Introducing JA4+ Fingerprints

Welcome back to Validin's monthly newsletter and thank you for inviting us into your inbox. This month we are excited to announce support for JA4X fingerprints, effective immediately. Additionally, we published our 2025 recap and are announcing our continued sponsorship of PIVOTcon in May. As always, we appreciate any feedback! - The Validin Team

PLATFORM UPDATE

Introducing JA4+ Fingerprints

Key Takeaways:

• Validin is introducing JA4+ capabilities, starting with JA4X available to Community and Enterprise users
• JA4X enables detection of structural anomalies in X.509 certificates
• JA4X can be used to uncover and track malicious C2 infrastructure

👉 Read the complete update blog now

Our 2025 Recap

Let's rewind and take a look at last year's published research, product updates, and community growth.

Read the full recap

👋 See you in Spain

We are excited to announce our continued support of PIVOTcon, an event that focuses on threat research and technical analysis tradecraft. We attended last year and are excited to return to Malaga, Spain as attendees.

Learn more about PIVOTcon

FEATURED IN

🐀 Dissecting CrashFix: KongTuke's New Toy

Huntress details a KongTuke campaign involving a malicious browser extension, a new ClickFix variant then baits users into running malicious commands and ModeloRAT, a previously undocumented Python RAT. Read the threat analysis now.

🪷 LOTUSLITE: Targeted espionage leveraging geopolitical themes

Acronis' research team reports a targeted malware campaign against U.S. government entities leveraging a politically themed ZIP archive containing a loader executable and a malicious dynamic-link library (DLL). Read their report.

BY THE NUMBERS

December's Top Viewed Threat Actor Profiles and their position change from last month. If you're logged into Validin, view the full profiles:

1. Lazarus Group (+3)

2. ClickFix (-1)
3. Poseidon Group (new)
4. Lumma Stealer (-1)
5. Fake Software Downloads (new)