Attack Type: Malware/Ransomware

Malware and Ransomware attacks are designed to infect your system through things like fake invoices, password-protected attachments, or files disguised as routine business documents. Once opened, they quietly install malicious software that can steal data, encrypt files, or open the door for more serious threats.
You might see things like macro-enabled Office documents, HTML attachments, or ZIP files that require a password. These are tricks to get around email filters and convince you to interact. Once the malware runs, it can connect to attacker-controlled servers, spread across your network, and even bring in more payloads.
Ransomware is especially damaging. It locks up your files and demands a payment—usually in cryptocurrency—to get them back. Some attackers also steal data and threaten to leak it if the ransom isn’t paid, a tactic known as double extortion. The impact can be severe, including downtime, lost data, financial loss, and reputational damage.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Russia return-path TLD (untrusted sender)
4d ago
Feb 13th, 2026
Sublime Security
/feeds/core/detection-rules/russia-return-path-tld-untrusted-sender-588b3954
File sharing link from suspicious sender domain
4d ago
Feb 13th, 2026
Sublime Security
/feeds/core/detection-rules/file-sharing-link-from-suspicious-sender-domain-95f20354
Attachment: Self-sender PDF with minimal content and view prompt
5d ago
Feb 12th, 2026
Sublime Security
/feeds/core/detection-rules/attachment-self-sender-pdf-with-minimal-content-and-view-prompt-07670a8c
Open redirect: embluemail.com
5d ago
Feb 12th, 2026
Sublime Security
/feeds/core/detection-rules/open-redirect-embluemailcom-48c5abd3
Anthropic Magic String in HTML
8d ago
Feb 9th, 2026
Sublime Security
/feeds/core/detection-rules/anthropic-magic-string-in-html-d860c6a8
Attachment: cmd file extension
8d ago
Feb 9th, 2026
Sublime Security
/feeds/core/detection-rules/attachment-cmd-file-extension-a902b8ed
New link domain (<=10d) from untrusted sender
11d ago
Feb 6th, 2026
Sublime Security
/feeds/core/detection-rules/new-link-domain-less10d-from-untrusted-sender-4805b0e6
macOS malware: Compiled AppleScript with document double-extension
12d ago
Feb 5th, 2026
Sublime Security
/feeds/core/detection-rules/macos-malware-compiled-applescript-with-document-double-extension-9669c169
Link: 9WOLF phishkit initial landing URI
18d ago
Jan 30th, 2026
Sublime Security
/feeds/core/detection-rules/link-9wolf-phishkit-initial-landing-uri-a165e206
Attachment: ICS with embedded Javascript in SVG file
19d ago
Jan 29th, 2026
Sublime Security
/feeds/core/detection-rules/attachment-ics-with-embedded-javascript-in-svg-file-d5201a19
Attachment: Employment contract update with suspicious file naming
20d ago
Jan 28th, 2026
Sublime Security
/feeds/core/detection-rules/attachment-employment-contract-update-with-suspicious-file-naming-8bdcd2da
Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK
20d ago
Jan 28th, 2026
Sublime Security
/feeds/core/detection-rules/attachment-ms-office-or-rtf-file-with-shellexplorer1-com-object-with-embedded-lnk-53a29f61
Attachment: Password-protected PDF with fake document indicators
27d ago
Jan 21st, 2026
Sublime Security
/feeds/core/detection-rules/attachment-password-protected-pdf-with-fake-document-indicators-b45e4440
Link: Excessive URL rewrite encoders
27d ago
Jan 21st, 2026
Sublime Security
/feeds/core/detection-rules/link-excessive-url-rewrite-encoders-b88e53a7
Open redirect: unitedwaynwvt.org
1mo ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/open-redirect-unitedwaynwvtorg-da6eb27a
Brand impersonation: Sharepoint fake file share
1mo ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/brand-impersonation-sharepoint-fake-file-share-ff8b296b
Link to Google Apps Script macro via comment tagging
1mo ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/link-to-google-apps-script-macro-via-comment-tagging-66fecd30
Suspicious Links to Cloudflare R2 and Edge Services
1mo ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/suspicious-links-to-cloudflare-r2-and-edge-services-5dd3e5c8
Attachment: Calendar file with invisible Unicode characters
1mo ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/attachment-calendar-file-with-invisible-unicode-characters-050fceac
Subject and sender display name contains matching long alphanumeric string
1mo ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/subject-and-sender-display-name-contains-matching-long-alphanumeric-string-a8a0c831