- \n
- Two new ransomware families, GREENBLOOD and BQTLock<\/strong>, capable of disrupting business operations within minutes and combining encryption with data theft, were identified this month. <\/li>\n<\/ul>\n\n\n\n
- \n
- Two new RATs \u2014 Moonrise and Karsto<\/strong> \u2014 were caught with zero detections on VirusTotal at the time of analysis, illustrating the growing gap between static detection and real-world threats. <\/li>\n<\/ul>\n\n\n\n
- \n
- Thread-hijack phishing<\/strong> reached a new level of sophistication, with attackers inserting themselves into real C-suite email conversations to deliver layered credential-theft campaigns using the EvilProxy phishing kit. <\/li>\n<\/ul>\n\n\n\n
- \n
- Enterprise phishing<\/strong> infrastructure is now routinely hosted on trusted cloud platforms: Microsoft Azure, Google Firebase, and Cloudflare. This makes URL reputation checks and blocklists increasingly unreliable as standalone defenses. <\/li>\n<\/ul>\n\n\n\n
1. The New Threats Nobody Had Signatures For <\/h2>\n\n\n\n
ANY.RUN analysts identified four new malicious families in February 2026 \u2014 two ransomware strains and two remote access trojans \u2014 all of which either evaded static detection entirely or compressed the window for defenders to respond. <\/p>\n\n\n\n
GREENBLOOD: Fast Encryption, Evidence Removal, and Immediate Business Exposure <\/h3>\n\n\n\n
GREENBLOOD is a newly identified<\/a> Go-based ransomware built for speed, stealth, and pressure. Rather than relying on encryption alone, it combines rapid file locking with self-deletion to reduce forensic visibility, and adds data-leak threats through a TOR-based site \u2014 transforming a technical incident into a full business crisis involving downtime, regulatory exposure, reputational damage, and recovery cost. <\/p>\n\n\n\n
ANY.RUN’s Interactive Sandbox<\/a> captured the full attack chain in real time. <\/p>\n\n\n\n
View detonation<\/a> <\/p>\n\n\n\n
![\"\"](\"\/cybersecurity-blog\/wp-content\/uploads\/2026\/03\/febr_1-1024x576.png\")
GREENBLOOD exposed inside ANY.RUN sandbox<\/em> <\/figcaption><\/figure>\n\n\n\n Analysts observed: <\/p>\n\n\n\n
\u2022 ChaCha8-based encryption<\/strong> capable of disrupting operations within minutes of initial execution. <\/p>\n\n\n\n
\u2022 Attempts to delete the original executable, limiting post-incident forensic visibility<\/strong>. <\/p>\n\n\n\n
\u2022 A TOR-based leak site to add extortion<\/strong> leverage beyond file recovery. <\/p>\n\n\n\n
Teams using TI Lookup can search for other GREENBLOOD sample analyses to uncover variants and expand detection coverage across environments: <\/p>\n\n\n\n
- Enterprise phishing<\/strong> infrastructure is now routinely hosted on trusted cloud platforms: Microsoft Azure, Google Firebase, and Cloudflare. This makes URL reputation checks and blocklists increasingly unreliable as standalone defenses. <\/li>\n<\/ul>\n\n\n\n
- Thread-hijack phishing<\/strong> reached a new level of sophistication, with attackers inserting themselves into real C-suite email conversations to deliver layered credential-theft campaigns using the EvilProxy phishing kit. <\/li>\n<\/ul>\n\n\n\n
- Two new RATs \u2014 Moonrise and Karsto<\/strong> \u2014 were caught with zero detections on VirusTotal at the time of analysis, illustrating the growing gap between static detection and real-world threats. <\/li>\n<\/ul>\n\n\n\n
![\"\"](\"\/cybersecurity-blog\/wp-content\/uploads\/2026\/03\/febr_2-1024x488.png\")