The Code Loom of Scarcruft: Stitching Ransomware into a Polyglot Intrusion

S2W TALON reports a ScarCruft‑attributed campaign targeting South Korean users that used a malicious RAR/LNK phishing lure to deploy a multi‑stage toolchain: PubNub‑based backdoors (NubSpy), information stealers (FadeStealer, LightPeek), a Transacted Hollowing Python loader (TxPyLoader), a Rust reimplementation of CHILLYCHINO, and VCD ransomware that encrypts target directories; the report provides technical analysis, MITRE ATT&CK mappings, extensive IoCs (hashes, URLs, ransom email), and recommended detection/mitigation steps.