DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft

TAG-150 is leveraging a sophisticated, multi-stage attack chain that abuses the Deno runtime and AI-generated code to deliver modular malware—DinDoor, DenoRAT, and NightshadeC2—for remote access, credential theft, and stealthy in-memory execution, highlighting a rapid evolution in adversary tradecraft targeting finance organizations.