ESET researchers discovered Kamran, previously unknown malware, which spies on Urdu-speaking readers of Hunza News
Unit 42 researchers identify EleKtra-Leak, an automated campaign that targets exposed IAM credentials in public GitHub repositories to spin up AWS EC2 instances for cryptomining, and they used a HoneyCloud setup to monitor the operation and reveal rapid creden…
Spammers abuse Google Forms quizzes by exploiting the “Release scores” feature to deliver emails from Google’s servers, increasing the likelihood they reach victims’ inboxes. Cisco Talos notes a recent spike in these campaigns, including elaborate cryptocurren…
This report analyzes Kopeechka, a service that automates social-media account creation to support mass-scale cybercrime operations. It explains how Kopeechka works, its pricing and ecosystem (including ZennoPoster and CAPTCHA/phone-verification bypass), and ho…
An FBI-led operation dismantled Hive, one of the most notorious ransomware groups, preventing about $130 million in ransom payments and providing decryption keys to over 300 victims. The analysis then follows Hunters International, a suspected Hive successor f…
SystemBC, also known as Coroxy or DroxiDat, is a versatile Proxy malware/toolkit active since 2018, used as a backdoor and sometimes a RAT across various threat groups and underground markets. It commonly installs a Socks5 C2 channel after gathering system inf…
Stealc is a Malware-as-a-Service information stealer promoted by Plymouth, active since January 9, 2023, designed to covertly harvest a wide array of data from the victim and exfiltrate it directly to its command-and-control server. Its standout feature is a s…
FBI and CISA release a joint advisory detailing Royal ransomware’s operations, including initial access via phishing, data exfiltration with double extortion, and encryption techniques, plus observed tools and IOCs since 2022, with guidance for defenders. The …
Deep Instinct identified a Go-based C2 framework named MuddyC2Go used by MuddyWater since at least 2020; attackers deliver PowerGUI-built executables containing embedded PowerShell that automatically connect to MuddyC2Go C2 servers and switch to dynamic DNS fo…
Attackers published malicious Python packages masquerading as obfuscation tools that execute code at install time and fetch a secondary payload called BlazeStealer. The payload runs a Discord-based remote-access bot that enables data theft, keylogging, webcam …
BatLoader is a batch-based loader used to deliver payloads across multiple malware families, notably AgentTesla, QuasarRAT, AsyncRAT, Mallox Ransomware, and Cryptojacker campaigns, often via phishing. It loads payloads into memory through obfuscated PowerShell…
Imperial Kitten, an Iran-linked threat actor likely tied to the IRGC, conducted strategic web compromise operations and used novel malware families (e.g., IMAPLoader, StandardKeyboard) to target transportation, logistics, and technology sectors. CrowdStrike In…
SysAid’s on-premises software was found to have a zero-day path traversal vulnerability that allowed code execution, exploited by DEV-0950 (Lace Tempest). The attackers deployed a WebShell via a WAR file, loaded the GraceWire loader to inject into system proce…
The Bakrie Group is an Indonesian conglomerate founded by Achmad Bakrie in 1942. It has interests across various industries including mining, oil and gas, property development, infrastructure, plantations, media and telecommunications
ASEC reports active distribution of Phobos ransomware using vulnerable RDP services as an entry point. The analysis covers Phobos’ file-encryption behavior, ransom-note mechanics, persistence, defense evasion, and network-shared-folder encryption. #Phobos #Dha…