📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays

• Country & Industry Profiles

💪 Detection Highlights. The Google Threat Intelligence Group and FLARE team continuously enhance Google TI's detection capabilities through new YARA rules and updated malware configuration extractors. This week, we've released YARA rules covering 15 newly tracked malware families and updated detection content for 53 existing families, including one with an updated configuration extractor. Our prioritization focuses on malware families actively observed in Mandiant incident response engagements, Google SecOps customer environments, and top GTI search trends.

As we track new malware families found through our research, we build and release detection signatures. Some recent examples include:

• POTATOWALL: a backdoor written in Rust that uses Telegram for command and control. POTATOWALL leverages the Rust libraries Tokio for asynchronous runtime and Teloxide for Telegram functionality. POTATOWALL contains a hard-coded Telegram bot token, which it uses to periodically poll for new command messages. POTATOWALL supports commands to change its working directory, execute a command using Windows cmd.exe, and execute a command using PowerShell. See its curated YARA detection rules.
• BINDCOUPE: a lightweight backdoor written in C++ that communicates to hard-coded command-and-control (C2 or C&C) servers using raw TCP sockets. It is capable of collecting basic system information, downloading files, taking screenshots, and executing arbitrary shell commands. See its curated YARA detection rules.
• DARKFLIP: a backdoor written in C++. DARKFLIP parses an external configuration file for its C2. DARKFLIP supports several commands including: update sleep value, re-register victim with C2, run Windows shell command, run PowerShell command, download file to victim, and delete file. DARKFLIP leverages AES-GCM to decrypt its configuration and for C2 communications. See its curated YARA detection rules.
• DRIVECLEAN: a disruptive payload written in C that is executed as a Windows Native Application masquerading as a system updater. DRIVECLEAN is responsible for enumerating all mapped drives (A-Z) and overwriting the content of files in those drives with NULL bytes. See its curated YARA detection rules.

In addition to providing detection rules for new and emerging threats, we continue to update our detection systems for threats we commonly see. This week, we updated SOGU, ICEFOG, and BRICKSTORM.

These updates ensure you have the latest indicators and enhanced detection capabilities, with configuration extraction systems updated where applicable.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

📢 Vulnerability Intelligence for Standard Licenses. The Vulnerability Intelligence module is a specialized component of Google Threat Intelligence designed to move security teams beyond static CVSS scores. It provides a centralized hub to search, filter, and prioritize vulnerabilities (CVEs) enriched with internally calculated risk ratings and real-world visibility into exploitation in the wild. Previously exclusive to Enterprise and Enterprise Plus tiers, the Vulnerability Intelligence module is now available to Standard licensed customers as well. This update empowers a broader range of security teams to implement smarter, threat-driven patching programs.

📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays

• Hunting for LOLBins Part 2

💪 Detection Highlights. The Google Threat Intelligence Group and FLARE team are dedicated to enhancing Google TI's detection capabilities through continuous updates to YARA rules and malware configuration extractors. This week, we've released YARA rules covering 7 newly tracked malware families, and expanded our detection capabilities for 35 existing families, which includes updates to YARA rules and configuration extractors. Our prioritization focuses on threats actively observed in Mandiant incident response engagements, Google SecOps customer environments, and prominent Google TI search trends.

As we track new malware families found through our research, we build and release detection signatures. Some recent examples include:

• ROTORWIPE: a disruptive payload written in C++ which makes use of the Mersenne Twister algorithm to compute a random buffer which is used to overwrite data on the victim's device. ROTORWIPE identifies and enumerates the device's logical drives; it then enumerates files and folders on the given drive and begins overwriting the data while aiming to ignore files in specific root directories. After parsing all child directories, each file is then overwritten with random data from the Mersenne Twister algorithm in 16-byte chunks. After overwriting the files, ROTORWIPE sleeps for 5 seconds before enumerating the drives and attempting to delete each file. After the file deletion activity is complete, the malware exits. See its curated YARA detection rules.
• MISTBRICK: a post-exploitation agent written in Java, designed to target Ivanti MobileIron appliances. It employs a multi-stage loader that reassembles an encoded JAR file on disk before utilizing the Java Attach API to inject malicious bytecode into a running Tomcat process. The malware uses the Javassist library to patch the com.mi.filter.CacheFilter class in memory, creating a passive backdoor that intercepts HTTP requests containing a specific hard-coded UUID header. Communication is secured using AES-256-CBC encryption with a hard-coded key and IV. MISTRBRICK supports a custom binary protocol, allowing for the fileless loading and execution of arbitrary Java classes directly from memory. The malware operates as a memory-resident implant and does not establish persistence beyond the runtime of the hijacked service. See its curated YARA detection rules.
• CRYSOME: a Delphi-based Remote Access Trojan (RAT) and Loader. It utilizes a custom UDP-based command-and-control (C2) protocol for system espionage and remote execution. The malware features a modular architecture, enabling the deployment of additional functional plugins to minimize the initial static footprint of the loader. See its curated YARA detection rule.

