Unit 42 researchers uncovered two North Korea–linked campaigns targeting job seekers: Contagious Interview, which lures developers via fake interviews to install malware, and Wagemole, which uses forged identities to seek remote employment. The campaigns intro…
In this report Kaspersky researchers provide an analysis of the previously unknown HrServ web shell, which exhibits both APT and crimeware features and has likely been active since 2021.
Insikt Group’s analysis of high-impact scam website campaigns before Black Friday reveals key scammer themes and protective measures for consumers and businesses.
A widespread phishing campaign that started distributing DarkGate in September has evolved with evasive, anti-analysis measures and now also delivers PikaBot, using tactics similar to QakBot campaigns. The attack chain commonly uses hijacked email threads, tai…
ReliaQuest analyzed a Scattered Spider intrusion that spanned cloud and on-prem environments, culminating in data exfiltration and encryption. The attackers used social engineering, Okta/Azure AD abuse, Citrix VDI access, and rapid pivoting with persistence to…
WailingCrab is a multi-stage malware campaign that loads, injects, and decrypts payloads to establish a backdoor and C2 communication, with MQTT-based traffic hiding its command channel behind a third‑party broker. The newer variant shifts away from Discord-ho…
Volt Typhoon is a state-sponsored APT, widely attributed to China, targeting critical infrastructure and government-adjacent entities with sophisticated, stealthy operations. Recent U.S. government actions disrupted a Volt Typhoon botnet and highlighted the ne…
North Korean-aligned threat actors targeting macOS staged a busy 2023, with RustBucket and KandyKorn as the two major campaigns examined. The analysis shows actors mixing components across operations—using SwiftLoader droppers to pivot to KandyKorn payloads—an…
The Andariel threat group is suspected of exploiting the Apache ActiveMQ CVE-2023-46604 remote code execution vulnerability to deploy malware, including NukeSped and TigerRat backdoors, after observing related activity such as HelloKitty-related components. Th…
Check Point Research detected a coordinated rug pull that siphoned nearly $1 million by creating fake tokens, inflating perceived trading activity, and withdrawing liquidity. The actor used wallet 0x6b140e79db4d9bbd80e5b688f42d1fcf8ef97798 and fake tokens such…
Fortinet researchers describe a Konni campaign that uses a Russian-language Word document with a malicious VBA macro to drop a ZIP payload, run batch installers, bypass UAC, install a persistent Windows service, and communicate with encrypted C2 channels. The …
The Bakrie Group is an Indonesian conglomerate founded by Achmad Bakrie in 1942. It has interests across various industries including mining, oil and gas, property development, infrastructure, plantations, media and telecommunications
A NCC Group incident response study analyzes NoEscape ransomware techniques observed in a recent engagement, highlighting opportunistic access and noisy tool use. The findings cover ProxyShell exploit access to Exchange, RDP lateral movement with SSH tunneling…
Check Point Research analyzes Linux- and ESXi-targeting ransomware across 12 families, highlighting rising activity and cross-platform development. The study finds Linux variants are often encryption-focused and simpler than Windows counterparts, with OpenSSL …
ASEC detected a malicious LNK file distributed to financial and blockchain personnel via email and other distribution methods, masquerading as Blockchain Corporate Solution Handbook Production.zip. The LNK leads to a multi-stage chain of payloads, including ob…