Telegram hosts public marketplaces where phishing kits, scampage generators, stolen credentials, bulletproof hosting, and mailer services are traded, enabling low-cost end-to-end phishing campaigns. The article demonstrates how attackers can assemble a full Ba…
Ofuji Fishing Tackles, a renowned fishing tackle wholesaler and manufacturer in Japan has recently faced a severe cyber threat. The company disclosed a potential data breach involving personal customer information, a consequence of a ransomware attack targeting their systems. This incident, confirme…
Internet Shortcut files (URL files) are simple text-based shortcuts that can point to network resources and serve as components in threat chains. The article reviews how URL files have been weaponized across campaigns and vulnerabilities—from SmartScreen bypas…
Red Canary began investigating MSIX-based malware delivery in July 2023, uncovering three clusters that used malicious MSIX installers and malvertising to lure victims downloading legitimate software. These clusters—FIN7, Zloader, and FakeBat—utilize MSIX pack…
Alpha ransomware is an emerging threat that operates a dedicated data leak site (DLS) on the Dark Web, named MYDATA, with six victims listed and ongoing development noted. The operation shows evolving tactics, including ransom notes, a victim login panel for n…
Albabat is a Rust-written ransomware family that spreads via rogue downloads (fake Windows activators and game cheats), encrypts user files with a .abbt extension, and drops ransom notes while attempting to stop key processes and services. FortiGuard Labs docu…
ANY.RUN uses the Suricata NIDS (signature + anomaly) with external rulesets to detect and surface malicious network activity during sandboxed malware analysis. The platform highlights detections (e.g., Gh0st communicating with a C2 over encrypted channels), ex…
Two critical zero-days affecting Ivanti Connect Secure (CVE-2023-46805 authentication bypass and CVE-2024-21887 command injection) enable unauthenticated remote command execution and have been weaponized in the wild. Attacks use crafted HTTP requests carrying …
Iranian intelligence and military, along with contractors, target democratic processes in Western countries, including the 2020 US election.
In December 2022, threat actors exploited a publicly exposed RDP host to exfiltrate data and deploy Trigona ransomware across the network in about three hours. They used batch scripts and Netscan for discovery, data theft, and lateral movement, with Mega as th…
Cloud-native development expands both the attack surface and the corresponding detection surface because resources are API-defined and provisioned rapidly, creating telemetry that must be properly interpreted. Security teams need to map cloud telemetry (contai…
FortiGuard Labs analyzed a Phobos-family campaign that uses an XLAM document with embedded VBA to launch PowerShell, download Base64-encoded payloads from a Gitea repository, and deploy the FAUST ransomware via in-memory shellcode injection. The chain includes…
As we step into 2024, we anticipate a year that is poised to set several significant precedents. In this blogpost, we provide our Threatscape report, presenting our predictions for the global threats that lie ahead in the upcoming year. These……
A financially motivated actor is delivering a heavily modified AllaKore RAT (tracked as chancla.exe) to Mexican companies using malspam and MSI installers that verify Mexican geolocation before deploying a .NET downloader. The payload includes banking‑focused …
Arctic Wolf Labs uncovered CherryLoader, a Go-based loader masquerading as CherryTree used in intrusions to swap exploits without recompiling. It decrypts payloads, drops privilege-escalation tools (PrintSpoofer and JuicyPotatoNG), and relies on process ghosti…