BLOODALCHEMY's payload never touches disk - decrypted, decompressed, and run entirely in memory. https://intel.threadlinqs.com/threat/TL-2026-2426 #ThreatIntel #SNAPPYBEE #ShadowPad #PlugX
@threadlinqs.bsky.social
@threadlinqs.bsky.socialBLOODALCHEMY's payload never touches disk - decrypted, decompressed, and run entirely in memory. https://intel.threadlinqs.com/threat/TL-2026-2426 #ThreatIntel #SNAPPYBEE #ShadowPad #PlugX
@hendryadrian.bsky.socialProofpoint says multiple espionage groups rapidly adopted BlueMoon, chaining Chrome V8 and Windows zero-days to hit NGOs, aerospace, manufacturing, and targets in Southeast Asia with GemStone and ShadowPad. #BlueMoon #Vietnam #ShadowPad
@threadlinqs.bsky.socialTwo rival nation-states hacked the same police portal - and never noticed each other. https://intel.threadlinqs.com/threat/TL-2026-2343 #ThreatIntel #PlugX #ShadowPad #Remcos