New Unfurling Hemlock threat actor floods systems with malware

Outpost24's KrakenLabs uncovered a long-running (since at least Feb 2023) Unfurling Hemlock campaign that uses a nested CAB 'cluster bomb' delivered via WEXTRACT.EXE to drop multiple malware payloads (including Redline, RisePro, Mystic Stealer, loaders like SmokeLoader and Amadey, and utilities that disable protections), affecting primarily US targets and other countries; researchers observed tens of thousands of related files and note indicators (Russian language in samples, AS203727 hosting) pointing to an Eastern European base.