The article analyzes PrivateLoader malware and how researchers uncovered its VMProtect packing, high-entropy sections, and encrypted strings, alongside unpacking methods. It also discusses a shared YARA rule to detect new PrivateLoader variants and the broader…
Patchwork APT is an India-based cyber espionage group identified in 2015 but active since 2009, targeting government, defense, and diplomatic entities primarily in South and Southeast Asia, with operations expanding to Europe and North America. It relies on sp…
An analysis of a travel-industry phishing campaign delivering Agent Tesla via a PDF attachment impersonating Booking.com to steal data and drop a PowerShell payload. The infection chain progresses from a malicious PDF to obfuscated JavaScript, a download of a …
PIKABOT is a widely deployed loader used by attackers to distribute payloads such as Cobalt Strike or ransomware, with Elastic Security Labs reporting new campaigns and an updated loader featuring a new unpacking method and heavier obfuscation. The update sign…
Dark Crystal RAT (DCRat) is a modular remote access Trojan active since 2018, known for stealthy data theft and ongoing feature updates. It includes a DCRat Studio for developing new modules, a low-cost model, and multiple distribution methods such as phishing…
Security researchers document active exploitation of the ScreenConnect vulnerability dubbed “SlashAndGrab,” with adversaries leveraging it for post-exploitation tradecraft including ransomware, cryptominers, and remote access. The activity spans LockBit-style …
Lazarus has released malicious Python packages on PyPI (pycryptoenv, pycryptoconf, quasarlib, swapmempool) to spread malware, likely exploiting typos in package installation. The payload uses a Comebacker loader that decodes and executes a DLL in memory and co…
This blog entry gives a detailed analysis of these recent ScreenConnect vulnerabilities. We also discuss our discovery of threat actor groups, including Black Basta and Bl00dy Ransomware gangs, that are actively exploiting CVE-2024-1708 and CVE-2024-1709 based on our telemetry.
The article demonstrates using WebAssembly (Wasm) to perform HTML smuggling by compiling Go-based dropper code into a .wasm module that decodes an embedded, encrypted payload client-side and reconstructs a malicious file for download. The author provides a pro…
FortiGuard Labs details Abyss Locker, a ransomware family based on HelloKitty code that exfiltrates data, disables recovery mechanisms, stops security/backup services, and encrypts files on Windows and Linux hosts. The malware adds extensions like “.abyss” or …
Morphisec Threat Labs uncovered UAC-0184 using the IDAT loader to deliver the Remcos RAT via steganography and module-stomping techniques, with payload retrieval dependent on a specific download key and dynamic API resolution. Key IOCs include a Remcos C2 at 1…
More than 8,000 domains and 13,000 subdomains belonging to legitimate brands and institutions have been hijacked as part of a sophisticated distribution architecture for spam proliferation and click monetization.
Guardio Labs is tracking the coordinated malicious activity, which has been ongoing since at least September 2022, under the name SubdoMailing. The emails range from “counterfeit
Guardio Labs uncovered a large-scale “SubdoMailing” campaign in which attackers register abandoned domains and hijack thousands of legitimate subdomains (over 8,000 identified) to authenticate and send millions of spam/phishing emails daily. The operation—attr…
The popular hacker IntelBroker announced that it had hacked the Los Angeles International Airport by exploiting a flaw in one of its CRM systems. The website Hackread first reported that the popular hacker IntelBroker had breached one of the CRM systems used by the Los Angeles International Airport. IntelBroker announced it had exploited a vulnerability […]
Earth Lusca used a geopolitical-themed lure timed around the Taiwanese election to deliver a multi-stage infection that culminated in a Cobalt Strike payload communicating with C2 domains such as updateservice[.]store and Cybereason[.]xyz. The campaign employe…