Unit 42 identifies malicious Chinese APT infrastructure masquerading as cloud backup services targeting Cambodian government entities, with long-running activity tied to geopolitical aims. The operation uses a multi-domain, multi-IP C2 setup, a Cowrie honeypot…
Predator AI is a Python-based infostealer/hacktool targeting cloud platforms, integrating a GPTj-powered ChatGPT interface to simplify use. While not production-ready, it demonstrates how AI could streamline threat-actor workflows by enriching data and adding …
SEQRITE Labs observed multiple SideCopy campaigns that deploy Windows and Linux RATs using phishing lures, reused compromised domains, and exploitation of the WinRAR zero-day CVE-2023-38831 to trigger payloads. The actor delivered AllaKore, DRat, Key RAT and a…
Unpacking a simple Cobalt Strike loader using Debuggers and Hardware breakpoints.
An NCC Group analysis dives into the D0nut extortion group’s TTPs, detailing how they used Cobalt Strike, BYOVD, GPO modifications, RDP, and Rclone-based exfiltration to deploy ransomware. The report links potential ties to HelloXD and other groups like Hive/R…
CYFIRMA analyzes Millenium RAT, a .NET Win32 RAT that has evolved from version 2.4 to 2.5 and is actively developed, with access sold on GitHub and details shared via Telegram. The report highlights the tool’s extensive data theft, anti-analysis, persistence, …
Researchers identified a fresh Gootloader variant named “GootBot” that adds lateral movement and stealth to post-infection activity. It uses hardcoded C2 servers on compromised WordPress sites and avoids common off-the-shelf tools to deploy additional payloads…
GhostSec unveils GhostLocker, a Ransomware-as-a-Service framework, withsold through a dedicated Telegram channel and a current focus on Israel, signaling a shift in their activity. The report details GhostLocker’s build/operation, historical attacks against Is…
A malvertising campaign impersonates a legitimate Windows portal (WindowsReport.com) to push a CPU-Z installer, delivering a signed MSIX payload that runs a malicious PowerShell script via a loader called FakeBat to install the Redline stealer. The operation u…
A WhatsApp mod with a built-in spy module has been spreading through Arabic and Azeri Telegram channels since August 2023.
Unpacking an Asyncrat loader using Process Hacker and Dnspy
eSentire’s TRU team details a stealthy NetWire RAT deployment chain starting with a drive-by download and culminating in process hollowing via Frenchy Shellcode, aided by AntiVM checks, UAC bypass, and persistence. The write-up covers the delivery chain, core …
The Russia-based SWAT USA Drop reshipping service, a major operation laundering stolen merchandise, was hacked, exposing its internal operations, finances, and organizational structure. The leak details how “drops” and “stuffers” use stolen credit cards to buy…
Threat researchers from eSentire’s TRU describe how DarkGate loader is used to deploy DanaBot, highlighting drive-by download delivery, a rich feature set, and advanced evasion techniques. The post also covers observed IOCs, attacker infrastructure, and remedi…
Jamf has identified ObjCShellz, a new macOS malware linked to North Korean BlueNoroff/Lazarus actors and likely part of the RustBucket Campaign, targeting crypto exchanges. The sample shows a simple remote-shell capability with a hardcoded C2 address, and rese…