ESET Research recommends updating Roundcube Webmail to the latest available version as soon as possible
Improving Malware Analysis Workflows by Modifying the default Ghidra UI.
Two October 2023 TA571 campaigns delivered a Forked IcedID loader via thread-hijacking emails that downloaded a password-protected ZIP. The operation used 404 TDS redirects and intermediary gates to filter targets and bypass analysis, ultimately loading IcedID…
Fortinet’s FortiGuard Labs details Knight ransomware, a relatively new double-extortion group active since August 2023 that encrypts files and exfiltrates data for ransom. The report covers infection via phishing campaigns delivering Knight through Remcos and …
Elastic Security Labs details a DPRK-linked intrusion targeting blockchain engineers via a Discord DM lure, employing a multi-stage Python-based chain and memory-resident payloads (SUGARLOADER, HLOADER, KANDYKORN) with RC4-encrypted C2 communications. The oper…
ESET Research uncovered a kill switch that took Mozi, a prolific IoT botnet, out of operation. The payload, delivered via UDP and signed with private keys, disabled services, killed the original malware, and staged updates. #Mozi #IoTBotnet
In this report, we share our latest crimeware findings: GoPIX targeting PIX payment system; Lumar stealing files and passwords; Rhysida ransomware supporting old Windows.
Malvertising via Google Dynamic Search Ads exploited a compromised website to indirectly deliver malware to visitors. An auto-generated ad for PyCharm directed users to a hacked page that unleashed a malware bundle after downloading a serial-key installer. #Py…
Elastic Security Labs uncovered a campaign delivering signed MSIX packages that install a stealth loader named GHOSTPULSE, which decrypts and injects its final payload to evade detection. The chain includes PowerShell-based stage delivery, GPG decryption, DLL …
Security Joes Incident Response identified a new Linux wiper sample linked to Hamas-affiliated hacktivists, named BiBi-Linux Wiper, observed targeting Israeli companies. The malware destroys data by overwriting files, renaming them with a BiBi-containing exten…
In this report Kaspersky shares insights into the validation components used in Operation Triangulation, TriangleDB implant post-compromise activity, as well as details of some additional modules.
Manually decoding a Cobalt Strike .vbs Loader utilising advanced CyberChef and Shellcode Emulation.
An extensive NetSupport RAT intrusion in January 2023 shows attackers using phishing to deliver a malicious JavaScript loader, which then deployed a PowerShell payload to install NetSupport and establish persistence. The operation progressed to domain compromi…
Decoding a .hta script with CyberChef and analysing Shellcode with the SpeakEasy Emulator.
Netskope analyzed a malicious Word document delivering a backdoor named Menorah attributed to APT34, distributed via spear-phishing and obfuscated VBA. The payload drops a .NET executable, persists via a scheduled task, and communicates with a C2 server over H…