Australian sanctions target Aleksandr Ermakov for allegedly stealing data on about 9.7 million Medibank customers and leaking it after a ransom dispute. Authorities link him to REvil and a ransomware affiliate ecosystem, with multiple handles and operatives ti…
On February 2, 2024, AnyDesk, a popular remote desktop software provider, announced that it had fallen victim to a cyberattack that compromised its production systems. The breach, orchestrated by malicious actors, has far-reaching implications for AnyDesk customers.The incident came to light when An…
AnyDesk, a widely used remote desktop software, recently announced a significant breach within its production environment. Despite the unsettling access gained by hackers, AnyDesk assured its user base that no authentication tokens were compromised, as these crucial elements reside solely on the use…
Evaluation of a new variant of Mispadu, a banking Trojan, highlights how infostealers evolve over time and can be hard to pin to past campaigns.
The post Exploring the Latest Mispadu Stealer Variant appeared first on Unit 42….
macOS.Bkdr.Activator is a multi-stage macOS malware campaign spread through cracked apps distributed via torrent sites, designed to infect users at scale. It patches legitimate cracked software, disables Gatekeeper, and uses Python-based payloads and DNS-based…
The article explains how analysts extracted Telegram bot credentials from malicious packages and used Telegram’s API to retrieve and forward messages sent to attackers’ bots. It also describes handling webhook-based forwarding (e.g., a7d8a278870ff9da6427af6d9d…
Volexity used memory forensics to reconstruct an exploit chain that chained two zero-day vulnerabilities in Ivanti Connect Secure VPN to achieve unauthenticated remote code execution. Memory analysis of uwsgi processes revealed base64-encoded commands, a vulne…
Snyk disclosed four high-severity container build-time vulnerabilities (CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, CVE-2024-23653) that enable container escape or host manipulation when attackers control the Dockerfile. Sysdig published Falco detection ru…
ESET researchers discovered several Android apps carrying VajraSpy, a RAT used by the Patchwork APT group
An active campaign delivering a new PowerShell backdoor tracked as SUBTLE-PAWS targets Ukrainian military personnel via compressed archives containing malicious .lnk shortcuts that load encoded PowerShell payloads and spread through USB drives. The backdoor st…
This analysis dissects DiceLoader (aka Icebot), a small FIN7-associated downloader that is injected via Reflective DLL injection, uses a multi-threaded IoCompletionPort + linked-list architecture, and executes deobfuscated shellcode delivered over a bespoke ra…
Cloudflare detected a threat actor on its self-hosted Atlassian server during Thanksgiving 2023 and began an investigation, later engaging CrowdStrike for forensic analysis. The incident involved stolen credentials from an Okta compromise used to access Jira/C…
ASEC uses a Linux SSH honeypot to monitor attacks against Linux systems and describes how threat actors install backdoor accounts or SSH keys via brute-force and dictionary attacks on poorly managed servers. The article covers backdoor account creation, root-p…
Commando Cat is a novel cryptojacking campaign that exploits exposed Docker API endpoints to gain initial access and run a chain of host-level payloads. It deploys backdoors, credential theft targeting AWS, GCP, and Azure, and a cryptocurrency miner, all while…
capa v7.0 adds dynamic analysis support for CAPE sandbox JSON reports, enabling capability extraction from runtime API traces and improving triage of packed or obfuscated samples. The release introduces a dynamic analysis flavor (process/thread/call scopes), f…