Underground Malicious Tools: Investigating Propagation

This report documents underground forum activity promoting several criminal offerings: the Trigona ransomware affiliate program (RaaS) with double extortion and ancillary services (DDoS, Tor admin panel, leaked DB storage), the Meduza stealer (C++ build targeting browsers, wallets, and credentials), ShadowVault macOS stealer (PKG/DMG delivery, keychain extraction, wide wallet/browser support, and optional forged Apple signatures), and the evolving LummaC2 stealer (Windows-targeting MaaS with load-balancing and build-generation modules).