UPX, the Ultimate Packer for eXecutables, is a widely used open-source binary packer that compresses executables to reduce size and obscure contents.
UPX is a tool tracked across 7 threat clusters and 9 intelligence report mentions on ThreatCluster. First observed December 3, 2025; most recent activity July 24, 2026.
UPX, the Ultimate Packer for eXecutables, is a widely used open-source binary packer that compresses executables to reduce size and obscure contents. In threat operations, attackers routinely leverage packers to shrink payloads and hinder static analysis, making UPX-packed binaries a notable tactic in malware campaigns and exploit deliveries.
Iran-affiliated hackers have expanded their attacks on U.S. critical infrastructure, targeting programmable logic controllers (PLCs) from Siemens and Schneider Electric, in addition to Rockwell Automation systems. The…
The Kimsuky group, linked to North Korea, targeted South Korean groupware vendors from late 2025 to early 2026, deploying new malware variants BirdTroy and DriveTroy. These Linux backdoors utilized Google Drive for…
A Chinese state-backed hacking group, UNC6201, has been exploiting a critical zero-day vulnerability in Dell RecoverPoint for Virtual Machines since at least mid-2024. The flaw, tracked as CVE-2026-22769, features a…
A zero-day vulnerability in Gogs, a self-hosted Git service, is being actively exploited, affecting over 700 instances. Discovered by Wiz Research during a malware investigation, the vulnerability allows authenticated…
Researchers have identified a new Linux malware that merges the Mirai botnet's DDoS capabilities with a fileless cryptominer. This sophisticated threat employs advanced techniques such as raw-socket scanning and dynamic…
The pkr_mtsi malware loader has been upgraded to incorporate advanced stealth techniques, including hashed API resolution and improved obfuscation. Initially observed in April 2025, it is utilized for deploying various…
Chinese authorities have arrested 67 suspects linked to the Silver Fox cybercrime group, which primarily targeted Chinese-speaking users. The arrests occurred across five provinces, including Zhejiang, Jilin, Shandong,…
UPX, the Ultimate Packer for eXecutables, is a widely used open-source binary packer that compresses executables to reduce size and obscure contents.
The most recent intelligence report mentioning UPX on ThreatCluster is dated July 24, 2026. Activity was first observed December 3, 2025, giving a tracked span from then to July 24, 2026.
Across ThreatCluster reporting, UPX most frequently co-occurs with CyberAv3ngers, Gonjeshke Darande, Kimsuky, Silver Fox APT, Unc6201, among 12 tracked related entities.
The most significant recent cluster is “Iranian Hackers Target U.S. Critical Infrastructure with Advanced PLC Attacks” (17 articles · Updated July 23, 2026). UPX appears across 7 threat clusters in total, listed above with sources.
UPX appears in 9 intelligence report mentions across 7 deduplicated threat clusters, aggregated from 17,000+ monitored sources.