Microsoft Threat Intelligence uncovered a Diamond Sleet supply chain attack that tampered with a CyberLink installer to deliver a second-stage payload. The malicious file is signed with a valid CyberLink certificate, hosted on CyberLink infrastructure, and inc…
Trend Micro’s Managed XDR observed Genesis Market–style techniques returning, leveraging Node.js as a backdoor platform, EV code signing for defense evasion, and Google Colab as potential search-engine–optimized download sites. The attack chain involves a load…
CISA analyzed four submitted files tied to exploitation of CVE-2023-4966 against Citrix NetScaler appliances that perform registry hive exports, LSASS memory dumping, and remote command execution via WinRM. The toolset comprises a BAT launcher, an EXE that inj…
MetaStealer is a C# infostealer first advertised in March 2022 that reuses Redline Stealer code, is obfuscated with Confuser (ConfuserEx/Core), and stores configuration using Base64 + XOR encryption. It collects browser data, crypto-wallets, system info and sc…
Robin Banks is a Phishing-as-a-Service platform that sells phishing kits and has been updated to use hCaptcha, DDoS Guard proxying, and AiTM (evilginx2) capabilities to capture MFA/2FA. Recent activity shows a pivot toward cryptocurrency services (e.g., Coinba…
XWorm is a Windows RAT analyzed for its post-connection C2 communications, including how the client and server exchange encrypted data and commands. The article examines the payload structure, encryption, plugins, and data-exfiltration capabilities enabled aft…
DarkGate is a sophisticated Remote Access Trojan sold as Malware-as-a-Service by the actor RastaFarEye, evolving through multiple versions with advanced evasion and multi-stage loading chains. Trellix researchers document its deployment methods, feature set, a…
Cyble Research and Intelligence Labs uncovered a new Java-based stealer called Rude that secretly harvests data from Windows machines, including browser data, Discord tokens, Steam IDs, game information, and screenshots, and it communicates exfiltrated data vi…
Unit 42 documents three Stately Taurus campaigns in August targeting South Pacific entities, including the Philippines government, using renamed Solid PDF Creator and a side-loaded DLL to maintain persistence and C2 activity. The actors also disguised C2 traff…
INC Ransom is a newly identified ransomware actor that emerged in August 2023, targeting mainly US and Western organizations with double and triple extortion and partial encryption. Cybereason Threat Alerts detail its operations, blog-leak activity, and how th…
SharpLoader is a very old project that loads and decompresses a C# payload from a remote server or local file to execute it. The article details a PowerShell-based chain that bypasses AMSI, downloads stage payloads, decrypts and loads a Quasar RAT in memory, a…
The article traces the Andariel group’s malware campaign distributed via an asset management program, tying the group to Lazarus and detailing their use of Log4Shell and other vulnerabilities to attack South Korean targets. It also covers the Go-based download…
WinRAR CVE-2023-38831 is a zero-day exploited by multiple APT groups to drop and execute malware via specially crafted archives containing PDFs/JPGs. The article details campaigns by groups like DarkPink, Konni, SandWorm, APT28, and APT29, the malware families…
LockBit 3.0 affiliates exploited CVE-2023-4966 (Citrix Bleed) to gain initial access to Citrix NetScaler ADC/Gateway appliances, bypass MFA, and hijack legitimate sessions to harvest credentials and move laterally. The advisory outlines attacker TTPs, IOCs, an…
Securonix researchers describe an SEO poisoning/malvertising campaign dubbed SEO#LURKER that uses fake Google ads and lookalike sites to deliver a malicious WinSCP lure which sideloads DLLs and executes obfuscated Python payloads, resulting in C2 beaconing and…