In addition to providing detection rules for new and emerging threats, we continuously enhance our detection systems for known threats, including updates to YARA rules and configuration extractors. This week, we've updated YARA rules for 34 families and improved configuration extraction for the SENDSTATE family. These updates ensure you have the latest indicators and enhanced visibility into evolving threats. Some examples of families with recent YARA rule updates include: SHADOWLADDER, SOGU, and WARPWIRE.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

🆕 New Countries and Industries Profiles. Complementary to Threat Profiles, our newest Countries and Industries Profiles provide quarterly, AI-synthesized intelligence tailored to specific geographic or sectoral threats. By consolidating expert-curated data and OSINT into intuitive visual analytics, these profiles eliminate manual data triaging, allowing you to command a clear view of your specific threat landscape.

🆕 New Hacktivist DDoS Activity Dashboard. The Hacktivist DDoS Activity dashboard is a specialized monitoring interface within Google Threat Intelligence that tracks distributed denial-of-service threats claimed by a curated list of hacktivist groups. It integrates telemetry from actor-controlled botnet command-and-control (C2) infrastructure and data harvested from hacktivist Telegram channels. This specialized interface empowers analysts to monitor Channel Activity Trends and identify the Geographic and Industrial distribution of victims at a glance. By surfacing these targeted statistics, the dashboard enables organizations to move from general awareness to a tailored, industry-specific defensive posture.

🔄 Livehunt Rule Now Tagged on Network Indicator Reports. Livehunt is the real-time detection engine within Google Threat Intelligence, designed to monitor the continuous stream of incoming IoCs. While built on YARA, traditionally used to classify files based on binary patterns, our platform significantly expands this technology. Livehunt has evolved beyond files to support network indicators, enabling YARA rules to match against URL, domain, and IP address patterns within their generated analysis reports as they are scanned and ingested.

Active Livehunt rules that trigger on network indicators are now explicitly identified within their analysis reports. Rule names are tagged directly below the indicator and listed under a dedicated section of the DETECTION tab, providing immediate context. This update allows you to instantly see which specific hunt or threat actor campaign flagged an indicator during its analysis.

🔄 Enhanced Time-Range Precision for Time Search Modifiers. The Intelligence Search tool within Google TI allows security researchers to hunt for IoCs (files, URLs, domains, IP addresses) across a massive historical dataset using advanced modifiers like fs, ls, la (first submission, last submission, last analysis).

Previously, using the fs:YYYY-MM-DD modifier would only return IoCs submitted at exactly 00:00:00 on that date. With this update, entering a date such as fs:2025-02-19 now returns all IoCs submitted during the entire day.

Additionally, to provide better clarity, the Google TI user interface will automatically expand your query to the range format fs:2025-02-19+ fs:2025-02-20-. This visual change confirms that the search covers the full window from the start of the selected day to the start of the next.

Try it: entity:file gti_score:100 fs:2025-02-19!

📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays

• Hunting for LOLBins using Advanced Searches

💪 Detection Highlights. This weekly update from the Google Threat Intelligence Group and FLARE team includes new and enhanced detection content for Google Threat Intelligence. We've released YARA rules covering 17 newly tracked malware families and updated YARA rules for 35 existing families. Additionally, we've enhanced our configuration extraction capabilities for 2 known malware families. Our prioritization for these updates is driven by malware actively observed in Mandiant incident response engagements, Google SecOps customer environments, and top Google TI search trends.

