Three Hacker Castes: How Script-Kiddies, Codemasters and Grandmasters Operate and Why Advanced Attacks Evade Detection
JET CSIRT analyst Maxim Kishmereshkin has published a detailed breakdown of attacker techniques observed during real incident response engagements over the past two years. He classifies threat actors into three castes — Script-kiddies, Codemasters and Grandmasters — differentiated primarily by the tools they use and their ability to evade detection.
Most incidents follow a five-stage pattern: reconnaissance via Shodan and Censys, initial access through brute-force or phishing, persistence via scheduled tasks or remote administration tools, privilege escalation with utilities such as Impacket and CrackMapExec, and final actions including data theft or ransomware deployment. Script-kiddies download ready-made tools and are frequently caught by antivirus when they attempt to run Certipy or similar utilities.
Codemasters modify existing tools to change file hashes and employ living-off-the-land binaries such as CertUtil to download payloads while masquerading as legitimate business applications. In one case they opened a command prompt through an accounting program and used only native Windows utilities, avoiding any detectable malicious binaries.
Grandmasters create custom malware and conduct thorough reconnaissance. A recent investigation attributed to the group Cavalry Werewolf began with a phishing email containing a trojanized 7-Zip executable signed with a valid certificate. The loader winload.exe injected the Adaptix C2 agent directly into memory, leaving no artifacts on disk. Attackers also revived a decommissioned domain controller using hypervisor access and reused credentials of former employees.
The report stresses that advanced attacks are difficult to detect because they operate entirely in memory and mimic normal administrative activity. Effective defense requires a layered approach: antivirus and multi-factor authentication for lower-tier actors, behavioral detection rules for codemasters, and EDR, audit logging of Active Directory access, and continuous hardening for grandmaster-level threats.
Related articles
Russian-Aligned Gorbag Group Exploits WinRAR CVE-2025-8088 to Steal Credentials from Ukrainian Government Bodies
ESET has published a detailed report on the Gorbag threat group, a Russia-aligned actor active since at least February 2025, that has adopted the WinRAR path traversal vulnerability CVE-2025-8088 to deliver the BeautyStealer password stealer against Ukrainian public sector targets. The flaw, fixed in WinRAR 7.13, allows attackers to escape the chosen extraction folder and write files to arbitrary locations using Windows alternate data streams. Upon opening the malicious RAR archive, victims see a decoy PDF while a Windows startup shortcut and PowerShell loader are silently installed to maintain persistence. BeautyStealer, written in C++, harvests saved passwords, cookies, and browsing data from Chrome, Edge, Opera, and Firefox, along with OpenVPN configurations, KeePass databases, Java key files, and Ukrainian electronic signature keys. The group previously relied on malicious Excel macros in 2025 before switching to RAR-based delivery that requires no user interaction beyond opening the archive. Stolen data is exfiltrated via the Telegram API or, from version 1.2 onward, to attacker-controlled servers. ESET links the operation to earlier activity tracked as GIFTEDCROOK and UAC-0226 by CERT-UA.
Positive Technologies Analyzes 140 Incidents: Web Applications Drive Half of Breaches, APT Groups Found in 49% of Cases
Positive Technologies' Incident Response team examined more than 140 full-cycle investigations and retrospective analyses conducted between Q4 2025 and Q3 2026. Web applications on the perimeter remained the leading initial access vector, accounting for 50.8% of incidents, with newly targeted services including Zimbra mail servers and TrueConf video-conferencing platforms. APT activity was detected in 49.3% of victim organizations, while supply-chain attacks through contractors and ViPNet networks still represented 14.9% of entries despite a decline from the previous year. Industry became the most affected sector at 22.5%, and median time to bring incidents under control after engagement stood at two days. Root causes continued to center on outdated software, missing multi-factor authentication, and poor network segmentation. Three previously unknown APT groups—APT10051, Stingy Basilisk, and Chewbacca—were identified during the investigations.
Peskov Rejects Claims of Russian Involvement in European Refrigeration System Attacks
Kremlin spokesman Dmitry Peskov has dismissed accusations that Russian-linked cyber groups were behind recent attacks on industrial refrigeration equipment across nine European countries. The incidents, which occurred in early November, involved unauthorized changes to temperature settings on internet-connected cooling systems, with some units pushed to +50 °C. Similar attacks had already been reported in France during October, affecting meat producers and other facilities that rely on precise climate control. Peskov described the allegations as lacking any evidence and part of a recurring pattern of unsubstantiated claims directed at Russia by European nations. The targeted systems are typically connected online for remote maintenance and fault alerts, a feature that becomes a liability when external actors gain access. No group has claimed responsibility for the October or November operations, leaving attribution unconfirmed. The events highlight risks associated with exposing industrial control equipment directly to the internet without adequate segmentation or authentication controls.
North Korean Hacker Groups: Lazarus, Kimsuky, Andariel and Financial Clusters Behind Billions in Thefts
North Korean state-sponsored hacking operations linked to the Reconnaissance General Bureau and other agencies involve dozens of clusters conducting cyber espionage, technology theft, and large-scale financial crimes. Groups such as Lazarus, Kimsuky, Andariel, BlueNoroff, and APT38 have been tied to the 2014 Sony Pictures breach, the 2016 Bangladesh Bank heist, WannaCry, and recent multi-billion-dollar cryptocurrency thefts from Bybit and Binance. Specialized teams focus on fake job offers to infiltrate defense contractors, supply-chain attacks on developers, and ransomware operations that fund further espionage. Researchers from Microsoft, CrowdStrike, Google, and Mandiant track overlapping clusters using names like Diamond Sleet, Labyrinth Chollima, TraderTraitor, and UNC2970, noting frequent infrastructure sharing and evolving tactics. The activity spans political intelligence collection, defense technology theft, and crypto wallet compromises, with some clusters creating fictitious IT workers to gain remote access to foreign companies.