🎯 Indicator Removal

The items that name it 6

• AI-Powered Espionage Campaign Targets Government Linux Infrastructure
  article2026-10-15It is written here as Indicator removal (log deletion and cleanup).

  Deleted authentication, history, email, OS, web server and PHP session logs, removed /tmp files and checked logs for their IPs

• MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker
  writeup2026-08-14It is written here as Indicator Removal: Clear Windows Event Logs (T1070.001).

  Clears event logs using wevtutil.exe

• UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
  article2026-08-06It is written here as Indicator removal: deleting security notifications.

  Operators used compromised email accounts to reset passwords for non-SSO applications and deleted password-reset confirmations, security notifications and MFA-change alerts to avoid detection.

• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeup2026-07-15It is written here as Indicator Removal: File Deletion.

  CleanupMeiFolders removes PyInstaller _MEI extraction directories; exitadaptive branch deletes non-EXE files and recursively removes subdirectories

• Socket: 152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic
  writeup2026-06-13

  An indexedDB.databases() enumerate-and-delete routine shipped in 100% of the family runs on every service-worker start as an anti-forensic state-reset, though it deletes nothing in this build since state is kept in localStorage

• [s|l]trace - Linux Malware Analysis
  writeup2024-02-01It is written here as Indicator Removal (File Deletion).

  Deletes /dev/shm/kdmtmpflush both before initial copy (cleanup) and after execution (rm -f), removing the file from disk while process still runs from deleted inode