads (Jul 6 – 12, 2026)

Set the ransomware layer aside for a moment. Everything else this week — RATs, APTs, wipers, cryptominers, novel loaders, phishing kits — still adds up to 1,804 unique IOCs across 89 adversary clusters. HASH still beats IP even without ransomware: 810 hashes vs 468 IPs, driven by the RAT-payload rotation surge. Eleven RAT families are running fresh indicators this cycle. Seven named APT clusters are active. A destructive-class wiper (wiper family) surfaced. And macOS finally got its own drive-by delivery technique variant. The message: if you have been fixated on the ransomware headlines this week, the non-ransomware threat surface is doing plenty too.

This is the ransomware-excluded view of the same seven-day window covered in the Ransomware Week edition. Same catalogue, different lens.

01 · This week in numbers (ransomware excluded)

Even without the ransomware layer, the catalogue produced 1,804 unique IOCs across 89 adversary clusters this cycle. 73 percent of those records are HIGH severity. The signal that survives when ransomware is removed: HASH indicators still outpace IP indicators (810 vs 468) — RAT payload rotation and multi-stage loader activity are enough on their own to invert the traditional IP-dominated composition.

02 · Five headlines — what defined the non-ransomware layer

Headline 01 · commodity RAT family cryptomining surge — 244 IOCs, wallet-drainer domain cluster

commodity RAT family contributed 244 unique indicators across DOMAIN + HASH — the largest non-ransomware cluster footprint this cycle. The domain layer shows deliberate theming: every catalogued domain sits adjacent to legitimate cryptocurrency-wallet or blockchain-service naming (anchorwallet[.]org, aptwallet[.]org, arkwallet[.]org, anchorupdate[.]com, arkupdate[.]com, and dozens more of the same shape). Category tag is Cryptomining but the operational profile combines wallet-drainer social-engineering with mining payload post-compromise. The victim-targeting profile is cryptocurrency users of specific blockchain ecosystems.

Headline 02 · The RAT economy — 11 families active with fresh indicators

Eleven named RAT families surfaced with fresh indicators this cycle: info-stealer family (117 IOCs, full four-type stealer footprint), Millenium RAT v4 (50 IOCs), GoodPersonRAT (45 IOCs), [tool] (37 IOCs full four-type), commodity RAT family (21 IOCs full four-type), EtherRAT (15 IOCs), QuimaRAT (10 IOCs full four-type), commodity RAT family (16 IPs), Banana RAT, NetSupport, and [tool]. Combined footprint: over 400 IOCs. The commodity-RAT tradecraft chain (T1566 → T1204 → T1059 → T1105 → T1071 → T1041) applies universally — a single detection strategy catches the family bucket.

Headline 03 · tracked APT cluster APT — port-trio infrastructure fingerprint

The signature of the week. 89 IOCs across HASH + IP + URL. Three catalogued IP anchors — 194.233.92.26, 217.15.160.247, 217.15.164.147 — each serving the same trio of ports: 2222 (SSH-alternate), 8088, 99. The trio is not coincidence — it is the operator’s deployed C2-stack configuration. Any other host on the internet serving that exact port combination is candidate operator infrastructure regardless of whether the catalogued IPs are still active. Sigma rule 04 below implements the port-pattern detection.

Headline 04 · Novel loader + destructive-class wiper

Two emerging threat classes worth flagging:

• Multi-Stage LNK + JavaScript-runtime backdoor — 135 IOCs across DOMAIN + HASH. Novel loader pattern: LNK dropper spawns a JavaScript-runtime process that pulls and executes second-stage payload. Defenders without instrumentation on the JS-runtime interpreter miss the execution chain entirely.
• wiper family — 10 IOCs (HASH + IP). Destructive-class malware, distinct from ransomware because there is no encryption and no ransom — the intent is sabotage, not extortion. Techniques: data destruction (T1485), disk wipe (T1561), inhibit recovery (T1490), system shutdown (T1529). Rare in the catalogue but severe when observed.

Headline 05 · APT week + macOS drive-by delivery technique + supply chain

Seven named APT clusters contributed indicators this cycle: tracked APT cluster (89 IOCs), DPRK cluster (37 IOCs across all 5 IOC types — the broadest single-cluster spread), RAT family (31 IOCs across HASH + IP + URL with two subnet anchors), DPRK-adjacent APT cluster (30 IOCs), Cavern Manticore (20 IOCs), attributed APT cluster (13 IOCs across all four types), and UNK_MassTraction (10 IOCs full four-type — newly-tracked cluster). Separately, macOS drive-by delivery technique made its first observation in this catalogue (18 IOCs, DOMAIN + URL) — the drive-by delivery technique social-engineering technique adapted for Unix shell. And the coordinated package-registry supply-chain campaign (57 IOCs across HASH + URL) hit two public package registries in coordinated fashion.

