UAC-0050’s Ukrainian-targeted operation leverages RemcosRAT with a Windows pipe-based interprocess communication channel to evade EDR/antivirus defenses and move data covertly. The campaign uses a multi-stage chain (LNK → HTA → VBScript → PowerShell) culminati…
Three PyPI packages — modularseven-1.0, driftme-1.0, and catme-1.0 — were uploaded by the author “sastra” to deploy a CoinMiner on Linux devices, using remote-hosted payloads and staged execution to evade detection. The campaign enhances persistence by adding …
Microsoft Threat Intelligence warns that financially motivated actors are abusing the ms-appinstaller protocol to distribute malware via signed MSIX packages and malicious landing pages, tying multiple groups like Storm-0569, Storm-1113, Sangria Tempest, and S…
Meduza Stealer 2.2 has been released with broader client support (including browser-based wallets) and enhanced credential/token dumping capabilities, aiming to rival Azorult, Redline, Racoon, and Vidar. The update includes a revamped interface, expanded data …
SOCRadar profiles the Cactus Ransomware Group, detailing its self-encrypting ransomware, evasion techniques, and double-extortion tactics used against organizations worldwide. The piece highlights VPN exploitation, a multi-layer infection chain, and a Tor-base…
Cybersecurity researchers report that the Kimsuky threat group—backed by North Korea—uses weaponized LNK shortcut files to deploy AppleSeed and AlphaSeed malware, often with JavaScript or Excel macros for initial execution. The group persists in using AppleSee…
Over the past year, 1,152 potentially malicious attachments were captured, yielding 525 unique samples (285 PE files and a mix of scripts, Office files, PDFs, and more). The collection ranged from a tiny 1.32 KB VBE VBScript downloader to a ~350 MB .NET EXE wi…
Pure Logs Stealer is a .NET stealer distributed by PureCoder that collects system info, browser credentials (including encrypted mnemonics), Discord tokens, and other application data, then encrypts and sends it to a C2 via a TCP socket. The tool is obfuscated…
The ransomware group Akira has declared responsibility for the recent cyberattack on the systems of Nissan in Australia and New Zealand. The hackers claim to have exfiltrated over 100 GB of documents from the automaker.Now, the malefactors are threatening to release confidential business and client…
The Kimsuky threat group (North Korea-linked) continues spear-phishing campaigns against defense and government sectors, using AppleSeed/AlphaSeed alongside other tools to control infected systems. Recent operations show a shift toward LNK- and JavaScript-base…
This guest diary analyzes Mirai activity observed on the DShield honeypot, highlighting repeated attempts to upload Mirai malware to IoT devices with weak credentials. It also covers Mirai’s propagation, persistence in memory, and practical defenses such as lo…
Cyble Research and Intelligence Labs detail the QBit RaaS group’s Go-based ransomware and the freely released qBit Stealer source code, highlighting its selective exfiltration approach and use of Mega.nz for uploads, which could expand adoption among new threa…
Barracuda confirms that a China-nexus threat actor (UNC4841) exploited an Arbitrary Code Execution vulnerability in a third-party library to deploy backdoors on ESG appliances, with patches and remediation guidance issued. The campaign involved new SEASPY and …
French video game developer Ubisoft has once again fallen victim to a cyberattack. On the morning of December 22, 2023, a security research team shared screenshots allegedly from Ubisoft’s internal services. Ubisoft subsequently acknowledged a suspected data breach incident, confirming that an inves…
Bandook is a long-running RAT that FortiGuard Labs found being distributed via a PDF that links to a password-protected .7z archive; once extracted, the malware injects into msinfo32.exe and uses registry-based control codes to drive actions and persistence. I…