Volexity details a targeted Sophos Firewall breach that leveraged a zero-day remote code execution vulnerability (CVE-2022-1040) to install a webshell, establish persistence, and conduct MITM activity that extended to external systems such as CMS websites. Sop…
Category: Threat Research
Cyble Research Labs identified an Android malware variant distributed via the Play Store that acts as a Hostile Downloader to fetch the Hydra Banking Trojan. The app masquerades as Document Manager, uses fake update prompts, and communicates with a TOR-enabled…
An unknown threat actor exploits CVE-2019-18935 in Telerik UI for ASP.NET AJAX to seize control of Windows servers, drop a Cobalt Strike beacon, and stage further malware via PowerShell commands. Sophos MTR links these campaigns to earlier Blue Mockingbird act…
Follina (CVE-2022-30190) is a remote code execution vulnerability in Microsoft Office that can be exploited without macros by loading an external reference which ultimately invokes the MSDT tool to run PowerShell. The article outlines the attack flow, the tech…
Saitama is a backdoor that uses DNS tunneling to encapsulate its C2 messages, hiding commands within IPv4 addresses. The activity has been linked to APT34 and was observed in a phishing email targeting Jordan’s foreign ministry; Morphus Labs also released a tr…
Two sentences summarizing: Check Point Research exposes an Iranian-backed spear-phishing operation targeting former Israeli officials and other high-ranking figures, leveraging a custom phishing infrastructure and inbox takeovers to steal credentials and ident…
Purple Fox malware evolved from an exploit kit used by RIG EK into an independent threat that deploys a multi-stage, stealthy infection chain featuring a rootkit, LOLBIN abuse, and privilege escalation via public CVEs. The analysis maps observed behaviors to M…
SeaFlower is a highly sophisticated intrusion set that targets web3 wallets by delivering backdoored iOS/Android apps, injecting covert code to exfiltrate seed phrases and balances. It uses provisioning-based sideloading, dylib injections, React Native bundle …
PureCrypter is a fully featured loader sold since 2021 that distributes a range of remote access trojans and information stealers. It uses a .NET-based, obfuscated, and encrypted delivery chain with protobuf-configured options for persistence, injection, and d…
Avast researchers document Syslogk, a Linux kernel rootkit under development in the wild that leverages Adore-Ng foundations to hide itself and a Rekoobe backdoor embedded in a fake SMTP server. The malware can be revealed, loaded, and controlled via on-demand…
Unit 42 identifies PingPull, a new remote access Trojan used by the GALLIUM group, expanding its targeting beyond telecommunications to financial institutions and government entities across multiple regions. PingPull supports three C2 channels (ICMP, HTTP(S), …
Two security researchers describe how crypto-mining operations leveraged Atlassian Confluence zero-day CVE-2022-26134 to drop and execute mining payloads on Linux and Windows hosts, using a multi-stage chain from initial exploitation to persistence and lateral…
IP2Scam tech support campaigns use malvertising to push visitors to browser locker pages. The operators rotate infrastructure and impersonate brands to misdirect users, while researchers tracked the activity and coordinated takedown efforts with hosting provid…
HelloXD is a ransomware family performing double extortion on Windows and Linux, with negotiations conducted via TOX chat and onion-based services instead of a leak site. Unit 42’s analysis links HelloXD to x4k and reveals details on its packers, memory-based …
Symbiote is a highly evasive Linux threat that infects running processes by loading as a shared object via LD_PRELOAD to gain rootkit capabilities and remote access. Researchers describe its stealthy behavior—hiding itself and other malware, evading live foren…