03 · Indicator type, severity, and category mix

Even excluding ransomware, HASH remains the dominant indicator type at 44.9 percent — RAT payload rotation is the driver. Malware-Activity leads the category mix (443 IOCs, 25 percent). Cryptomining sits at 248 (14 percent) — the commodity RAT family wallet-drainer surge. APT is elevated at 202 IOCs (11 percent).

By indicator type

By severity

By category

Reading the mix without ransomware. With Ransomware-as-a-Service removed, Malware-Activity leads at 25%, followed by Cryptomining (14%), APT (11%), RAT (11%), Phishing (8%), and Backdoor (8%). The category diversity is broader than in the ransomware-inclusive view — ransomware was compressing what the rest of the catalogue looks like.

04 · Top adversary clusters (non-ransomware)

36 clusters ranked by unique IOC footprint. commodity RAT family leads at 244 IOCs. Open-framework infrastructure entries in grey to preserve visual clarity of the campaign-attributed clusters.

Full-footprint clusters this week (3+ IOC types). info-stealer family (4 types) · [tool] (4) · DPRK cluster (5) · commodity RAT family (4) · EtherRAT (4) · QuimaRAT (4) · UNK_MassTraction (4) · drive-by delivery technique (4) · GoodPersonRAT (3) · SCMBANKER (3) · RAT family (3) · tracked APT cluster (3) · Cavern Manticore (3) · Fake tax-return phishing (3) · Forg365 (3) · MODBEACON (3) · FortiBleed (3) · Fake remote-desktop tool phishing (3). The DPRK cluster’s 5-type spread is the broadest.

05 · Cluster deep-dives — the non-ransomware names to act on

05.1 · commodity RAT family cryptomining surge — 244 IOCs, wallet-drainer domain cluster

Deliberate wallet-adjacent domain naming across all 244 catalogued indicators (anchorwallet[.]org, aptwallet[.]org, arkwallet[.]org, anchorupdate[.]com, arkupdate[.]com, ancupdate[.]top, and dozens more). The naming pattern targets specific blockchain ecosystems — ARK, Aptos, Anchor. Victim workflow: search engine or social-media lure → landing on a wallet-service impersonation domain → extension install or seed-phrase form → wallet drain, mining payload for persistence.

Defensive actions: Push the 244 catalogued domains and hashes to blocking. Deploy regex DNS filter for the *wallet.* / *wallet-update.* / anc(hor)?(update|v2|wallet).* patterns to catch operator rotation. Brief cryptocurrency-using users (developers, finance staff) on the wallet-drainer domain-family targeting them.

05.2 · The RAT economy — 11 families, 400+ combined IOCs

The commodity-RAT family bucket had a busy week. The combined footprint across 11 named families adds up to over 400 IOCs. The TTP chain is nearly identical across all families:

Phishing (T1566) or user-execution (T1204)
  → Command interpreter (T1059)
    → Ingress tool transfer / second-stage pull (T1105)
      → Web-protocol C2 (T1071 / T1071.001)
        → Exfil over C2 (T1041)
          → Registry-run key persistence (T1547.001)

Defensive actions: A single detection strategy fired against that TTP chain catches the family bucket regardless of hash rotation. Push all catalogued RAT hashes to endpoint scan-and-quarantine. Watch for the parent-process-shell → child-process-command-interpreter → outbound sequence within 60 seconds.

05.3 · info-stealer family — 117 IOCs, full four-type stealer footprint

Password-store theft (T1555) + local data collection (T1005) + system-info enumeration (T1082) + screen capture (T1113) + exfil over C2 (T1041). The four-type footprint (DOMAIN + HASH + IP + URL) makes info-stealer family this week’s most rotation-resilient stealer — blocking any single IOC type catches only a fraction of the family activity.

Defensive actions: Push all 117 hashes to endpoint scan. Watch for lsass memory-scraping alongside browser-credential-store access — the pair is info-stealer family’s canonical run sequence.

05.4 · tracked APT cluster APT — port-trio infrastructure fingerprint

The most operationally-actionable APT observation this week. 89 IOCs across HASH + IP + URL. Three catalogued IP anchors each serve the same trio of ports: 2222, 8088, 99. The port trio is a stable operator fingerprint. Any other host serving that exact combination is candidate operator infrastructure regardless of whether the IP appears in this week’s catalogue.

