PEERSTITCH Hid Inside FortiGate After a Management Breach
Unit 42 traced stolen configurations for 500+ firewalls, reused credentials and a memory implant. Why patching FortiManager does not revoke exposed trust.
Gridinsoft security desk
Security Blog
Fresh malware news, scam explainers, removal guides, browser fixes, and field notes from the Gridinsoft research team. Start with the alert, then move to the fix.
Xandr Fined Over Grindr Data in Ad Auctions
Norway fined Xandr NOK 92 million over historical Grindr data sharing. How app identity and device identifiers made…
A Name and a Question Mark: The Text Scam Reply Trap
A new SMS example contains only a name and a question mark. Why a correct name does not…
Guides
View all
Cronigame.exe: Discord Game-Test Scam Warning
Received cronigame.exe from a Discord friend? See what the report establishes and what to do if you downloaded, blocked, or ran the…
Repair desk
View all
GameAssembly.dll Virus Alert: Check Unity Game DLLs Safely
GameAssembly.dll or lib_burst_generated.dll quarantined? Check the game source and exact alert, keep suspect files isolated, and repair safely after review.
msiexec.exe: Safe Windows Installer or Suspicious Activity?
Calipso Ransomware: Identify .calipso Files and Recover Safely
TrojanDownloader:Win64/Penguish.PO!MTB: Alerts and Removal
WindowsPackageManagerServer.exe: Is It Safe, and How Do You Fix an Error?
ntoskrnl.exe High CPU: Trace the System Process
Trojan:Win32/Sabsik.EN.B!ml: Removal and False Positive Checks
Understand the exact Sabsik EN.B Defender alert, keep suspicious files quarantined, and use Gridinsoft Anti-Malware to investigate repeat detections.
Trojan:MSIL/Jalapeno!MTB: Removal and False-Positive Checks
Check Trojan:MSIL/Jalapeno!MTB by its file path and quarantine status. Separate browser-cache alerts from an installer that…
Domain Age of Flagged Online Stores: A Study of 1,000 Records
Gridinsoft studied 1,000 flagged store records. Compare domain ages for new records and updates, with date…
How Malware Abused Paste.tc: XWorm, LimeRAT, and AsyncRAT Cases
A cross-case investigation of how AsyncRAT, LimeRAT, and XWorm used Paste.tc raw pages as C2 resolvers…
Plushiefun.xyz PowerShell Chain Found Under HP Task Identities
Gridinsoft Labs observed plushiefun.xyz on nine endpoints where activity under Hewlett-Packard Diagnostics task identities led into…
Planet Search Chrome Extension: Is It Safe and How to Remove It
Planet Search can route Chrome searches through hidden intermediaries to Nextgeeker. Verify its ID, remove it,…
Rotating Names, Stable Loader: A Polymorphic CoinMiner Cluster on Chinese Windows Systems
Gridinsoft telemetry links 45 CoinMiner hashes across 34 Chinese Windows installations to rotating EXE names, signed…
OkoBot/TookPS: New C2 and GDrive Backup Sync Task
Gridinsoft Labs identifies 22tuk.digital as a new high-confidence TookPS/OkoBot callback and analyzes its encoded PowerShell launcher,…
Payment to Bank Details DOCX: Broken altChunk Lure Analysis
Static analysis of a suspicious Payment to Bank Details DOCX attachment with a broken altChunk/RTF import…
Latest from every desk
Mobile Security
Hirudo Android Malware: Removal and Bank App Recovery
Hirudo can replace a banking app with a tampered copy. Learn what to remove,…
Troubleshooting
DecoDigi32.exe: Is It Malware and How Do You Remove It?
Found DecoDigi32.exe after a suspicious download? Learn what user reports show, how to handle…
Security News
Cyberattack Hits French Supermarket Refrigeration
Coopérative U confirms refrigeration disruption. CERT-FR warns of compromised Danfoss AK-SM and AK-SC systems…
Security News
Ledger Confirms Hardware Implant in CryptoBilis Wallet Investigation
Ledger confirms an implant in one CryptoBilis-linked device. Why a genuine chip can miss…
Security News
GitPower Uses Fake Conference Invitations to Target Ukrainian Experts
Genians links fake conference invitations to GitPower attacks on Ukrainian experts. A PDF-looking shortcut…
Security News
YMCO Fake Jobs Turned Personal Bank Accounts Into a Cash-Out Service
Korniev’s guilty plea exposes how YMCO recruited job seekers to forward stolen bank funds.…
Security News
FBI Seizes Microscan and FishHub Domains Behind File-Theft Operations
FBI seizures expose how Microscan hid scans behind infected devices and FishHub delivered file-stealing…
Security News
Fake Offline Maps Lead Android Users to a Telegram App Trap
Cyberpolice warns that free navigator ads lead through Telegram to a malicious app. Check…
Security News
MATCHBOIL Hides a Backdoor Behind a Fake Planner
ESET traces MATCHBOIL’s fake planner, hidden execution mode and two-minute callbacks in Ukraine. Why…
Troubleshooting
SgrmBroker.exe: Is It Safe, and What Does Event 7023 Mean?
Check the exact SgrmBroker.exe event before changing Windows: separate the historical Event 7023 error,…
Security News
Noir Wallet Drainer Uses DNS to Keep Fake Crypto Pages Working
Infoblox traces Noir’s wallet-permission trap and DNS backend rotation. Why connecting, signing and disconnecting…
Security News
Fake Event Invitations Turn QR Codes Into Google Phishing
Talos traces real event details, altered poster QR codes and a live Google sign-in…