Sekoia.io reviews cyber operations against past Olympic Games and assesses likely threats to Paris 2024, highlighting state-sponsored sabotage, espionage, hacktivism, and opportunistic cybercrime. Key technical concerns include destructive wiper malware (e.g.,…
CRIL uncovered a New Year-themed multi-stage malware chain starting from a ZIP that hides a shortcut LNK masquerading as a PNG. The infection flow uses MSHTA and JavaScript, decodes a payload with certutil, drops a DLL and performs DLL sideloading to reach a C…
SpectralBlur is a MacOS backdoor tracked as TA444 (Sapphire Sleet, BLUENOROFF, STARDUST CHOLLIMA) that researchers tie to SockRacket/KandyKorn and an early iteration of KANDYKORN, uncovered via domain investigations around pxaltonet.org and a dropped .macshare…
Two sentences summarizing the article: The piece analyzes how user agent strings observed on a DShield honeypot can reveal outdated software, spoofed devices, and scanning activity, including potential Log4j/JNDI exploitation attempts. It also demonstrates aut…
Cyfirma analyzes how threat actors use a YouTube channel to distribute a Monero cryptominer through multi-stage payloads, evasion, and persistence techniques. The report highlights dynamic download URLs, anti-analysis measures, C2 communications, and safeguard…
Analysis of the BlankGrabber stealer shows it is packaged as a PyInstaller executable with multi-layer obfuscation and AES encryption, exfiltrating data via Discord webhooks while performing sandbox/VM checks and Defender evasion before launching bundled paylo…
Sea Turtle is a Turkey-based APT focused on espionage and information theft against European and Middle Eastern targets, including government, NGOs, telecoms, IT services, and Kurdish groups; their operations have evolved to evade detection and involve reverse…
AttackIQ has released a new attack graph in response to the recently published CISA Advisory (AA23-353A) which disseminates Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) associated with the ALPHV BlackCat Ransomware-as-a-Service (RaaS) identified through FBI investigations as recently as December 6, 2023.
The post Response to CISA Advisory (AA23-353A):…
The article analyzes technical changes in a new MetaStealer build: updated class names, a layered string decryption routine (base64 → XOR → base64), and a dnlib-based dynamic approach to identify and invoke decryption methods to recover embedded payloads. It s…
Ateam Inc., a developer of content for smartphones, disclosed that 935,779 personal data records stored in their cloud service were accessible over the Internet.The company stated that they use the cloud service ‘Google Drive’ across their group. However, they discovered permission-setting errors in…
Panasonic Avionics Corporation (PAC), revealed that they suffered a cyberattack at the end of 2022, which may have led to the leak of personal information related to employees.According to Panasonic, the internal network systems of PAC were compromised in a cyberattack. The breach was discovered app…
As the world adorned its festive attire, the cybercriminal community in the shadowy realms of the Dark Web orchestrated their chilling celebration – “Leaksmas.” This event, coinciding with the Christmas season, unfolded as a sinister display of data sharing among hackers, as observed by Resecurity.T…
FortiGuard Labs highlights 8base, a Windows-targeted ransomware variant likely based on Phobos, delivered via SmokeLoader and featuring data exfiltration and high ransom demands. The write-up covers infection vectors, victimology, encryption behavior, variant …
Resecurity uncovered a cybercriminal group known as the GXC Team, led by googleXcoder, that developed AI-powered tools for invoice fraud, wire transfers, and business email compromise (BEC). Their AI-enabled toolset includes FraudGPT/WormGPT-based platforms an…
Unit 42’s timely threat intelligence roundup for Oct–Dec 2023 surveys malware campaigns, infection chains, and IoCs shared via social channels. It highlights recurring families—DarkGate, Pikabot, IcedID, AsyncRAT, and JinxLoader—and TA577 activity, with practi…