https://www.shadowstackre.com/ – Committed to delivering high quality malware intelligence and services to the cybersecurity community. Open this link : https://github.com/ShadowStackRe/intel/tree/master/rules/yara Example :YARA to detect Cactus Ransomwarestrings:$strReadMe = “cAcTuS.readme.txt” wid…
Bitdefender Labs analyzed a coordinated ransomware operation by the CACTUS group that struck two independent corporate networks within a short window. The campaign combined rapid vulnerability weaponization (CVE-2023-38035), multi-stage credential access and l…
Hunt tracks an ongoing sophisticated phishing campaign targeting Telegram groups in the blockchain and angel-investing communities, with actors posing as investment-representatives to lure victims into downloading a malicious Apple Script. The activity shows L…
Web APIs faced a sharp rise in attacks in early 2024, with about 1 in 4.6 organizations targeted weekly and cloud-based networks increasingly in the crosshairs. The report highlights critical API vulnerabilities (Fortinet, Joomla!, ownCloud, Ivanti) and crypto…
Mandiant attributes an ongoing espionage campaign since June 2022 to suspected Iran-nexus actor UNC1549, which uses tailored job- and Israel-Hamas-themed lures to deliver two custom backdoors, MINIBIKE and MINIBUS, and a tunneler named LIGHTRAIL. The operators…
Mandiant observed China-nexus actor UNC5325 actively exploiting an SSRF in Ivanti Connect Secure (CVE-2024-21893), chaining it to command injection to deploy web shells and appliance-specific backdoors. The intrusions use living-off-the-land techniques and nov…
Zscaler’s ThreatLabz discovered a low-volume, targeted campaign using malicious PDF invitations that lead to a multi-stage infection chain installing a previously undocumented backdoor named WINELOADER. The actor, tracked as SPIKEDWINE, used compromised websit…
The Top 10 Malware in Q4 2023 changed slightly from the previous quarter. Here’s what the CIS Cyber Threat Intelligence team observed….
Here at Bitdefender, we’re constantly working on improving detection
capabilities for our macOS cyber-security products; part of this effort involves
revisiting old (or digging up new) samples from our malware zoo. During routine
verifications, we were able to isolate multiple suspicious and undetected macOS
disk image files surprisingly small for files of this kind (1.3 MB per file).
A short look into the code revealed that these files are significantly similar
to other samples analysed in the
The basic idea revolves around gafAsyncKeyState (gaf = global af?), which is an undocumented kernel structure in win32kbase.sys used by NtUserGetAsyncKeyState (this structure exists up to Windows 10 – more on that at the end or in the talk linked above). By first locati…
Daikin Industries, a global leader in air conditioning systems, recently faced a challenging situation – a data breach compromising the personal data of its suppliers. The incident highlights the intricate web of business relationships that characterize modern supply chains and the inherent risks th…
This analysis walks through surface, dynamic, and static examination of DCRat using ANY.RUN, showing an SFX loader that extracts a .NET RAT which establishes HTTP C2 and deploys persistence via scheduled tasks. The report includes deobfuscation details (KO4/XT…
Cisco Talos identified a Mexico-focused spam campaign that delivers a new obfuscated information stealer named TimbreStealer via compromised websites and WebDAV-based .url lures, using geofencing to serve payloads only to Mexican victims. The malware uses laye…
An “intricately designed” remote access trojan (RAT) called Xeno RAT has been made available on GitHub, making it available to other actors at no extra cost. Written in C# and compatible with Windows 10 and Windows 11 operating systems, the open-source RAT comes with a “comprehensive set of features…
SVR-attributed actors (commonly tracked as APT29) are shifting their initial access techniques to target cloud environments, using methods such as password spraying against service and dormant accounts, stolen access tokens, MFA fatigue, device registration, a…