As part of our ongoing research into emerging threats, we've developed and released new YARA detection signatures for several malware families. Notable additions include:

• SANTASTEAL: SANTASTEAL is a C-based malware-as-a-service (MaaS) designed for stealth, operating entirely in memory to bypass traditional detection. Functioning as a rebranding of the Blueline Stealer project, it harvests sensitive data from browsers, crypto wallets, and messaging platforms like Discord and Telegram. See its curated YARA detection rules.
• SIDEFOX: SIDEFOX is a specialized infostealer that harvests passwords, credit cards, and session tokens. By injecting code into browsers and targeting apps like Discord, Steam, and Telegram, it allows attackers to bypass user protections and hijack accounts almost instantly. See its curated YARA detection rules.
• ROTORWIPE: ROTORWIPE is a disruptive payload written in C++ which makes use of the Mersenne Twister algorithm to compute a random buffer which is used to overwrite data on the victim's device. ROTORWIPE identifies and enumerates the device's logical drives; it then enumerates files and folders on the given drive and begins overwriting the data while aiming to ignore files in specific root directories. After parsing all child directories, each file is then overwritten with random data from the Mersenne Twister algorithm in 16-byte chunks. After overwriting the files, ROTORWIPE sleeps for 5 seconds before enumerating the drives and attempting to delete each file. After the file deletion activity is complete, the malware exits. See its curated YARA detection rule.

Beyond tracking new threats, we continuously enhance our detection capabilities for established malware families. This week, we've focused on improving our configuration extraction systems for threats such as: MIRAI and UPATRE. These updates ensure you have the latest indicators that were extracted by our configuration extraction systems.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

🆕 Enhanced Private Scanning: Clipboard Keystroke Injection. Private Scanning provides a dedicated, isolated environment for analyzing files and URLs. This ensures that Indicators of Compromise (IoCs) and their reports remain strictly confidential and are never shared with the public community.

Beyond advanced configuration settings, users can interact with the sandbox in real-time during file detonation. This interactive experience now includes a virtual clipboard: simply open the options menu on the left of the interface and select the "Clipboard" option to paste content directly into the sandbox.

💪 Seamless File Integration for Agentic Context. Agentic is an AI-powered analysis interface built to automate complex investigative workflows. By leveraging specialized agents with direct access to Google Threat Intelligence datasets and analysis engines, users can rapidly summarize threats and pivot through malicious infrastructure.

We have streamlined how you upload context files to Agentic as an expansion of your prompt such as a list of IoCs to summarize threats and explain complex logic, or a code snippet to explain its purpose. You can now instantly upload files to your session using 2 new intuitive methods:

• Drag-and-Drop (New): simply drag files from your local system directly into the Agentic conversation box.
• Copy and Paste (New): Use standard keyboard shortcuts (copy/paste) to paste files instantly to the chat.
• Manual Upload: you can still click the + button below the Agentic conversation box followed by the Upload file as context option to select files from your device.

🔄 Agentic Updates: New Report Tag for Prompt Templates. Agentic Prompts are reusable query templates within the Agentic conversational AI platform. They allow security analysts to create standardized, structured instructions for the AI agents to automate and accelerate recurring threat investigation, malware analysis, and reporting workflows in Google TI.

We have introduced a Reports tag as a new prompt template category. This tag is automatically applied to templates crafted by the Google TI team that are specifically designed to generate structured outputs such as emerging threat profiles, cybersecurity news summaries, and in-depth analysis. Users can now filter by this tag within the Prompts view to instantly locate report-specific templates, streamlining the transition from raw intelligence to finished documentation.

🔄 Bulk User Management for Group Administrators. The Group Management suite within the Google Threat Intelligence platform allows administrators to oversee their organization’s users, service accounts, features allowance and consumption and all group settings. It provides a centralized interface (and API) to control who has access to the platform and what specific modules they can interact with.

Group administrators can now perform administrative tasks in bulk, significantly reducing the manual effort required to manage large-scale environments. Specifically:

• Bulk Onboarding: administrators can add multiple users to a group simultaneously by providing a comma-separated list of email addresses. New users receive an automated invitation, while existing users are added immediately.
• Bulk Privilege Management: group roles (Admin vs. User) and module-specific permissions (for DTM, ASM and Private Scanning) can now be managed collectively.

📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays

• Operationalizing Agentic AI

💪 Detection Highlights. The Google Threat Intelligence Group and FLARE team consistently update Google TI's YARA rules and malware configuration extractors. This week, we've released YARA rules covering 11 newly tracked malware families. We've also enhanced our detection capabilities for 3 known malware families by expanding our configuration extraction platform, and updated YARA rules for many existing families. This update prioritizes malware families actively observed in Mandiant incident response engagements, SecOps customer environments, and top GTI search trends.

