DarkGate is a modular loader increasingly used by financially motivated actors (e.g., TA577, Ducktail, BianLian, Black Basta) to gain initial access, deploy follow-on tools (info-stealers, Cobalt Strike, ransomware), and exfiltrate data from primarily financia…
This article builds a simple .NET obfuscator that hides string literals using proxy functions, per-character splitting, numeric masking, heavy math expressions, and control-flow (CFG) shuffling implemented with dnlib. It then shows how run-time inspection and …
Fortinet’s FortiOS SSL VPN is affected by a critical Remote Code Execution vulnerability (CVE-2024-21762) with PoC exploits and active exploitation chatter, alongside related issues in Shim (CVE-2023-40547) and Ivanti (CVE-2024-22024). The report also highligh…
The Sandman APT group has drawn major attention for targeting telecommunications providers in Europe, the Middle East, and South Asia, employing LuaDream, a LuaJIT-based modular backdoor, to achieve stealthy espionage with minimal footprints. Research ties San…
Sticky Werewolf, a cyber-espionage group, attempted to attack Belarusian companies by distributing a CCleaner6.20 installer that drops the Ozone RAT. The campaign featured a large SFX payload (75.79 MB) built with NSIS, hiding obfuscated AutoIt and BAT scripts…
Proofpoint researchers describe an ongoing cloud account takeover campaign targeting Microsoft Azure environments, affecting hundreds of user accounts including executives. The attackers use credential phishing within personalized lures and MFA manipulation, a…
In June 2023, we’ve observed multiple alerts that seemingly came from different sources. A quick search through our telemetry allowed us to identify multiple infected machines across our clients. Although they would sometimes present different behaviour, the initial infection vector……
This tool allows you to search files by reading the contents of a file. Included Features Regular expressions Concurrent multiple file types Recursive directory searching A “context” feature that selects the lines above and below your search expression, or view entire file Most Recently Used li…
Discover key insights from Insikt Group’s analysis on ransomware exploitation patterns and targets from 2017–2023.
AttackIQ has released a new attack graph in response to the recently published CISA Advisory (AA24-038A) which assesses that the People’s Republic of China (PRC) state-sponsored cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major…
The .tprc ransomware has reappeared with an evolved loader that extracts a PE payload from a .NET resource, injects it into a suspended RegAsm.exe process, establishes C2 connectivity, and encrypts user files using AES before appending a 48‑byte blob and chang…
eSentire’s TRU reports a surge of SolarMarker infections across multiple industries since late 2023, with evolving payloads and anti-analysis techniques. The researchers detail the infection chain—from installer-based payloads to PowerShell-based decrypt-and-e…
The Importance of Patching: An Analysis of the Exploitation of N-Day Vulnerabilities | Fortinet Blog
Fortinet analyzes the exploitation of known Fortinet N-Day vulnerabilities in FortiOS, detailing multi-cluster malware activity that uses living-off-the-land techniques and persistence mechanisms to target government and critical infrastructure. The report lin…
eSentire’s TRU details a January 2024, multi-stage threat starting with a lure ZIP named IMG_Mia_khlifa delivered via a Discord CDN, containing AnyDesk and a VBS file that leads to a DcRat drop. The campaign escalates to RemcosRAT with dynwrapx.dll, injection …
This post analyzes ShadowPad infrastructure tied to an unidentified threat actor, highlighting non-standard HTTP headers and a certificate spoofing Dell to mask its origin. It catalogs ShadowPad servers across multiple providers, outlines two main port-based c…