Disclosing the BLOODALCHEMY backdoor

As cited

Copy frozen at 2026-09-19 19:56 UTC (site build).

threat intel

Disclosing the BLOODALCHEMY backdoor

BLOODALCHEMY is an actively developed backdoor that uses a benign binary as an injection vector and is associated with the REF5961 intrusion set. Researchers disclosed the malware and its operational characteristics.

Why it matters: Defenders tracking REF5961 activity need to identify and block BLOODALCHEMY deployments, which may be difficult since the malware leverages legitimate binaries for execution.

Source published

2023-10-13 00:00 UTC

First seen by Cybersecurity Tracker

2026-09-19 17:45 UTC