A SEO‑poisoned search result led to a user downloading a ZIP that executed obfuscated JavaScript and PowerShell to install Gootloader, which staged and loaded a Cobalt Strike beacon directly from registry‑stored payloads. The intruder used Cobalt Strike and a …
Sonatype found several npm packages that install a Windows info-stealer/crypto-stealer named Bladeroid, designed to harvest browser data, wallet information, and social-media sessions. The packages were published on npm and deploy encrypted payloads that exfil…
Malwarebytes researchers describe an Airbnb scam where attackers lure victims to a fake TripAdvisor page to book and pay for an Amsterdam property. The fraud relies on impersonation, shortened URLs, and spoofed emails, with Malwarebytes Browser Guard warning u…
DarkGate is a modular, MaaS-style loader that begins with a phishing PDF leading to a signed MSI, employing layered obfuscation and certificate abuse to bypass detection. It deploys a tampered DLL/CAB chain, decrypts and executes an AutoIt-based final stage th…
Following a string of major public disclosures, Insikt Group has identified new infrastructure associated with operators of the mercenary mobile spyware Predator.
PRESS RELEASEORANGE COUNTY, Calif. and RICHMOND, Va., Feb. 28, 2024 /PRNewswire/ — Troutman Pepper has formalized an Incidents + Investigations Team that caters to a growing need for comprehensive legal services around data breaches and cybersecurity incident…
A new Linux variant of the Bifrost remote access trojan (RAT) employs several novel evasion techniques, including the use of a deceptive domain that was made to appear as part of VMware. […]
Applications are increasingly distributed, expanding companies’ cloud attack surfaces and requiring regular testing to find and fix vulnerabilities — and avoid the risk of a growing sprawl of services.
Brave Software is the next company to jump into AI, announcing a new privacy-preserving AI assistant called “Leo” is rolling out on the Android version of its browser through the latest release, version 1.63. […]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed today that attackers who hack Ivanti VPN appliances using one of multiple actively exploited vulnerabilities may be able to maintain root persistence even after performing factory resets. […]
Overview SonicWall Capture Labs Threat Research Team became aware of the MonikerLink Remote Code Execution vulnerability (CVE-2024-21413) in Microsoft Outlook, assessed its impact and developed mitigation measures for the vulnerability. Microsoft Outlook is a globally […]
The RAT Bifrost has a new Linux variant that leverages a deceptive domain in order to compromise systems. We analyze this expanded attack surface.
The post The Art of Domain Deception: Bifrost's New Tactic to Deceive Users appeared first on Unit 42….
A Darktrace customer was compromised via malvertising that redirected a user to a fake Wireshark site, leading to the installation of the Nitrogen Python backdoor and subsequent deployment of Cobalt Strike beacons which enabled lateral movement and eventual AL…
GTPDOOR is a Linux backdoor discovered targeting telecom infrastructure adjacent to GPRS Roaming eXchange (GRX) networks; it uses GTP-C (GPRS Tunnelling Protocol — Control Plane) signalling to carry command-and-control traffic. By embedding C2 into GTP control…
Phobos ransomware operates as an affiliate RaaS that gains access via exposed RDP, brute force, and phishing to deploy loaders like SmokeLoader which retrieve and decrypt the final Phobos payload. Once inside, actors use process injection, token theft, credent…