In a new report, Recorded Future’s Insikt Group examines North Korea’s success in its cybercriminal operations targeting the cryptocurrency industry.
Serpent Stealer is a .NET 64-bit information stealer that performs environment checks, harvests browser autofill/history/passwords, crypto wallet data, SSH/FTP/Steam credentials, and exfiltrates data via webhooks and Discord. The malware uses sandbox/VM and de…
TrickMo reemerged in 2023 as an enhanced Android banking Trojan, shifting from screen recording to overlay-based credential capture and using JsonPacker for obfuscation. It communicates with a C2 server at keepass.ltd (194.169.175.138) and targets a broad set …
Researchers from Curated Intelligence detail a multi-platform credit-card information harvesting phishing campaign that leverages hotel and Booking brand impersonations, chat-based delivery, and fake Booking flows to harvest payment data. The operation links c…
Two public-facing servers running Adobe ColdFusion were exploited via CVE-2023-26360 at a Federal Civilian Executive Branch agency, with activity observed in June–July 2023. The advisory maps attacker tactics to MITRE ATT&CK, lists IOCs and procedures, and pro…
Genians Security Center observed a Korean-targeted APT campaign that delivers malicious OLE objects embedded in HWP documents to execute encrypted PowerShell payloads from the FlowerPower tool family. Attackers leverage GitHub as a covert command-and-control/h…
Apache ActiveMQ CVE-2023-46604 is being actively exploited to load remote XML configurations that trigger deserialization and remote code execution, enabling threat actors to deploy multiple payloads. Notable observed payloads include the new GoTitan Golang bo…
Malvertising campaigns linked to ScamClub redirected readers of top sites (AP, ESPN, CBS) to fake security alerts and malicious affiliates. The operation blended real-time bidding with obfuscated JavaScript and cloud hosting to evade detection and sustain mali…
Two sentences: In December 2022, BlueSky ransomware entered a public-facing MSSQL Server via a brute-force attack on the sa account, leading to a network-wide encryption within about 32 minutes. The intruders used Cobalt Strike and Tor2Mine for post-exploitati…
Nova is a sophisticated infostealer from MaaS operator Sordeal, designed to harvest browser credentials, system data, and crypto-wallet information while employing anti-forensic techniques and kernel-log evasion. The operators distribute Nova via free keys, le…
Infoblox’s DNS Early Detection Program identifies potentially malicious domains before OSINT feeds publish them, enabling earlier blocking and reducing risk. Void Rabisu’s ROMCOM backdoor (aka Storm-0978/UNC2596) is used for espionage and financially motivated…
Arctic Wolf Labs reports a new Cactus ransomware campaign that exploits public Qlik Sense installations to gain initial access, followed by deployment of the ransomware. The operation leverages Qlik Sense Scheduler to drop remote-access tools (ManageEngine UEM…
Cisco Talos uncovered a campaign that delivers a new remote access trojan called “SugarGh0st,” likely active since August 2023 and targeting Uzbekistan’s Ministry of Foreign Affairs and users in South Korea. The operation uses two infection chains via Windows …
CRIL identified a new Java-based RAT embedded in a ZIP file found on VirusTotal, triggered via a LNK file. The malware, named Saw RAT, offers multiple capabilities and communicates over a socket-based C2 channel; the threat actors and victims remain unknown. #…
NetSupport Manager variants use obfuscated JavaScript that launches wscript.exe and PowerShell to download and execute the legitimate-signed NetSupport client (client32.exe), then persist via hidden AppData folders and registry run keys. Observed infrastructur…