As we track new malware families found through our research, we build and release detection signatures. Some recent examples include:

• SIDEFOX: a specialized infostealer that harvests passwords, credit cards, and session tokens. By injecting code into browsers and targeting apps like Discord, Steam, and Telegram, it allows attackers to bypass user protections and hijack accounts almost instantly. See its curated YARA detection rules.
• ROTORWIPE: a disruptive payload written in C++ which makes use of the Mersenne Twister algorithm to compute a random buffer which is used to overwrite data on the victim's device. ROTORWIPE identifies and enumerates the device's logical drives; it then enumerates files and folders on the given drive and begins overwriting the data while aiming to ignore files in specific root directories. After parsing all child directories, each file is then overwritten with random data from the Mersenne Twister algorithm in 16-byte chunks. After overwriting the files, ROTORWIPE sleeps for 5 seconds before enumerating the drives and attempting to delete each file. After the file deletion activity is complete, the malware exits. See its curated YARA detection rule.
• CHROMEDREAM: a credential-stealing malware written in Rust. Its primary function is to locate the victim's Chrome browser's saved username and password credentials, extract them from the Login Data and Local State files, decrypt the passwords, and then display the recovered information in the console window. See its curated YARA detection rule.

In addition to providing detection rules for new and emerging threats, we continue to update our detection systems for threats like SYSTEMBC, DANABOT, and EMOTET. These updates ensure you have the latest indicators that were extracted by our configuration extraction systems.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

💪 Code Insight now supports OpenClaw skill packages. As a Gemini-powered assistant for malware analysts and reverse engineers, Code Insight uses AI to strip away obfuscation and generate clear, natural language summaries of a file’s true intent. With OpenClaw skills rapidly emerging and abused by malicious actors as a supply-chain threat delivery channel, we’ve extended our analysis to OpenClaw skill packages looking past a package’s "claimed" purpose. Instead, Code Insight evaluates what the skill actually does from a security perspective. This provides analysts with a concise, security-first description of real behavior, making it easy to identify malicious patterns hidden behind seemingly helpful functionality.

As described in the blog posts below, this initiative has analyzed more than 3,016 OpenClaw skill packages, unmasking a variety of malicious behaviors: sensitive data exfiltration, remote control via backdoors, direct malware installation and techniques for persistence and propagation.

1. From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized
2. From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills

Search for samples with the following advanced query: entity:file has:codeinsight codeinsight:"Type: OpenClaw Skill" codeinsight_verdict:malicious

💡 Remember! Private Scanning + Livehunt Rules. Private Scanning is a dedicated service that allows organizations to analyze files and URLs in total isolation. This ensures that IoCs and resulting reports remain strictly confidential and are never shared with the public community.

• Remember that when scanning URLs and files with Private Scanning, your IoCs are checked against not only crowdsourced YARA, SIGMA, and IDS rules, but also your own active Livehunt YARA rules.

📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays

• Leveraging Threat Graph

💪 Detection Highlights. The Google Threat Intelligence Group and FLARE team continuously enhance Google TI's detection capabilities. This week, we've released YARA rules for 6 newly tracked malware families and updated YARA rules for 10 existing families. Our configuration extraction platform also received an update for 1 malware family. Our content prioritization focuses on threats actively observed in Mandiant incident response engagements, Google SecOps customer environments, and top Google TI search trends.

As part of our ongoing research into emerging threats, we've added detection signatures for several new malware families. Some recent examples include:

• VOIDLINK: a modular Linux command and control (C2) framework written in the Zig programming language. It is optimized for cloud and containerized environments, utilizing eBPF and LKM-based rootkits for persistence and stealth. The framework features an extensive plugin API and adaptive evasion strategies that adjust behavior based on the detected security products and cloud provider (AWS, GCP, Azure, Alibaba, and Tencent). See its curated YARA detection rules.
• CORESTING: a file infector written in C++ designed to modify the Windows termsrv.dll file, which is responsible for Remote Desktop Services. Its primary function is to enable multiple concurrent Remote Desktop sessions or bypass licensing restrictions by patching specific byte patterns within the dynamic-link library (DLL). See its curated YARA detection rule.
• ECHONOISE: a Linux backdoor written in Rust. ECHONOISE can communicate with its command and control server using multiple protocols including TCP, KCP, WebSocket and QUIC. ECHONOISE capabilities include command execution, socks proxying, port forwarding, file upload, download, deletion and execution. See its curated YARA detection rule.

