Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Today we are thrilled to announce that Netskope has once again been named a Leader in the Gartner Magic Quadrant for Security Service Edge (SSE). This is the fourth year in a row Netskope has been recognized as a Leader, and we have been recognized as a Leader every time since the inaugural 2022 Magic Quadrant for SSE.

The adversary group commonly referred to as Scattered Spider is also tracked as UNC3944, Muddled Libra, Octo Tempest, Starfraud, Scatter Swine, 0ktapus, Roasted 0ktapus, and Storm-0875. Active since at least 2022, this financially motivated group has rapidly gained notoriety for its social engineering campaigns and ransomware attacks, which span multiple sectors.

In recent months, the Netskope Threat Labs team has observed several different campaigns delivering the PureHVNC RAT and its plugins. In 2024, the same malware was observed being delivered via a Python chain, and a few days ago, it was also observed using genAI sites to lure victims. In this blog post, we’ll describe an infection chain using different methods to lure the victim and successfully deliver the PureHVNC RAT.

Enterprises today operate in a hyper-distributed environment where users, devices, applications, and workloads are no longer confined within traditional corporate boundaries. Whether you’re working with remote employees, branch offices, SaaS, IaaS, or non-human form factors like robots and AI workloads, everything must securely and reliably connect to everything else, along with unified policy enforcement.

In today’s interconnected world, data has become the lifeblood of business success, driving innovation, customer engagement, and operational efficiency. As organizations embark on rapid digital transformation, the proliferation of cloud computing and mobile devices, stringent privacy regulations such as GDPR and CCPA, and the rise of disruptive technologies like AI all play a key role in guiding the direction.

The future of business technology leadership is being reshaped daily; by AI, cloud-native operations, decentralized decision-making, and rapidly shifting business demands. In this evolving landscape, titles matter less than mindset. Whether you’re a CIO, a VP of engineering, a security leader, or a digital transformation manager, the way you lead through technology is changing. What defines today’s most effective business technology leaders?

During the Netskope Threat Labs hunting activities, we came across a payload that led us to a multi-stage chain involving several custom PowerShell scripts, open source tools (such as Mimikatz and Rubeus), vulnerable drivers being exploited, and red team framework payloads (such as Havoc). After further investigation, we discovered these files were part of the arsenal of what seems to be an operator of a ransomware named “DOGE Big Balls,” a variant of the Fog ransomware.