Credit card skimming campaigns are rising during the holiday shopping season, with the Kritec operation tailoring its skimmers for each victim site and expanding its infrastructure. The article also offers safety guidance for online shoppers and publishes a li…
A targeted disinformation operation aimed at Spanish Russian-speaking residents during the 2023 general elections used a fake website impersonating the Community of Madrid and Telegram messaging to discourage voting. The campaign demonstrates niche demographic…
Cyble Global Sensor Intelligence (CGSI) reports ongoing exploitation of newly disclosed Citrix CVE-2023-4966 and F5 BIG-IP CVEs 2023-46747/46748, with PoCs circulating in cybercrime forums and thousands of internet-facing vulnerable devices identified. The rep…
ASEC observed PDF-based phishing campaigns distributing files that lure users to malicious URLs, triggering a chain that downloads and executes more payloads. The flow includes decryption prompts, admin-level execution, Defender evasion, browser credential the…
NSFOCUS Research Labs analyzes DarkCasino, a financially motivated APT group, its use of the WinRAR CVE-2023-38831 zero-day, and how multiple known and unknown actors exploited this vulnerability in widespread campaigns targeting governments and crypto-related…
Threat actors used DRACOON.team to host a PDF that contained a secondary link to an attacker-controlled reverse proxy impersonating the Microsoft 365 login page, capturing credentials and session cookies. Stolen credentials and cookies were used to access Micr…
Secureworks CTU researchers demonstrated an “application smuggling” technique that abuses Microsoft Entra ID (Azure AD) consent and the preAuthorizedApplications manifest setting to make tenants consent to both a verified app and a malicious unverified app. Mi…
Chinese state-sponsored cyber operations have transformed, emerging as a more mature, stealthy, and coordinated threat than in previous years.
The Ducktail malware, designed to hijack Facebook business and ads accounts, sends marketing professionals fake ads for jobs with major clothing manufacturers.
SecurityJoes first reported a Linux wiper named BiBi-Linux Wiper used by pro-Hamas hacktivists. BlackBerry later identified a Windows variant, BiBi-Windows Wiper, signaling the threat is expanding to Windows end-user machines. #BiBiLinuxWiper #BiBiWindowsWiper…
OracleIV describes a campaign that exploits publicly exposed Docker Engine API endpoints to pull a malicious image, delivering a Python/Cython ELF payload that acts as a DDoS bot; the image also includes XMRig-related files, and the operators control the botne…
Unauthorized access activity in healthcare networks leveraged a locally hosted ScreenConnect remote access tool to gain initial access and maintain persistence, with attackers installing additional remote tools like ScreenConnect and AnyDesk across two endpoin…
A July 2023 NATO-NATO Summit-targeting campaign leveraged a weaponized Word document to exploit CVE-2023-36884 and bypass Microsoft’s MotW, leading to a multi-stage infection chain attributed to Storm-0978 (RomCom Group). Microsoft’s CVE-2023-36584 vulnerabili…
Cerber ransomware exploits CVE-2023-22518 in Atlassian Confluence Data Center and Server to gain unauthorized admin privileges and deploy its payload. It uses an encoded PowerShell command to fetch the payload, encrypts files with the .L0CK3D extension, drops …
Mandiant details a two-stage Sandworm operation in Ukraine that used a virtual CD-ROM autorun to run VBS/batch files which invoked the native MicroSCADA utility scilc.exe to execute SCIL commands against substations, causing an unplanned power outage. Two days…