Beyond tracking new threats, we also continuously update our detection content for known and prevalent malware families. This week's updates include enhanced YARA rules and configuration extraction capabilities for threats such as: VIDAR, PALEBEAM, DOGCALL

These updates ensure you have the most current indicators and insights derived from our analysis.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

📢 Mastering the Hunt: New Practitioner-Oriented Content. Threat hunting is only as good as the intelligence backing it. To help you put that intelligence into action, we’ve released two new practitioner-focused blog posts that walk you through hunting specific threats on our platform. We dive deep into real-world scenarios, ranging from tracking a widespread Infostealer campaign to dissecting a malicious "Electronic Invoice" EPUB file.

• New Infostealer Campaign Targets Users via Spoofed Software Installers
• A fake EPUB lecture

📢Agentic is now GA. We are thrilled to announce that Agentic, our multi-language AI-powered conversational platform, has moved from public preview to General Availability (GA) for all Google Threat Intelligence Enterprise and Enterprise + customers. This milestone marks a significant step in democratizing high-level threat research by putting an expert AI assistant at the fingertips of every security analyst.

Read more: Transforming Defense Workflows with Agentic

💪 Intelligence at Speed - Instant Executive Briefs Powered by Agentic. Agentic conversational AI platform was integrated across all public IoC analysis reports (files, URLs, domains, IP addresses) and now we have extended this functionality to Private Scanning as well. This capability is accessed via a single 'Brief' button at the top of private files and URLs reports, which automatically initiates a conversation within the Agentic interface, allowing the AI to produce an executive summary focused specifically on the selected IoC.

📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays

• Leveraging TTP Analysis

💪 Detection Highlights. The Google Threat Intelligence Group and FLARE team consistently enhance Google TI's detection capabilities. This week, we've released YARA rules covering 5 newly tracked malware families. We've also enhanced our detection capabilities for 19 existing malware families, including updates to YARA rules for 17 families and configuration extractors for 2 families. Our prioritization for new and updated content focuses on malware families actively observed in Mandiant incident response engagements, Google SecOps customer environments, and top GTI search trends.

As we track new malware families found through our research, we build and release detection signatures. Some recent examples include:

• FROSTCANOPY: a shell script that injects malicious PHP code into legitimate device management web pages. The injected code can harvest credentials and facilitate the remote exfiltration of stolen data via a secret URL. Furthermore, this tool incorporates functions to perform timestomping and erasing traces of file modification. See its curated YARA detection rules.
• ANGRYPICKLE: a downloader written in JavaScript. After performing multiple layers of internal deobfuscation, the code will download a next stage JavaScript script from a remote server and execute that code within the confines of the ANGRYPICKLE's process space. The code uses ActiveX VBScript to interact with the victim's computer from within the JavaScript process. See its curated YARA detection rule.
• LUNAMIST: a C-based backdoor with capabilities for command execution and the bidirectional transfer (upload and download) of files. It initiates communication by issuing HTTP POST requests to its command-and-control (C2 or C&C) infrastructure; the subsequent responses contain commands encapsulated within RSA-encrypted JSON data for execution on the compromised system. See its curated YARA detection rule.

In addition to providing detection rules for new and emerging threats, we continuously update our detection systems for known threats. Recent updates include: SLIVER, SNOWLIGHT, and FAKETREFF. These updates ensure you have the latest indicators and enhanced detection capabilities, including those extracted by our configuration extraction systems.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

🔄 Updated Conversation Retention Policy in Agentic. Agentic, our AI-powered assistant designed to streamline complex security workflows, now features an automated cleanup process.
We are introducing a new retention policy to keep your workspace organized and focused on active investigations. Conversations inactive for 30 days will now be automatically removed from your Recent sessions. As long as you continue to interact with a specific conversation, it will remain accessible, ensuring your ongoing investigations are preserved while clearing out stale data.

💪 Vulnerabilities Cards: Enhanced Identification with MVE IDs. The Vulnerability Intelligence module within Google TI aggregates and contextualizes security vulnerabilities. It provides a comprehensive view of each vulnerability, including exploitation state, consequence and vectors, risk ratings, mitigations, and direct links to related malware families, threat actors, and active campaigns if possible. Vulnerability cards now include MVE IDs (Mandiant Vulnerability Enumeration) as alternative names. This integration provides a more comprehensive view of vulnerabilities by bridging the gap between standard CVE identifiers and Mandiant’s proprietary research, ensuring analysts can find relevant intelligence regardless of the naming convention used in their source reports.
See example.

