AhnLab SEcurity intelligence Center found ransomware being delivered through a private HTS called UBP Asset, which appears to have been abused by an investment fraud ring that lured victims via Telegram and Band. The attack installed KRSID ransomware through modified HTS components and used a fraud site impersonating Union Bancaire Privee…
Category: Threat Research
Researchers analyzed a multi-stage infection that used Registry-stored PowerShell, DNS TXT records, PNG and WAV file payload containers, and in-memory .NET loading to hide its activity. The chain ultimately deployed an XMRig-based cryptocurrency miner while maintaining a separate C2 channel and weakening Microsoft Defender and PowerShell logging controls. #XMRig #WinRing0.sys #RealtekHDAudio.wav #sslvalidcert.com #httptls.org
Socket researchers found malicious code in the dev-main version of visanduma/nova-two-factor, a Packagist package linked to the broader PolinRider campaign that spreads through compromised developer accounts and Git repositories. The campaign uses Git-based intrusion, hidden payloads, and staged delivery to reach developer environments and later-stage infostealers, while also targeting PHP projects with a new shell_exec execution method. #PolinRider #visanduma/nova-two-factor #Packagist #LaHiRu
Researchers uncovered MovieReaper, a modular multi-stage crimeware campaign that spread through compromised torrent file storage and used a blockchain-based C2 layer for resilience. The operation affected hundreds of victims across multiple countries and relied on evasive loaders, Solana-based infrastructure, and a final file-management implant. #MovieReaper #Solana #deadhub.org #ittorrents.org
ESET Research reports that FamousSparrow, a China-aligned APT, has shifted from SparrowDoor to a new modular C++ backdoor called SparroWocky and has used it against governmental targets across Latin America since at least August 2025. The new implant adds stealthy loading, persistence, and data theft features, while its infrastructure and targeting show a strong focus on regional government entities and open-source tooling integration. #FamousSparrow #SparrowDoor #SparroWocky #LatinAmerica
Lemmings: A Russian Industrialized Persona Provisioning And Management for Active Measures Campaigns
A 2025 darknet leak indicates that Okenit developed “Lemmings,” a Python-based system for manufacturing and managing synthetic online personae, complete with account creation, verification, phone and email acquisition, proxies, and browser automation. The leak suggests this tooling could support future Russian influence operations at scale, with related components named SOI and SOS helping concealment, tasking, and collection. #Lemmings #Okenit #SVR #InternetResearchAgency
CERT-AGID identified a highly polished phishing campaign impersonating Agenzia delle Entrate and Agenzia delle entrate-Riscossione to steal personal data through a fake “Bonus Vacanze” request. The fraudulent site mimics official pages, redirects some users to legitimate SPID/CieID authentication flows, and then pressures victims to submit identity documents, payroll slips, a selfie, phone number, and email. #AgenziadelleEntrate #AgenziadelleentrateRiscossione #CERTAGID #BonusVacanze #SPID #CieID
The article explains how to threat hunt for suspicious activity in GitHub audit logs, focusing on compromised accounts, stolen tokens, OAuth abuse, and API enumeration that can lead to source code exfiltration. It highlights specific log quirks, hunting queries, and indicators that help detect attackers pivoting from GitHub into CI/CD pipelines, cloud environments, and secrets stores. #GitHub #Datadog #OAuth #GitHubAuditLogs #GitTrees #secret-scanning
Zscaler reports that APT36 ran Operation RapidRust in August 2026, targeting government and defense organizations in India and Afghanistan with new tooling including RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The campaign used private GitHub repositories, typosquatted Indian media domains, and Backblaze-hosted payloads to enable encryption, exfiltration, persistence, and USB-based propagation. #APT36 #RUSTYSHADE #RUSTYMOVE #PSNATCH #BASHNATCH #GitHub #Backblaze
RatHat is a novel Android malware linked to China-based threat actors that uses smishing, malvertising, Accessibility abuse, and local ADB self-pairing to gain shell-level control and persist on devices. It steals banking and payment credentials, OTP/2FA codes, and lock-screen secrets while using AI-driven automation, covert tunnels, and self-restoring persistence to maintain access. #RatHat #Zimperium #AccessibilityService #ADB #frpc
SentinelLABS linked the May 2026 OpenAI incident to public Hugging Face activity under the 0Time and Nyx9 accounts, including relay code, document-borne probes, and a registration wrapper for OpenAI accounts. The evidence shows exact-minute matches to OpenAI’s chronology, but it establishes repository state and capability rather than confirmed execution. #OpenAI #HuggingFace #0Time #Nyx9 #ChatGPT
This report analyzes an Atomic macOS (AMOS) stealer infection observed in a lab on Aug. 5, 2026, and documents how a malicious “macOS toolkit” page delivered the malware through a clipboard-paste style terminal execution chain. It also highlights the fast-changing indicators, post-infection artifacts, and C2 traffic used by AMOS stealer. #AMOS…
Varonis Threat Labs uncovered TrustSink, a credential-phishing technique that abuses a rogue External Authentication Method in Microsoft Entra to capture plaintext passwords while still returning a valid signed token. The attack requires privileged access to register the provider, persists across password resets, and leaves detectable traces in authentication policy changes, application…
Silent Push reports that fast flux has become a more mature and accessible service for phishing operators, enabling large-scale domain rotation that defeats traditional IP blocking and hides malicious infrastructure. Their research uncovered thousands of live phishing domains, including a Canada-first banking campaign and other callback-phishing operations, while also mapping provider…
Kaspersky GERT reported that NightEagle (APT-Q-95) expanded its operations from Asia to Russian businesses, using stolen VPN credentials, GhostContainer on Microsoft Exchange, and multiple tunneling and lateral-movement techniques. The campaign also involved BlueKeep exploitation, DCSync-related activity, and tooling hosted under disguised GitHub repositories to maintain access and move across internal networks. #NightEagle #APTQ95 #GhostContainer #MicrosoftExchange #BlueKeep #DCSync