Cyble CRIL uncovered a new Higaisa APT operation that uses a phishing site impersonating legitimate VPN software to deliver a Rust-based payload. The malware features anti-debugging, shellcode decryption, and encrypted C2 communication, with connections to add…
Insikt Group identified an application disseminated on a Telegram Channel used by members or supporters of the Hamas terrorist organization
ExelaStealer is a new Python-based infostealer distributed as both an open-source project and a paid, customizable build that targets Windows to harvest browser credentials, cookies, clipboard contents, screenshots, and keystrokes. FortiGuard Labs’ analysis sh…
Decoding a .hta script with CyberChef and analysing Shellcode with the SpeakEasy Emulator.
Two campaigns targeted at Hong Kong residents used malvertising to push fake WhatsApp Web and Telegram pages, tricking victims into scanning QR codes or downloading malware. The operators aimed to steal data, impersonate accounts, and compromise devices, with …
Cybercriminals attack government, law enforcement, non-profit organizations, agricultural and commercial companies by slipping a cryptominer, keylogger, and backdoor into their systems.
The article examines how steganography is being revived in recent malware campaigns to hide payloads inside benign files like images, and demonstrates a hands-on analysis using ANY.RUN and CyberChef to extract and inspect hidden code. It covers phishing-based …
XWorm is a modular .NET RAT analyzed in-depth, detailing a multi-stage unpacking and deobfuscation process that culminates in a runnable payload. The write-up walks through the analysis from initial malspam delivery to the final unpacked sample, including conf…
Cactus ransomware, discovered in March 2023, uses a mutex to ensure a single active copy and persistence via a scheduled task named “Updates Check Task.” It encrypts files with AES (OpenSSL), stores the public RSA key encrypted inside the binary, and renames e…
A Russian-targeted phishing campaign delivered a NSIS-based loader that installs backdoors and data-stealing components, with Go-written UsrRunVGA.exe as the main backdoor. The operation operated in two waves, using anti-virtualization checks, encrypted data e…
Cisco Talos assesses that YoroTrooper is a Kazakhstan-origin, espionage-focused threat actor active since June 2022, with language and currency cues pointing to Kazakhstan and a focus on CIS government targets. The group disguises its operations as Azerbaijan,…
In early September 2022, we discovered several new malware samples belonging to the MATA cluster. The campaign had been launched in mid-August 2022 and targeted over a dozen corporations in Eastern Europe from the oil and gas sector and defense industry.
Rusty Droid is an Android RAT that masquerades as Chrome (package com.catajuhufepusuwo.xenonome), requests Accessibility service, then decrypts and loads a DEX payload to steal credentials, SMS, and other sensitive data while contacting a hardcoded C2. The mal…
Threat actors are distributing the information-stealer Lumma Stealer via Discord by hosting malicious installers on Discord’s CDN and luring victims with direct-message social engineering. The malware executes a downloaded binary that contacts the C2 domain ga…
Cyble reports a threat actor targeting Italian-speaking users with a Tor Browser phishing site delivering a fileless Pure Clipper campaign. The operation uses a .NET dropper obfuscated with SmartAssembly, loads loader/crypto payloads, stores data in the regist…