🔄 Topic-Based News Analysis Reports. Google Threat Intelligence offers curated analyst Reports, OSINT articles and real-time insights, helping organizations stay ahead of an ever-changing threat landscape. News Analysis curated reports are now organized by topic. This way, instead of focusing on individual news articles, we cover OSINT topics more holistically, generating titles and summaries based on all available OSINT (including blogs, whitepapers, vendor advisories, and more). While the visual style remains consistent, the Media Summary section now features source URLs and text-based timelines where applicable, making it easier to track and verify information.
See example.

We will continue to iterate on this product to ensure we are providing customers with the best possible information available and relating OSINT topics to our vast library of knowledge.

📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays

• Malware config extractor

💪 Detection Highlights. The Google Threat Intelligence Group and FLARE team consistently update Google TI's YARA rules and malware configuration extractors. This week, we've released YARA rules covering 7 newly tracked malware families, and enhanced our detection capabilities for 26 existing families through updated YARA rules and configuration extractors. Our updates prioritize malware families actively observed in Mandiant incident response engagements, SecOps customer environments, and top GTI search trends.

As we track new malware families found through our research, we build and release detection signatures. Some recent examples include:

• POLLREGISTER: is a backdoor written in C++ that provides a persistent communication channel to its controller using WebSocket Secure (WSS) after an initial HTTPS connection to register the host with its controller. The backdoor is capable of executing arbitrary shell commands; loading arbitrary dynamic-link libraries (DLLs); and performing file manipulation, file uploading and downloading, process listing, process termination, and drive enumeration. See its curated YARA detection rule.
• SIDEFOX: is a specialized infostealer that harvests passwords, credit cards, and session tokens. By injecting code into browsers and targeting apps like Discord, Steam, and Telegram, it allows attackers to bypass user protections and hijack accounts almost instantly. See its curated YARA detection rule.
• DARKKEY.LOCKER: is a backdoor written in PowerShell and supports arbitrary PowerShell command execution. DARKKEY.LOCKER obtains its C2 address from the DNS TXT records of another domain and communicates with the C2 using JSON over a Secured WebSocket (WSS). DARKKEY.LOCKER establishes persistence via a registry run key, can perform keylogging, access clipboard data, screen monitor, and perform self deletion. See its curated YARA detection rules.

In addition to providing detection rules for new and emerging threats, we continue to update our detection systems for threats like EMOTET, SLIVER, and MIRAI. These updates ensure you have the latest indicators that were extracted by our configuration extraction systems and YARA rules.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

🔄 Unified Support: Google Threat Intelligence Joins the GCP Support Process. The Google TI Support Portal is the dedicated channel for technical assistance, troubleshooting, account queries and users feedback. It has now been fully integrated into the Google Cloud Platform (GCP) Support ecosystem to provide a unified experience across Google Cloud services.

🔄 Consolidation of vulnerability reporting. Google Threat Intelligence provides continuously updated, in-depth insights to help organizations navigate the evolving cyber threat landscape via curated Reports written by Google Threat Intelligence analysts. In order to reduce duplicative reporting, we are consolidating the following reports into the existing Weekly Vulnerability Exploitation Report (WVER):

• OT Vulnerability Exploitation Roundup
• Industrial Control Systems and Medical Vulnerability Advisories Reported by CISA
• Cloud Vulnerabilities

By adding new dedicated fields, such as Affects OT and Affects Cloud, to the WVER reports, we ensure you receive the same critical data with greater frequency and in a single, comprehensive view.

🆕 CAPE sandbox executable payload extraction now in Private Scanning. Leveraging CAPE-based sandboxing, our platform automates dynamic malware unpacking and YARA classification of captured payloads. This capability has been expanded to Private Scanning, where unpacked payloads now feature an Analysis button for independent detonation. This workflow defines parent-child relationships within the Payload Files section of the RELATIONS tab using their SHA256 hashes.

💪 Agentic AI Now Integrates with IoC Stream. Agentic is the AI-powered assistant within Google Threat Intelligence, designed to streamline complex security workflows. Acting as a force multiplier, Agentic enables security teams to leverage natural language to query expansive datasets, automate investigations, and synthesize technical reports. Agentic is now integrated with the IoC Stream, your centralized IoCs notification hub. This connection allows you to investigate notification statuses and extract immediate insights directly through the Agentic interface.

