We will delve into the workings of the infection chain and explore the capabilities of the new Trojan that specifically targets users of more than 60 banking institutions, mainly from Brazil.
Darktrace observed widespread CoinLoader loader infections in late 2023 that established encrypted C2 channels, used DNS tunnelling and DLL search-order hijacking, and in many cases led to cryptocurrency mining activity. Darktrace DETECT identified anomalous C…
Talos discovered a new, stealthy espionage campaign that has likely persisted since at least March 2021. The observed activity affects an Islamic non-profit organization using backdoors for a previously unreported malware family we have named “Zardoor.”…
McAfee Mobile Research describes a new MoqHao Android variant that auto-executes immediately after installation by abusing an Android installation uniqueness check, allowing malicious behavior without the user launching the app. The campaign uses smishing with…
U.S. agencies warn that PRC-aligned Volt Typhoon actors have been pre-positioning long‑term access in U.S. critical-infrastructure IT environments—using living-off-the-land techniques, valid credentials, and covert proxying to enable lateral movement toward OT…
A .NET 32-bit DotStealer sample collects browser credentials, credit card data, cookies, downloads and desktop files, stages them into a ZIP and exfiltrates via Telegram using a ROT13-decoded token and chat ID. The loader evades analysis by checking a username…
S2W TALON researchers uncovered Troll Stealer, a Go-based info-stealer linked to the Kimsuky group, distributed via a page that redirects to a South Korea site and uses a stolen certificate to sign both the dropper and the malware. The campaign targets South K…
Cyble Research and Intelligence Labs (CRIL) uncovered an active malware campaign targeting cryptocurrency users, deploying deceptive phishing sites that impersonate Metamask, WazirX, Luno, and Cryptonotify. The campaign uses the XPhase Clipper to intercept and…
PAPERWALL is a large network of anonymous Chinese websites that pose as local news outlets to push pro-Beijing content to audiences worldwide, leveraging Times Newswire as a seed source and embedding political material within largely benign-looking content. Th…
The Avast Q4/2023 Threat Report chronicles a record year of attacks, highlighted by the revival of Qakbot, a surge in PDF-based social engineering, and expanding menace across adware, information stealers, ransomware, and mobile threats. It also covers notable…
BlueShell is a Go-based backdoor used against Linux systems in Korea and Thailand, with a threat actor customizing and deploying it via a dropper that loads the malware into memory. The campaign features environment-variable-configured C2 data, TLS-enabled C2 …
Lumen’s Black Lotus Labs documented KV-botnet as a covert data-transfer network used by China-based state-sponsored actors and observed a concentrated re-exploitation effort in early December 2023 after a court-authorized takedown began. Lumen null-routing and…
HijackLoader continues to become increasingly popular among adversaries for deploying additional payloads and tooling A recent HijackLoader variant employs sophisticated techniques to enhance its complexity and defense evasion CrowdStrike detects this new HijackLoader variant using machine learning and behavior-based detection capabilities CrowdStrike researchers have identified a HijackLoader (aka IDAT Loader) sample that employs sophisticated evasion […]
Check Point Research details how the Raspberry Robin worm rapidly integrated new kernel LPE exploits (including CVE-2023-36802 and CVE-2023-29360), shifted delivery and lateral movement methods, and added multiple anti-analysis and evasion techniques. The repo…
Ivanti disclosed two zero-day vulnerabilities in Ivanti Connect Secure and Policy Secure that enable authentication bypass and command injection, which were quickly probed and exploited in the wild by an actor tracked as UNC5221. AttackIQ published an assessme…