Defensive actions: Block all three anchor IPs. Deploy Sigma rule 04 (port-trio signature). Hunt for the trio across the last 60 days of proxy / firewall / netflow telemetry.

05.5 · DPRK cluster — broadest 5-type IOC spread

37 IOCs across DOMAIN + EMAIL + HASH + IP + URL. The cluster maintains multi-layered infrastructure: acquired domains for recruitment lures ([adv]cameradriverupdates.compaxos-apply.com-style), phishing email addresses, second-stage payload hashes, C2 IPs, and staging URLs. Watch for the recruitment-lure targeting profile (developers, cryptocurrency-exchange staff, defense-adjacent research).

Defensive actions: All 37 indicators to blocking / watchlist by tier. Hunt for outbound to 144.172.110.53 across the last 60 days.

05.6 · RAT family — two subnet anchors, classic APT loader signature

31 IOCs across HASH + IP + URL with two subnet anchors: 172.111.233.0/24 (5 concentrated IPs — largest APT-malware anchor of the week) and 172.94.9.0/24 (3 IPs). Classic DLL-side-loading signature: signed benign binary + malicious sideload DLL + payload file.

Defensive actions: Perimeter-block both /24 subnets. Push hashes to endpoint scan. Hunt for the DLL side-load pattern — process image path from user-writable directory + loaded module from same directory.

05.7 · Multi-Stage LNK + JavaScript-runtime backdoor — novel loader technique

135 IOCs across DOMAIN + HASH. Technique: LNK shortcut file drops and executes a JavaScript-runtime process (Windows JScript engine, server-side JavaScript runtime, or equivalent) that fetches and executes a second-stage payload. Defeats detection content that only inspects powershell.exe and cmd.exe as the loader — the JS runtime is the executor.

Defensive actions: Instrument JavaScript-runtime process spawning as a suspicious loader in endpoint content. Watch for wscript.exe, cscript.exe, and jsruntime.exe-equivalent processes with parent = explorer.exe and LNK-related command-line arguments.

05.8 · wiper family — destructive-class malware

10 IOCs across HASH + IP. Distinct from ransomware because there is no encryption and no ransom — the intent is sabotage. Techniques observed: data destruction (T1485), disk wipe (T1561), inhibit recovery (T1490), system shutdown (T1529). Wiper-class malware is rare in this catalogue but severe when observed — typically deployed in geopolitically-motivated intrusions where the operator wants to deny use of the environment, not extract value from it.

Defensive actions: Push the 10 hashes to endpoint quarantine. Consider adding wiper-specific behavioural detectors: process opens raw disk device + writes zeros or random data is the canonical pattern.

05.9 · macOS drive-by delivery technique — first observation of macOS variant

18 IOCs across DOMAIN + URL. First observation of the drive-by delivery technique social-engineering technique adapted for macOS. Users encounter a fake-instruction lure (“your Mac is missing X, run this command to fix it”) and paste attacker-controlled shell commands into their terminal. Pure social-engineering — no exploitation involved. User awareness is the primary defence.

Defensive actions: Update user-awareness content to include macOS-specific drive-by delivery technique lures. Block the 18 catalogued endpoints at the DNS resolver. Deploy endpoint content that flags terminal execution of curl-piped-to-shell or bash-piped commands from clipboard sources.

05.10 · Coordinated package-registry supply-chain campaign

57 IOCs across HASH + URL. Two public package registries hit in coordinated fashion. Install-time command-interpreter execution + obfuscated payload + data-encoded exfil. The coordination is the signal — typosquat campaigns typically hit one registry at a time.

Defensive actions: Package allow-listing in CI build agents. Outbound-domain monitoring from build runners. Publisher-identity verification on the package registries used.

06 · ATT&CK mapping per named cluster

Per-cluster technique mapping with operational narrative. Detection content that fires on these techniques catches the cluster even after IOC rotation.

Detection-engineering takeaway. The commodity-RAT technique chain (T1566 → T1204 → T1059 → T1105 → T1071 → T1041) is observed in 8 of the 11 RAT families this week. A single detection strategy fired against that chain catches most of the RAT bucket. For the APT layer, prioritise T1583.001 (adversary-acquired domains) and T1071.001 (web-protocol C2) — both are heavily observed and both survive infrastructure rotation.

07 · ATT&CK tactic-pressure roll-up

Aggregation of technique tags rolled up to the parent tactic. With ransomware removed, Initial Access + Execution + C2 lead the roll-up — the classic RAT / commodity-malware tactic profile.

