HomuWitch is a C# .NET ransomware that primarily targets individual users via a SmokeLoader backdoor disguised as pirated software, compresses files with Deflate and encrypts them with AES-CBC appending the .homuencrypted extension. Avast discovered a flaw in …
On January 10, 2024, Ivanti disclosed that their Connect Secure VPN devices were breached through two zero-day vulnerabilities. Organizations using these devices are rapidly working to patch and safeguard their networks from potential compromise. The situation…
Migo is a Go-compiled cryptominer that targets exposed Redis instances by disabling Redis security settings, writing malicious keys that install a cron-based downloader, and executing a packed ELF miner which deploys XMRig. The campaign also uses compile-time …
The cybercrime ecosystem has created a supply chain of stolen accounts and breached networks that are used to fuel ransomware attacks and data breaches. Learn more from Flare about how this supply chain has led to an explosion of cybercrime. […] Read More BleepingComputer…
Google Cloud Run has been abused to host high-volume distribution infrastructure that redirects victims to Google Cloud Storage ZIPs or serves malicious MSI installers directly, delivering banking trojans Astaroth (Guildma), Mekotio and Ousaban primarily to La…
MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the…
Reliable uptime monitoring >> Uptime Robot Website monitoring Be the first to know that your website is down! Cron job monitoring Monitor background jobs or intranet devices. Port monitoring Monitor IMAP, POP3 or any other specific ports. Keyword monitoring Check presence of any text on the page. Pi…
ReversingLabs found two malicious PyPI packages (NP6HelperHttptest and NP6HelperHttper) that use a setup.py installer to download a signed executable (ComServer.exe) and sideload a malicious DLL (dgdeskband64.dll) which then fetches and executes an encrypted C…
Hunters International emerged in late 2023 as a RaaS operation with technical lineage and tactics resembling Hive, continuing cyber extortion trends despite Hive’s takedown. The group claims independence, focuses on data theft over encryption, and shows ties t…
A Python-based info stealer now uses dynamic sandbox detection by pulling Indicators Of Detection (IOD) from online sources to decide whether to run. It also retrieves external indicator lists from rentry.co and exfiltrates cookies from a wide set of targeted …
Cyble Research & Intelligence Labs identified AsukaStealer as a Malware-as-a-Service (MaaS) advertised on a Russian-language forum, with version 0.9.7 of its web panel offered for USD 80/month, and noted it is likely a revamped ObserverStealer. The research de…
In this blog entry, we focus on Earth Preta’s campaign that employed a variant of the DOPLUGS malware to target Asian countries.
An ISC guest diary analyzes a Mirai-based attack captured on a honeypot, highlighting an automated SSH intrusion that downloads a binary named ‘sh’ from a Moscow IP and executes it. The sample is identified as Trojan.Mirai / miraidownloader, with mitigations t…
BackMyData ransomware, linked to the Phobos family, targeted Romanian hospitals, encrypting local and network files and forcing systems offline. It uses AES256 with RSA-encrypted keys, disables security controls, and persists via Run registry keys and the Star…
Today’s attackers are taking advantage of changing business dynamics to target people everywhere they work. Staying current on the latest cybersecurity attack vectors and threats is an essential part of securing the enterprise against breaches and compromised data. https://www.proofpoint.com/us/thre…