CISA and MS-ISAC found an unknown threat actor used a former employee’s active domain admin account to authenticate via the organization’s VPN from an external VM, execute LDAP queries to enumerate users, hosts, and trusts, and post the resulting files to a da…
Reference : Australian Cyber Security Centre The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) leads the Australian Government’s efforts to improve cyber security. Our role is to help make Australia the most secure place to connect online. https://www.cyber.gov.au/th…
Alpha attacks have emerged from the NetWalker ashes, scaling up operations and launching a data leak site. The campaign heavily uses living-off-the-land tools and shows strong links to NetWalker, suggesting revived or repurposed ransomware activity. #NetWalker…
SNS Sender is a Python-based tool that leverages AWS SNS to send bulk SMS phishing messages (smishing), leveraging compromised credentials to bypass SNS sandbox limitations. The actor behind SNS Sender, alias ARDUINO_DAS, is connected to numerous USPS-themed p…
RansomHouse operates as a Ransomware-as-a-Service group that uses a tool called MrAgent to automate ransomware deployment across many hypervisors. The report outlines their double-extortion model, Tor-based negotiation platform, and the technical details of Mr…
RustDoor (macOS) and GateDoor (Windows) are a cross‑platform pair of malware disguised as legitimate updates or utilities, with RustDoor acting as a backdoor and GateDoor as a loader. They share overlapping C2 infrastructure linked to ShadowSyndicate, and empl…
Insikt Group has observed TAG-70 leveraging cross-site scripting (XSS) vulnerabilities against Roundcube webmail servers in Europe, targeting government, military, and national infrastructure.
SpyNote Android RAT masqueraded as a crypto wallet (Imtoken.apk) to inject a Base64-encoded WebView overlay and abuse the Accessibility API to automatically hijack and replace destination addresses, force “Max” transfers, and complete cryptocurrency transactio…
Identifier: TRR240201. Summary Following an X post by IntezerLab about an attack campaign that they dubbed “SameCoin”, we analyzed the samples they discovered and found a few identical variants. The infection vector appears to be an email impersonating the Israeli……
Darktrace detected and contained a Gootloader infection in late 2023 by identifying anomalous beaconing, internal SMB scanning, and a subsequent FTP executable download attempt, then autonomously blocking malicious connections. The platform’s DETECT, RESPOND, …
This analysis describes a Windows stager that uses indirect syscalls to bypass user-mode hooks and EDR tracing, locating SSNs and syscall instruction addresses in ntdll and calling kernel APIs directly. The stager decrypts two payloads (including an UPX-packed…
Cisco Talos uncovered TinyTurla-NG (TTNG), a new Turla backdoor deployed as a lightweight “last chance” implant that uses compromised WordPress sites as HTTP/S C2 servers and executes tasks via cmd.exe or PowerShell. The campaign deployed additional PowerShell…
In a worrisome turn of events, messaging app giant Line Yahoo Corporation has revised the scope of its previously reported data breach. A deeper investigation uncovered additional compromises, significantly boosting the number of potentially leaked data points. This incident underscores the far-reac…
Kryptina RaaS is a Linux-focused ransomware framework that evolved from a paid underground offering to an openly available open-source tool after its source code was released on BreachForums, potentially expanding accessibility for attackers. The open-source r…
Rapid7 Incident Response investigated two exposed Confluence servers that were exploited via CVE-2023-22527, leading to remote code execution and the deployment of cryptomining and Sliver C2 payloads. The Sliver C2 was then used to fetch additional tooling (Ke…