💪 Bulk IoC Investigations in Agentic Google TI. Agentic, our AI-powered assistant, now supports Bulk IoCs, enabling users to search for multiple indicators of compromise simultaneously. By uploading a context file containing your IoC list, you can now trigger a comprehensive batch investigation, significantly reducing response times and accelerating the identification of relevant threats.

📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays

• Behavior signature hunting
• Hunting Holiday Threats in late December Campaigns
• Private IoC Collections

💪 Detection Highlights. The Google Threat Intelligence Group and FLARE team consistently enhance Google TI's YARA rules and malware configuration extractors. Over the past week, we've released YARA rules covering 5 newly tracked malware families and updated YARA rules for 8 existing families. Additionally, we've expanded our configuration extraction platform to cover 1 new malware family. These updates prioritize malware families actively observed in Mandiant incident response engagements, SecOps customer environments, and top GTI search trends.

As we track new malware families identified through our research, we develop and release detection signatures. Some recent examples include:

• BOATBRICK: a malicious JavaScript-based credential harvesting extension, distributed as a .crx archive, specifically targeting the Chrome environment. This extension is designed to facilitate illicit activities such as user-agent spoofing, search hijacking, and sophisticated advertising fraud. Its primary objective is to covertly exfiltrate the entire contents of the victim's Chrome user profile databases. See its curated YARA detection rules.
• BOATMOOR: a credential stealer written in C#. The stealer exfiltrates sensitive user data including saved passwords, cookies, browsing history, and bookmarks from Mozilla Firefox, Microsoft Edge, Opera, and Opera GX. Data is merged into a local Google Chrome user profile database prior to exfil by BOATBRICK. See its curated YARA detection rule.
• COLDSAUCE: a fully featured Windows backdoor written in C/C++. COLDSAUCE communicates with its command-and-control (C2 or C&C) server using QUIC. COLDSAUCE capabilities include system information collection, screenshot capture, keystrokes capture, file system operations, and file upload and download. COLDSAUCE also provides an interactive shell that supports a number of commands that are custom implementations of common Windows command-line tools. See its curated YARA detection rules.

In addition to providing detection rules for new and emerging threats, we continuously update our detection systems for known threats such as:GAFGYT, TIMEDRAIN, and FLASHHOOK.

These updates ensure you have the latest indicators, including those extracted by our configuration extraction systems.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

💪 New Middle East Storage Region for Private Scanning. Private Scanning is a dedicated service within Google Threat Intelligence that allows organizations to submit suspicious files and URLs for both static and dynamic analysis. Unlike public submissions, this service ensures that all IoCs, execution data, and resulting analysis reports remain completely confidential and are never shared with the public or the broader community. To support local data residency and governance requirements, we have expanded our global infrastructure to include the Middle East as a new region for temporary storage. This update offers regional customers greater flexibility in aligning their security operations with local compliance standards.

🆕 Agentic Workflows Supercharged with Gemini 3. Agentic is the AI-powered assistant integrated within Google Threat Intelligence, designed to simplify and streamline complex threat intelligence tasks. It acts as a force multiplier for security teams, allowing them to interact with Google TI’s expansive dataset using natural language to automate investigations, generate complex queries, and synthesize technical reports. We have upgraded the underlying engine of Agentic from Gemini 2.5 to Gemini 3, bringing significant advancements to the system's reasoning capabilities and overall behavior.

🆕 New OCR detection in Agentic. Agentic, our AI-powered assistant, now supports file uploads as context, allowing for deeper analysis. This update includes OCR support for PDF files, and we are actively expanding this capability to other file types, so stay tuned for updates.

💪 Intelligence at Speed - Instant Executive Briefs Powered by Agentic. We have integrated the Agentic Conversational AI platform across all major IoC analysis reports (files, URLs, domains, IP addresses). This new capability is accessed via a single 'Brief' button. After selecting a set of IoC analysis reports, clicking the 'Brief' button automatically initiates a conversation within the Agentic interface, allowing the AI to produce an executive summary focused specifically on the selected entities' recent activity.

🆕 New outbound 3rd-party integrations. Integrations are vital to operationalizing Google Threat Intelligence, converting raw security insights into immediate, effective defensive action. These crucial integrations help organizations eliminate siloed data and dramatically enhance their security ecosystem, boosting efficiency and accelerating Mean Time to Resolution (MTTR).

