News and Analysis

The Horus Protector crypter uses a new delivery technique that makes detection more difficult due to its obfuscation tactics. It uses VBE scripts to distribute malware such as AgentTesla, Remcos, Snake, NjRat, among others. The method involves encoding and storing malicious files in registry locations before they’re executed. Notably, the execution process involves a check on the status of Windows Defender – the script terminates if Defender is active.