Bitter (T-APT-17) continues to target Bangladesh, employing a multi-stage infection chain beginning with an Excel Maldoc that exploits CVE-2018-0798 to drop additional payloads. The operation culminates in Almond RAT, a .NET-based backdoor that uses AES-CBC en…
Category: Threat Research
BumbleBee is a new loader actively used to deliver payloads via phishing campaigns and to establish an initial foothold in target networks. The analysis highlights its living-off-the-land techniques, notably using a Microsoft-signed odbcconf.exe to indirectly …
MS-SQL servers are commonly targeted by attackers who gain control and install malware, including coin miners and ransomware. The article details a case where attackers deploy Cobalt Strike and Meterpreter on vulnerable MS-SQL servers to install AnyDesk for re…
An LNK file is a Windows Shortcut that serves as a pointer to open a file, folder, or application. LNK files are based on the Shell Link binary file format, which holds information used to access another data object. McAfee Labs has seen a rise in malware being delivered using LNK…
Two sentences summarizing the content: ReversingLabs uncovered a widespread npm software supply chain attack where malicious JavaScript packages were published to steal form data from apps and websites. The campaign used typosquatting to impersonate legitimate…
DarkComet RAT has re-emerged with new TTPS-based detection and response coverage, highlighting its capabilities as a stealthy remote access Trojan that can spy on systems, steal credentials, and add infected machines to a botnet. The article outlines a multi-s…
VSingle, a Lazarus-linked malware, has been updated to fetch C2 server information from GitHub instead of relying solely on hard-coded C2 endpoints. The Linux variant uses wget for C2 communication, stores responses in /tmp/.sess_* files, and dynamically disco…
Cyble Research Labs analyzed Xloader’s updated infection technique, detailing a multi-stage chain that starts with a phishing email delivering a PDF attachment, then traverses through embedded XLSX and an RTF-triggered dropper to load a final Xloader payload. …
GlowSand describes a Ukraine-focused, multi-stage malware campaign leveraging documents with malicious macros to download staged payloads. It uses geofenced infrastructure and persistence via a scheduled task to maintain access and conduct system discovery and…
SessionManager is an IIS backdoor tied to the GELSEMIUM activity cluster that persists on compromised servers by loading a malicious IIS module after ProxyLogon-type exploits. It enables reading/writing files, remote command execution, and HTTP-based command-a…
Raccoon Stealer v2 marks a notable revival of the information stealer brand, with early signs of life detected in 2022 as servers and administration panels surfaced. SEKOIA.IO documents a refreshed build, renewed distribution, and a plan to scale behind a rede…
YTStealer is a YouTube authentication cookie stealer marketed on the dark web, designed to harvest credentials and channel data from creators. It evades analysis with sandbox checks, uses headless browser automation to validate cookies and collect YouTube Stud…
Cyble Research Labs uncovered PennyWise, a new evasive infostealer that targets 30+ Chrome-based and 5+ Mozilla-based browsers as well as crypto wallets, with updated version 1.3.4 already observed in the wild. The malware is distributed via YouTube campaigns …
Black Basta expanded its repertoire by employing QakBot as an entry point and using the PrintNightmare flaw to perform privileged file operations. It also leveraged the Coroxy backdoor and Netcat for lateral movement across networks. #BlackBasta #QakBot
Two Ukrainian targets were hit by emails delivering malicious documents that leveraged a Follina-like vulnerability and malicious macros to drop a DCRat variant. FortiGuard Labs notes the campaign revolves around Dark Crystal RAT (DCRat) with multi-stage infec…