Advanced CyberChef techniques using Registers, Regex and Flow Control
This report details statistics and key trends associated with mobile malware: Google Play Trojans, malicious messaging app mods, and others.
Victim: KAI Country : ID Actor: stormous Source: Discovered: 2024-02-26 03:47:27.770023 Description: indonesia…
A PyPI package named django-log-tracker was updated with malicious code, likely via a compromised PyPI account rather than legitimate repository activity. The update downloads and executes a NovaSentinel stealer payload, with a configuration that targets brows…
Two critical ScreenConnect vulnerabilities (CVE-2024-1709 and CVE-2024-1708) allowed authentication bypass and path traversal, enabling unauthorized access and potential RCE. The advisory details exploitation trends (web extensions deploying a webshell, certut…
ASEC reports that Nood RAT, a Linux variant of Gh0st RAT, is used in attacks and features a builder, RC4 encryption, and process-name spoofing. It provides remote shell, Socks proxy, and port forwarding capabilities and has a history of campaigns including Web…
Xeno RAT is a feature-rich remote access trojan published as an open-source project on GitHub and disseminated via its creators’ and threat actors’ use of Discord CDN. The campaign uses multi-stage payloads, anti-analysis techniques, DLL search order hijacking…
TikTok is rolling out in-app election centres across EU languages to curb misinformation and help users distinguish fact from fiction. The article also notes broader global misinformation trends and highlights ongoing cyber threats tied to misused cloud infras…
Blind Eagle campaigns leverage Ande Loader to deliver RemcosRAT and NjRAT, backed by crypters from Roda and Pjoao1578, with hardcoded servers hosting injectors and additional malware. The actor group has targeted Spanish-speaking manufacturing companies in Nor…
The threat actors behind the LockBit ransomware operation have resurfaced on the dark web using new infrastructure, days after an international law enforcement exercise seized control of its servers. To that end, the notorious group has moved its data leak portal to a new .onion address on the TOR n…
By Dylan DuncanCofense Intelligence is tracking an advanced campaign that is successfully reaching intended targets in the Oil and Gas industry. The campaign delivers an uncommon, but advanced, Malware-as-a-Service information stealer, the Rhadamanthys Stealer. This new and advanced phishing campaig…
Lorenz ransomware has evolved its TTPs with double-extortion, exfiltrating data before encryption. New indicators include a .sz41 encryption extension, randomized file and task names, a DLL-based RSA encryption seeded by the current time, and registry-based pe…
Threat researchers at eSentire document Pikabot, a malware campaigns impacting manufacturing and business services with layered encryption and anti-analysis features, including phishing, JavaScript droppers, and process hollowing. The activity shows how Pikabo…
DarkVNC is a stealthy VNC-based payload linked to threats like IcedID, with past associations to StellarInjector and SolarMarker infections. The article details how the malware creates hidden desktop sessions, performs privilege escalation and input/output man…
LATAM-focused threat actors updated several banking trojans in 2023, enhancing defense evasion, obfuscation, and multi-stage delivery chains. The report highlights SAMBA SPIDER as a Brazil-based actor using Mispadu, and provides IOCs for multiple families acro…