08 · Subnet anchors and port-pattern signatures

Subnet anchors (non-ransomware) — /24 blocks with 3+ concentrated IPs

Port-pattern signature — tracked APT cluster APT

09 · Top 15 IOCs per indicator type (non-ransomware)

All indicators defanged (re-fang on import: [.] → . and hxxp → http).

Top 15 · IP addresses (High severity)

Top 15 · Domains (High severity)

Top 15 · File hashes (High severity)

Top 15 · URLs (High severity)

10 · Sigma detection rules — four for the non-ransomware layer

Sigma 01 · commodity RAT family wallet-drainer domain family

title: commodity RAT family Wallet-Drainer Domain-Family Pattern
id: 9a3c1e7f-4b82-4520-b193-6d8f2c1e5a90
status: experimental
description: Detects DNS queries or HTTP host headers matching the commodity RAT family
  wallet-drainer domain-family naming pattern observed this cycle. Catches
  the 244-domain family plus operator rotation.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-6-12-2026/
author: HackForLab Threat Intelligence
date: 2026/07/13
tags:
  - attack.initial_access
  - attack.t1566
  - attack.resource_development
  - attack.t1583.001
logsource:
  category: dns_query
detection:
  selection:
    QueryName|re:
      - '^ap[a-z]{2}wallet\.'
      - '^ark(wallet|update)\.'
      - '^anchor(wallet|update|v[0-9])\.'
      - '^anc(update|wallet)\.'
      - '^[a-z]{2,6}wallet\.'
  exclusion:
    QueryName|contains: [allowlisted_legitimate_wallet_services]
  condition: selection and not exclusion
falsepositives:
  - Legitimate cryptocurrency-wallet services — allowlist explicitly
level: high

Sigma 02 · Universal commodity-RAT TTP chain

title: Universal Commodity-RAT TTP Chain
id: 8c4b9d1e-7a25-4360-b581-3f9d5c2e8a10
status: experimental
description: Detects the universal commodity-RAT execution chain — parent shell
  spawns a script interpreter or JS runtime, which triggers an outbound web
  connection within 60 seconds. Catches commodity RAT family, info-stealer family, GoodPersonRAT, [tool],
  EtherRAT, QuimaRAT, Banana RAT, commodity RAT family, and more.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-6-12-2026/
author: HackForLab Threat Intelligence
date: 2026/07/13
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
  - attack.command_and_control
  - attack.t1071.001
logsource:
  product: correlation
detection:
  s1_shell_parent:
    EventID: 4688
    ParentImage|endswith: ['\explorer.exe', '\OUTLOOK.EXE', '\winword.exe', '\excel.exe']
  s2_interpreter_child:
    EventID: 4688
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\jsruntime.exe'
  s3_outbound_web:
    EventID: 5156
    DestinationPort: [80, 443, 8080, 8443]
  condition: s1_shell_parent and s2_interpreter_child and s3_outbound_web within 60s
falsepositives:
  - Legitimate business macro workflows (allowlist parent + child + destination triple)
level: high

Sigma 03 · tracked APT cluster APT port-trio signature

title: tracked APT cluster APT Port-Trio Signature (2222 / 8088 / 99)
id: 7d1a4b8e-5c62-4930-a8f1-3e9c7d5b2a40
status: experimental
description: Detects outbound connections to any destination serving the
  tracked APT cluster APT port-trio signature. The port combination is a stable operator
  fingerprint — matches even after IP rotation.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-6-12-2026/
author: HackForLab Threat Intelligence
date: 2026/07/13
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1571
logsource:
  category: network_connection
detection:
  known_ip:
    DestinationIp:
      - '194.233.92.26'
      - '217.15.160.247'
      - '217.15.164.147'
  port_trio_hit:
    DestinationPort: [2222, 8088, 99]
  # Fire on known IPs OR any destination hit on 2+ of the trio in 5 minutes
  condition: known_ip or (port_trio_hit | count(DestinationIp) by 5min > 2)
falsepositives:
  - Legitimate SSH-alternate (2222) or internal service (99) usage — allowlist
level: high

