Threat Coverage
-
How KryBit Ransomware Works and How to Test Your Defenses
KryBit is a Ransomware-as-a-Service operation launched in late March 2026, leasing encryption builders to affiliates. Builders cover Windows, Linux, VMware ...
-
ModeloRAT Malware: How the CrashFix Campaign Delivers a Python RAT
ModeloRAT is a Python-based Windows Remote Access Trojan first observed in January 2026 targeting domain-joined hosts. The CrashFix campaign delivers it ...
Threat Coverage
-
NCUA Cybersecurity Compliance: How Picus Supports Credit Unions
-
.png?width=367&height=232&name=picus-threat-research-preview-Dragon%20Breath-august-11%20(1).png)
Dragon Breath (APT-Q-27): RONINGLOADER and Gh0st RAT Explained
-
Gunra Ransomware: Multithreaded ChaCha20 Encryption Explained
-
Dropping Elephant (Patchwork): Espionage APT Tactics and Tools
-
HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel
-
CVE-2026-31635 (DirtyDecrypt) Linux Kernel Privilege Escalation Explained
-
INC Ransomware Explained: How It Attacks Healthcare and Education
-
Astaroth (Guildma) Uses Steganography and Ngrok for C2 Resilience
-
FrigidStealer Explained: macOS Infostealer and Gatekeeper Bypass