14 new malware families covered: the June YARA batch

Detecting what is circulating now, not what circulated six months ago

Weeks usually pass between the moment a malware strain starts spreading and the moment a public rule set recognises it. That is a window in which an up-to-date antivirus sees nothing, and in which an attacker works undisturbed.

Every month we analyse the latest batch of samples actually observed in the wild and derive our own detection rules from it. The June batch adds 14 new families to the ThreatClaw YARA feed.

Fourteen families, but 391 detection rules: on average nearly 28 rules per family. A malware family is not a single object, it is a lineage of variants, recompiled, repackaged, slightly altered for each campaign. We cover each one from several angles: rules that recognise the precise sample, and cross-cutting rules that capture the traits shared across the whole lineage, including variants we have not seen yet.

We still headline 14 families, not 391, because that is the honest number: the 391 measure the depth of our coverage, not a count of distinct threats. One more family is one more threat your estate can name, and behind each one, a net of rules, not a single signature an attacker sidesteps by recompiling.

Exactly what this batch covers

Your Linux servers, two families

• Prometei, a modular botnet that settles in for the long run on Linux servers: it diverts compute power, harvests credentials and spreads laterally. The archetype of a compromise that goes unnoticed for months, because it breaks nothing.
• A generic Linux backdoor, persistent remote access, the door an attacker keeps open to come back.

Linux servers are the classic SMB blind spot: very few estates watch them as closely as Windows endpoints. That is precisely where mining, pivoting and exfiltration take hold.

Your Windows endpoints, three families

• A code-injection family, the technique makes a legitimate process execute the malicious payload, blending into the machine's normal activity.
• A spyware family, aimed at stealing data and credentials.
• A general-purpose trojan, the broadest Windows family in this batch.

Your office attachments, one family

• A trojan carried in Office documents, the most ordinary and most effective entry vector there is: an attachment that looks like a quote, an invoice or a CV. It is the most thoroughly covered family in this batch.

Your mobile devices, one family

• An Android trojan, for estates where phones reach email and business apps, which is to say nearly all of them.

The first rung of an intrusion: scripts and downloaders, seven families

• Three shell-script downloader families, the small script that runs first and fetches the rest. Catching it there stops the attack before its payload.
• An obfuscated-script family, code deliberately made unreadable to evade analysis.
• A Java family, cross-platform by nature.
• Two multi-platform families, able to run on several operating systems.

These seven are the least spectacular and the most useful. A downloader detected is a ransomware that never fires.

The part nobody shows: proving they do not cry wolf

An over-broad detection rule is worse than no rule at all. It drowns the team in alerts, and within three weeks nobody reads them any more. That is how real attacks slip through the noise.

So we measure. Every rule in this batch was run against a set of 5,694 legitimate files: Microsoft-signed Windows executables and drivers, Linux system binaries, macOS applications. The required result was zero, and the result obtained was zero matches.

That number is not a marketing line, it is an exit criterion: a rule that fails this test does not ship. On this very batch, one family was dropped because it reacted to 53 perfectly clean files. It is not in the feed, and rightly so.

We also verify that every rule compiles on the real YARA engine, the one your EDR runs, not an approximation of it.

What it changes in practice

These rules ship with the ThreatClaw YARA feed, loadable into your EDR, DFIR scanners, mail gateway or file-analysis tooling. They arrive with the rest of the feed, signed and verifiable.

They belong to our exclusive set: detections we write ourselves, which you will not find in public repositories, and which are reserved for subscribers.

And next month there will be more, because next month there will be new families. That is precisely the point.

Want to know what your current setup cannot see? Explore the ThreatClaw YARA feed, vetted licensing, false-positive validation shipped with the pack, continuously updated.