🚨 The malware arrives as a legal file from a police department email and passes SPF, DKIM, and DMARC. What's inside: a Delphi/Inno Setup installer dropping PhantomEnigma's JS backdoor that beacons, persists, and executes on command. 👨‍💻 Live detonation: https://app.any.run/tasks/1f6dd152-8b8c-427d-8b9d-b6dddd5ffb4b/?utm_source=mastodon&utm_medium=post&utm_campaign=phantomenigma_case&utm_content=linktoservice&utm_term=210726 The full report covers what your SOC needs: IOCs, YARA hunting rules, TI Lookup queries to track new compromised hosts, Suricata signatures, and MITRE ATT&CK mapping 👇https://any.run/cybersecurity-blog/phantomenigma-research/?utm_source=discord&utm_medium=post&utm_campaign=phantomenigma_case&utm_content=linktoblog&utm_term=210726 #cybersecurity #infosec