Sigma 04 · wiper family destructive-class behavioural

title: wiper family Destructive-Class Behavioural Detection
id: 3e8b7f2c-1d95-4a60-b731-5c9e6d4f2a10
status: experimental
description: Detects the canonical wiper behaviour — process opens a raw disk
  device and writes zero/random data. Catches wiper family and any other
  destructive-class malware regardless of variant.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-6-12-2026/
author: HackForLab Threat Intelligence
date: 2026/07/13
tags:
  - attack.impact
  - attack.t1485
  - attack.t1561
logsource:
  category: file_event
  product: windows
detection:
  raw_disk_write:
    TargetFilename|contains:
      - '\\.\PhysicalDrive'
      - '\\.\Harddisk'
      - '\\.\Volume'
    EventType: 'setValue'
  privileged_process:
    Image|endswith: '.exe'
    IntegrityLevel: 'System'
  condition: raw_disk_write and privileged_process
falsepositives:
  - Legitimate disk-imaging / backup / forensic tools (allowlist by process image)
level: critical

11 · Hunt queries — SIEM-agnostic pseudo-syntax

Hunt 01 · Wallet-drainer domain-family DNS queries

// Pseudo-query
FROM dns_queries
WHERE query_name MATCHES regex '.*(wallet|update)\.'
  AND query_name MATCHES regex '(ap[a-z]{2}|ark|anchor|anc|arb)wallet\.'
  AND query_name NOT IN (allowlisted_wallet_services)
| AGGREGATE BY src_host, query_name
| SORT BY COUNT DESC

Hunt 02 · tracked APT cluster port-trio contact (first-seen)

// Pseudo-query
FROM network_flows
WHERE dest_port IN (2222, 8088, 99)
  AND first_seen_pair(src_ip, dest_ip) WITHIN 60d
| AGGREGATE BY src_ip, dest_ip,
  COUNT(DISTINCT dest_port) AS unique_ports_hit
WHERE unique_ports_hit >= 2
| SORT BY unique_ports_hit DESC

Hunt 03 · LNK + JavaScript-runtime loader chain

// Pseudo-query
FROM process_creates
WHERE parent_process_name IN ('explorer.exe', 'Shell.exe')
  AND process_name IN ('wscript.exe', 'cscript.exe', 'jsruntime.exe')
  AND (command_line CONTAINS '.lnk' OR command_line CONTAINS '.js')
| JOIN network_flows AS n
  ON process_creates.host = n.src_host
  AND n.flow_time BETWEEN process_creates.create_time
                     AND process_creates.create_time + 300s
WHERE n.dest_domain NOT IN (allowlisted_domains)
| PROJECT process_creates.host, process_creates.command_line, n.dest_domain
| SORT BY create_time DESC

Hunt 04 · Wiper-class raw-disk write behaviour

// Pseudo-query
FROM file_events
WHERE target_path MATCHES regex '\\\\.\\PhysicalDrive[0-9]+'
   OR target_path MATCHES regex '\\\\.\\Volume\{'
  AND event_type = 'write'
  AND process_integrity = 'System'
  AND process_image NOT IN (allowlisted_imaging_tools)
| PROJECT host, process_image, target_path, event_time
| SORT BY event_time DESC

12 · Operationalise in 60 minutes

Minute 00 – 15 · Block + sinkhole

• Block 172.111.233.0/24 + 172.94.9.0/24 (RAT family subnet anchors).
• Block 91.92.43.0/24 (Tsundere botnet).
• Block 45.74.7.0/24 (commodity RAT family concentration).
• Block 194.233.92.26, 217.15.160.247, 217.15.164.147 (tracked APT cluster APT anchors).
• DNS-deny the commodity RAT family wallet-drainer domain cluster via Sigma rule 01 pattern.

Minute 15 – 30 · Detection content

• Deploy Sigma 01 (wallet-drainer domain regex).
• Deploy Sigma 02 (universal commodity-RAT TTP chain).
• Deploy Sigma 03 (tracked APT cluster port-trio).
• Deploy Sigma 04 (wiper raw-disk behaviour).

Minute 30 – 45 · Retrospective hunt

• Run Hunt 01 (wallet-drainer DNS queries) across the last 30 days.
• Run Hunt 02 (port-trio pattern) across the last 60 days.
• Run Hunt 03 (LNK + JS-runtime chain) across the last 30 days.
• Run Hunt 04 (wiper raw-disk write) baseline scan across the last 90 days.

Minute 45 – 60 · Awareness + policy

• Update macOS user-awareness content on drive-by delivery technique.
• Brief cryptocurrency-using users (finance, developers) on the wallet-drainer domain family.
• Brief developers on the coordinated package-registry supply-chain campaign.
• Audit backup and disaster-recovery posture — the wiper observation is a reminder that some operators want to deny use of your environment, not extract value.

13 · Frequently asked questions