Trend Micro collaborated with INTERPOL to monitor and report FIFA World Cup 2022 cyber threats, helping to block attacks and mitigate risks around the event. The findings highlight fake ticketing sites, fake live streaming, survey scams, and crypto-related mal…
Mallox operates as a RaaS platform with affiliates conducting attacks since 2021, sharing profits with operators. The post details incident response that helped a victim fully recover and outlines Mallox’s techniques from initial access to extortion, plus reco…
Mandiant describes CLINKSINK, an obfuscated JavaScript drainer used in phishing campaigns that target Solana users by tricking them into connecting Phantom wallets and signing fraudulent transactions. The drainer retrieves AES-encrypted configuration and affil…
Sysdig researchers built an automated WAF fuzzer (Wafer) that used PortSwigger XSS payloads and Selenium-driven interaction to discover that AWS WAF failed to block payloads leveraging the experimental DOM event onbeforetoggle. The team reported the issue to A…
Securonix tracked a financially motivated campaign dubbed RE#TURGENCE that brute forced exposed MSSQL servers to gain access, then used xp_cmdshell to run encoded PowerShell downloaders, deploy Cobalt Strike and AnyDesk, harvest credentials, move laterally, an…
Avast, in cooperation with Cisco Talos and the Dutch Police, released an updated free decryptor that restores files encrypted by the Babuk variant called Tortilla. The tool is effective because Tortilla was built from leaked Babuk source code and uses a shared…
FortiGuard Labs found attackers hijacking YouTube channels to distribute a Lumma Stealer variant via cracked-software videos that link to ZIP archives hosted on GitHub and MediaFire. The chain uses an LNK that launches PowerShell to fetch a SmartAssembly-obfus…
Water Curupira-affiliated spam campaigns in 2023 delivered the Pikabot loader via password-protected ZIP/IMG attachments and malicious PDFs, using obfuscated JavaScript and LNK files to retrieve and execute a DLL payload via rundll32.exe. The Pikabot DLL perfo…
This article explains how to perform .NET managed hooking with the open-source Harmony library, covering patch types (Prefix, Postfix, Transpiler, Reverse Patch), injection/bootstrapping via reflection or injectors, and examples of manual patching using Harmon…
Aqua Nautilus researchers uncover a stealthy attack targeting Apache Hadoop and Flink apps, using packers and rootkits to conceal malware and evade defenses. The operation abuses misconfigurations in Hadoop YARN and Flink unauthenticated RCE to deploy a downlo…
CyFirma examines Silver RAT, a Windows-based tool built to bypass AV, log keystrokes, encrypt data, destroy restore points, and run hidden processes. It traces the developer ecosystem around Anonymous Arabic, including Telegram channels and underground forums,…
eSentire’s TRU team analyzed a Ducktail malware attempt delivered via LinkedIn, featuring multi-stage PowerShell payloads, obfuscated scripts, and UAC bypass techniques. The campaign culminated in a remote command-and-control setup with persistence via schedul…
Microsoft’s DCU exposed a Vietnam-based group, Storm-1152, that used CAPTCHA-solving tools to automate massive creation of Microsoft email accounts (Hotmail/Outlook), potentially totaling hundreds of millions of accounts. The operation leverages multiple CAPTC…
The article shows how attackers with Contributor access to an Azure Container Registry (ACR) can create malicious ACR Tasks that authenticate as attached Managed Identities to obtain access tokens, and introduces MicroBurst’s Invoke-AzACRTokenGenerator to auto…
Qakbot has resurfaced after the “Duck Hunt” disruption and is being delivered via phishing emails that drop malicious PDFs and an MSI installer containing a patched IDM DLL with the malware. The campaign unpacks a memory-loaded second-stage using VirtualAlloc/…