New integrations released:

• Google SecOps - see user guide here
• Wiz - see user guide here
• FortiSOAR - see documentation here

💪 Detection Highlights. The Google Threat Intelligence Group and FLARE team regularly enhance Google TI's YARA rules to provide comprehensive malware detection. In this update, we've released YARA rules covering 6 newly tracked malware families and updated detections for 30 existing families. Our content development is prioritized based on malware actively observed in Mandiant incident response engagements, Google SecOps customer environments, and top GTI search trends.

As we track new malware families found through our research, we build and release detection signatures. Some recent examples include:

• SANDGLASS: SANDGLASS is a backdoor written in Python capable of arbitrary command execution and different file operations.
• GRIMROUTE.V2: GRIMROUTE.V2 is a cross-platform ransomware family written in Rust that targets Windows and Linux VMware ESXi environments. Operating as a command-line utility, GRIMROUTE.V2 requires specific runtime arguments to define its execution scope. It employs a high-performance, multi-threaded architecture to encrypt files using the ChaCha12-Poly1305 stream cipher. GRIMROUTE has dropped ransom notes identifying itself as AETHERION ransomware.
• CRUDEEXCLUDE: CRUDEEXCLUDE is a utility written in Delphi that comes packaged with a basic GUI application that tries to masquerade as a chat application. Rather than download or drop a payload, CRUDEEXCLUDE instead sets up the staging directories that have historically housed HEAVYGRAM and SHADEGENES and sets them as exclusions for Microsoft Defender. CRUDEEXCLUDE then beacons a message to a hard-coded Telegram chat ID using a hard-coded bot token. The message is formatted like the following, PC Name:<pc_name> Excluded!. The response from Telegram is not used in any way, so this may indicate the purpose of CRUDEEXCLUDE is to simply masquerade as a chat application and setup the environment for HEAVYGRAM and/or SHADEGENES.
• SLEEKSTROKE: SLEEKSTROKE is a passive backdoor written in C++ designed to operate on Citrix NetScaler devices. During startup the backdoor creates a PHP webshell component in a web accessible location and uses it to receive commands via named pipes. Supported backdoor commands include system command execution, file listing, file removal and directory creation. The backdoor is capable of monitoring Apache HTTP logs and removing entries indicating access to the webshell component.
• SURFCAKE: SURFCAKE is a downloader written in JavaScript that communicates over HTTPS or HTTP. SURFCAKE is capable of process termination, user enumeration, registry modification, self-update, and installation.

In addition to providing detection rules for new and emerging threats, we continue to update our detection systems for threats like SNOWLIGHT, INVISIBLEFERRET, and BEAVERTAIL. These updates ensure you have the latest YARA-based detections for these persistent threats.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

📢 Google TI Mondays. Quick reminder to Follow the Google TI Mondays series across our social platforms every week for quick, actionable practitioner tips and product adoption advice designed to enhance your efficiency. These actionable tips are essential. #GoogleTIMondays

• Saved Searches in Google Threat Intelligence
• Private IoC Collections

💪 Detection highlights. The Google Threat Intelligence Group and FLARE team consistently update Google TI's YARA rules and malware configuration extractors. This week, we focused on improving coverage for existing malware families. We updated 11 YARA rules and 2 configuration extractors. A few examples of families we updated our coverage for are: VIDAR, POISONPLUG.SHADOW, and GLUPTEBA.

These updates ensure you have the latest indicators that were extracted by our configuration extraction systems and YARA rules.

See latest malware family profiles added to the knowledge base and the complete list of curated YARA rules in our database.

🆕 Ransomware Data Leaks endpoint exposed. The Ransomware Data Leaks dashboard is our threat intelligence tool focused on aggregating data from numerous leak sites (DLS) to track extortion trends, victim volume, and active threat actor brands that serves as a strategic "command center" for cybersecurity teams. Now the new endpoint allows customers to programmatically retrieve the raw data powering the dashboard, enabling the seamless integration of ransomware intelligence into automated security workflows, custom reporting, and internal SOAR platforms. Our documentation provides practical examples to help you get started with this endpoint.

🆕 New URL search modifiers. The Intelligence Search feature allows users to execute complex and powerful queries against our expansive dataset of malicious indicators, enabling threat hunters to uncover infrastructure, track campaigns, and identify evolving threats. We have introduced three new search modifiers for URL entities: last_modified, last_modification_date, and lm​​. These modifiers allow analysts to filter URL indicators based on the exact time they were last updated in our database.
See example.