YARA Summer Pack: 72 malware families covered this summer (Prometei, WannaCry, SpyNote…)

Three months of fresh detection, in one place

Detection is a race: weeks usually pass between a strain starting to spread and a public rule recognising it. Every month, ThreatClaw analyses the latest batch of malware actually seen in the wild and forges its own rules from it.

Summer tally: 72 new malware families added to the ThreatClaw YARA feed across June, July and August 2026. Here is what the Summer Pack covers, by attack surface.

We count in families, not rule counts: one family is one more threat your estate can name. Behind each one is a net of several rules (the precise variant plus the lineage's shared traits), not a single signature an attacker sidesteps by recompiling.

Ransomware and exploits, the classics that still hit SMBs

These threats are not new, but they remain active against unpatched systems, and an SMB without an up-to-date EDR is exposed to them today:

• WannaCry, the 2017 ransomware still spreads across unpatched networks over SMB.
• EternalBlue (MS17-010), the SMB exploit behind WannaCry and NotPetya, still mass-scanned.
• CVE-2017-11882, Microsoft Office (Equation Editor) exploit, still a live attachment vector.
• CVE-2017-17215, Huawei router exploit, used to enrol edge devices into botnets.
• A Netgear exploit and BypassUAC (Windows User Account Control bypass).

Your Linux servers, the SMB blind spot

• Prometei, a modular botnet that settles in for the long run on Linux servers: mining, credential theft, lateral movement. The archetype of a compromise that goes unnoticed for months.
• Several Linux backdoor and downloader families (IRCBot, Shellbot, RevShell, shell agents), the scripts that run first and fetch the rest.

Android mobile banking, this summer's wave

The category that grew the most this summer, and the most dangerous for executives and finance staff who bank on mobile:

• GhostNFC, a banking trojan abusing NFC relay.
• SpyNote, a full Android RAT (surveillance, data theft, OTP interception).
• Mamont, a widely-distributed banking dropper.
• Banbra, BeatBanker, Rewardsteal, Btmob, overlay-based banking trojans and credential stealers.

Windows endpoints

• Neshta, a stubborn file-infecting virus, still very much around.
• Qukart, Sdum, PMax, Zapchast, CoreWarrior, DLLhijack, trojans, proxies, DLL hijacking and denial-of-service tooling.

The part nobody shows: false-positive proof

An over-broad rule is worse than no rule: it drowns the team in alerts until nobody reads them. So we measure.

Every Summer Pack family was run against 5,694 legitimate files, Microsoft-signed Windows executables and drivers, Linux system binaries, macOS applications. The required result was zero, and the result obtained was zero matches.

That is not a marketing line, it is an exit criterion: a family that fails this test does not ship. This summer, several families were dropped precisely because they reacted to perfectly clean files, they are not in the feed, and rightly so.

Every rule is also compile-validated on the real YARA engine, the one your EDR runs.

What it changes

These 72 families ship with the ThreatClaw YARA feed, loadable into your EDR, DFIR scanners, mail gateway or file-analysis tooling. They belong to our exclusive set: detections we write ourselves, reserved for subscribers, that you will not find in public repositories.

And next month there will be more, because next month there will be new families. That is precisely the point.

Want to know what your current setup cannot see? Explore the ThreatClaw YARA feed, vetted licensing, false-positive validation shipped with the pack, continuously updated.