For the latest discoveries in cyber research for the week of 27th November, please download our Threat_Intelligence Bulletin. TOP ATTACKS AND BREACHES Nevada-based medical transcription company, Perry Johnson & Associates (PJ&A), has disclosed a data breach that affected more than 9M patient…
Threat actors repurpose native Windows tools (LOLBins) such as finger.exe to enable data ingress and exfiltration while blending in with legitimate activity. The Huntress report shows finger.exe used to download files to the endpoint, enumerate information, an…
Leveraging Ghidra to establish context and intent behind imported functions.
ParaSiteSnatcher is a modular malicious Chrome-extension framework delivered by VBScript downloaders that abuses the Chrome extension API to intercept POST requests, harvest cookies and form data, and exfiltrate banking and identity details from Brazilian targ…
Leveraging Ghidra to establish context and intent behind suspicious strings.
Manually Reversing a decryption function using Ghidra, ChatGPT and CyberChef.
RisePro has evolved from a commodity info-stealer into a variant with remote-control capabilities, adopting a new TCP-based C2 protocol and HVNC features. This article analyzes the updated RisePro network patterns, staged C2 workflow (initialization, configura…
Telekopye is a Telegram-based toolkit that helps scammers run targeted phishing campaigns by generating phishing web pages, emails, and SMS for online marketplaces. The article analyzes its features, its group-based organization, and how operators referred to …
Vidar, evolved from the Arkei Stealer, is a sophisticated credential stealer capable of extracting data from 2FA software and the Tor Browser. Censys tracked Vidar’s TLS-based C2 infrastructure, identifying 22 unique IPs and tying the activity to Scattered Spi…
Check Point Research describes new SysJoker variants used in targeted attacks against Israeli organizations, highlighting a full rewrite in Rust and a shift from Google Drive to OneDrive for hosting encrypted C2 configuration. The report details persistence vi…
eSentire’s TRU team analyzes Parallax RAT operations, including initial drive-by delivery, lateral movement via PsExec, and persistence through Startup/Run keys, with obfuscation techniques like RC4 encryption and anti-disassembly. The report notes that Parall…
Qualys Threat Research uncovers Phobos ransomware masquerading as VX-Underground (VXUG), often distributed via stolen RDP and operating as a RaaS linked to Dharma/CrySIS. The article details anti-analysis checks, a wide process-kill routine, backup and firewal…
The article analyzes AgentTesla infection stemming from a Spanish-language email with an attached RAR archive, leading to a VBS dropper and a base64-based delivery chain that culminates in FTP data exfiltration. It outlines the infection chain, artifacts, and …
Threat-hunting activity builds on VirusTotal Intelligence to track LOLBAS-based behavior and related sample sets from October–November 2023, tying observed techniques to groups like APT33 and The Gorgon Group. The post highlights Start-BitsTransfer, WMI Event …
CRIL identified Persian Remote World, a site selling a suite of malicious tools including RATs, loaders, and crypters. The collection features operational panels, free and paid variants on Telegram, and a range of capabilities such as privilege escalation, fir…