Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Securonix Threat Research team has identified an ongoing espionage campaign, tracked as SHEETCREEP, where threat actors deliver a C# remote access trojan through a diplomatic-themed ISO phishing lure.

Securonix Threat Research tracks TAX#TRIDENT, an active fake Indian Income Tax-themed campaign that uses three delivery paths to reach Windows endpoints. The campaign starts with fake tax assessment lures and then moves victims toward ZIP files, VBScript downloaders, or PHP-looking web endpoints that actually return script content.

Modern security teams are not lacking data. They are drowning in it. Threat intelligence feeds, indicators, campaigns, internal detections, and investigation artifacts are constantly growing in volume and complexity. Yet when analysts need answers, they are often forced to manually search, pivot, correlate, and interpret across multiple data points. This creates a familiar problem: too much data, not enough clarity.

For most organizations, answering these questions is slow, manual, and difficult to defend. Analysts must interpret threat reports, build SIEM queries, run retroactive searches, and validate findings under pressure. The result is delayed answers, inconsistent processes, and limited confidence at the executive level. This is the gap between threat awareness and proof of exposure. It is where operational risk and board-level scrutiny converge.

Every security leader knows the sequence. A new threat breaks; reports start circulating, and within minutes the same questions are moving through the organization. Are we exposed? Does this change our risk? What are we doing about it?

Phishing campaigns leveraging remote management tools is nothing new. Securonix Threat Research has conducted in-depth dynamic analysis of an ongoing phishing campaign targeting multiple vectors, active since at least April 2025. The campaign has impacted over 80 organizations, predominantly in the United States, spanning multiple sectors. This campaign leverages vendor-signed Remote Monitoring and Management (RMM) software to establish silent, persistent access.

Securonix Threat Research analyzed a stealthy Python-based backdoor framework, dubbed Deep#Door, which uses an obfuscated batch loader to deploy a persistent surveillance and credential-stealing implant on Windows systems.