Threat Spotlight: WarmCookie/BadSpace

This Cisco Talos report analyzes WarmCookie (BadSpace), a malware family used since April 2024 that is distributed via malspam and malvertising to achieve initial access and persistence, deploy follow-on tools (CSharp-Streamer-RAT, Cobalt Strike), and maintain long-term access; the report details infection chains, recent technical changes (execution flags, C2 user-agent, self-update, commands), code similarities to the Resident backdoor, overlaps with TA866 activity, and supplies IOCs and detection/remediation guidance.