Jamf Threat Labs identified a new macOS malware variant attributed to the BlueNoroff APT group, linked to the Rustbucket campaign, embedded in a Mach-O universal binary labeled ProcessRequest. The malware communicates with swissborg.blog (resolved to 104.168.2…
Demonstrating three additional methods for obtaining unpacked malware samples. Using Process Hacker, Pe-sieve, Hxd and Pe-bear.
Unit 42 investigates a destructive, data-theft campaign attributed to the Iranian-linked Agonizing Serpens (Agrius) APT, targeting Israeli higher-education and tech sectors from January to October 2023. The operation blends data exfiltration with new wipers (M…
Trap Stealer is an open-source Python-based stealer that claims to pilfer a wide range of data from compromised systems in just 6 seconds, with exfiltration to threat actors via Discord webhooks. It leverages deceptive methods like fake gift-card generators an…
CYFIRMA highlights Good Day ransomware, an ARCrypter family member that disguises as a Microsoft Windows Update and employs stealthy techniques (like VSS deletion and debug-detection) while encrypting files and exfiltrating data. The report also covers related…
PDFs are a popular vector for delivering malware, often via phishing emails, and attackers abuse PDF features like JavaScript, embedded streams, and reader vulnerabilities to drop payloads. The article demonstrates real-world examples, open-source tools for an…
Hive0051 is documented by X-Force as executing large-scale, synchronized multi-channel DNS fluxing to remap its C2 infrastructure across Telegram channels and Telegraph sites, enabling persistent operations and dynamic reallocation of victims across Gamma malw…
Prolific Puma is a DNS threat actor that has operated unnoticed for over four years, primarily focusing on domain generation and link shortening services for malicious activities. This underground network creates a vast number of domains using an RDGA to suppo…
Social media platforms offer immense opportunities for financially motivated
threat actors to conduct large-scale attacks against unsuspecting Internet
users. Fraudulent and malicious threats are prevalent on all social networks and
it has become crucial for users to be aware of the latest tricks that can
compromise the security of their accounts, data, reputation and finances.
Cybercriminals always seek to trick users into taking all sorts of unwelcome
actions, and one way they achieve this is
ReversingLabs mapped a coordinated campaign that published hundreds of malicious NuGet packages since August, and found actors evolving from PowerShell-based downloaders to abusing NuGet’s MSBuild integrations by embedding executable inline tasks in .targets f…
McAfee Labs details a stealthy AsyncRAT campaign distributed via a malicious HTML file, leveraging multiple script types to evade detection. The infection chain culminates in RegSvcs.exe process injection, keylogging, credential and browser data theft, and dat…
Unpacking an Asyncrat loader using Process Hacker and Dnspy
Netskope Threat Labs reports a new DarkGate variant delivered via MSI that uses a loading chain inspired by Cobalt Strike to reach its final payload. The malware employs multiple loaders (DLL side-loading, Delphi, AutoIt) across several stages to deliver DarkG…
Cyble Research and Intelligence Labs identified a Java RAT named Sayler, detected as a zero-detection JAR on VirusTotal, which targets Polish-speaking users and includes features like keylogging, information theft, screen capture, ransomware, and more, using a…
Blister is a loader that drops payloads and has evolved to support targeted deployments, environmental keying, and obfuscated first-stage loading, with a shift from Cobalt Strike to Mythic agents. The article catalogs 137 unpacked Blister samples over about tw…