From eeee9d63a0ab539427b8bf7d06ebfea786791904 Mon Sep 17 00:00:00 2001
From: CERT Orange Cyberdefense
 <5493049+cert-orangecyberdefense@users.noreply.github.com>
Date: Fri, 19 Jun 2026 11:14:28 +0200
Subject: [PATCH] Update and rename 20260605_Runster_malwarecampaigns.md to
 readme.md

---
 runster/{20260605_Runster_malwarecampaigns.md => readme.md} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename runster/{20260605_Runster_malwarecampaigns.md => readme.md} (93%)

diff --git a/runster/20260605_Runster_malwarecampaigns.md b/runster/readme.md
similarity index 93%
rename from runster/20260605_Runster_malwarecampaigns.md
rename to runster/readme.md
index 408ff34..ed94daa 100644
--- a/runster/20260605_Runster_malwarecampaigns.md
+++ b/runster/readme.md
@@ -8,7 +8,7 @@
 
 ---
 
-Orange Cyberdefense has been tracking a previously unnamed modular stealer-loader framework we call **Runster**, active since at least November 2025. Two main delivery methods. Two PowerShell modules stealing data. A third, related executable with a DGA component dropping a full-featured DLL.
+Orange Cyberdefense CERT has been tracking a previously unnamed modular stealer-loader framework we call **Runster**, active since at least November 2025. Two main delivery methods. Two PowerShell modules stealing data. A third, related executable with a DGA component dropping a full-featured DLL.
 
 ![RUNSTER attack chain](runster_attack_chain.png)
 *RUNSTER delivery and modular architecture — Orange Cyberdefense*