23-09-2026
Threat Intel \| One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign
https://blog.lastpass.com/posts/lastpass-delphos-report-rapuncel-infostealer
Report completeness: High
Actors/Campaigns:
Blacksnufkin
Threats:
Rapuncel
Cruciferra
Purosangue
Boryptgrab
Av-killer
Dll_sideloading_technique
Uac_bypass_technique
Byovd_technique
Process_hollowing_technique
Cncrypt_protect_tool
Reflectiveloader
Tunnesshclient
Heaconload
Dll_injection_technique
Process_injection_technique
Aitm_technique
Victims:
Lastpass, Software companies, Cryptocurrency users, Discord users, Steam users, Telegram users
TTPs:
Tactics: 3
Technics: 15
IOCs:
Domain: 8
File: 27
Url: 2
IP: 6
Hash: 7
Path: 1
Registry: 1
Soft:
LastPass, Discord, Steam, Telegram, NativeAOT, macOS, Windows registry, Google Chrome, Chrome, NVIDIA graphics, have more...
Algorithms:
sha256, chacha20, zip
Win API:
PsLookupProcessByProcessId, ObOpenObjectByPointer, ZwTerminateProcess, SeAccessCheck
Win Services:
bits
Languages:
golang, javascript
Platforms:
x64, intel
Links:
https://github.com/BlackSnufkin/BYOVD/tree/main/CcProtect-Killer