Several malicious campaigns have been uncovered, targeting various systems and individuals. Ransomware actors are leveraging SSH tunneling to persist on VMware ESXi bare metal hypervisors, while a North Korean threat group, Andariel, is using a technique called RID hijacking to trick Windows into treating low-privileged accounts as administrator accounts. Additionally, a threat actor has been targeting low-skilled hackers with a fake malware builder that secretly infects them with a backdoor, allowing the attacker to steal data and take over computers. Meanwhile, a malware campaign is utilizing a PowerShell-based loader called MintsLoader to distribute secondary payloads, including the StealC information stealer and the legitimate BOINC network computing platform, targeting the electricity, oil and gas, and legal services sectors in the US and Europe. These campaigns highlight the importance of monitoring system logs, restricting tool execution, and protecting accounts with multi-factor authentication, as well as the need to be cautious when downloading and installing software, especially from untrusted sources. Researchers have been able to disrupt some of these campaigns, but many devices remain compromised, emphasizing the need for continued vigilance and proactive security measures to prevent and detect these types of attacks. CTIX analysts will continue to report on the latest malware strains and attack methodologies.