Malware researchers analyzed how Discord is being abused to download payloads and exfiltrate data, including a Ukrainian-targeted sample that points to emerging APT-like activity. The attack chain leverages Discord’s CDN to fetch a next-stage payload and Disco…
Anomali’s Cyber Watch roundup covers multiple campaigns including ROMCOM 4.0 (PEAPOD) backdoors targeting defense and government sectors, a typosquatted RedAlert Android infostealer, EtherHiding via blockchain hosting, the NoEscape ransomware, and ShellBot DDo…
Threat hunting today blends structured methodologies, real-time data analysis, and adaptive automation to uncover anomalies, threats, and attacker activity across logs, networks, and endpoints. The article showcases traditional approaches, a modern futuristic …
QuasarRAT employs a novel dual DLL sideloading technique using two trusted Microsoft processes, ctfmon.exe and calc.exe, to stealthily deploy payloads and evade detection. The analysis covers the two-phase execution flow, resource encryption/decryption, memory…
Akira Stealer is a Python-based information stealer offered as Malware-as-a-Service (MaaS) via a dedicated portal at Akira.red, with Telegram used for updates and command-and-control. It harvests credentials, financial data, and system information, exfiltratin…
Cyble Research and Intelligence Labs uncovered a phishing-driven VPN malware campaign that delivers BbyStealer via VPN installer downloads. The campaign impersonates VPN services, drops BbyStealer to steal browser and crypto wallet data, and even performs a cl…
Two North Korean threat actors, Diamond Sleet and Onyx Sleet, were observed exploiting CVE-2023-42793 in JetBrains TeamCity servers to gain access and persist in victim environments. They used two distinct attack paths—ForestTiger backdoor deployment and DLL s…
Crambus (OilRig/APT34) conducted an eight-month intrusion against a Middle Eastern government in early 2023, stealing files, passwords, and emails while deploying backdoors and credential dumping tools. The operation relied on PowerShell backdoors (PowerExchan…
Vietnamese threat actor clusters are using Malware as a Service infostealers and RATs (DarkGate, Ducktail, Lobshot, Redline stealer) to hit the digital marketing sector, with a strong focus on Facebook Business accounts. The campaigns show heavy overlap in lur…
Threat actors leveraged malvertising and a Punycode-based domain to impersonate KeePass, directing users to a lookalike site. The campaign delivers a malicious MSIX installer signed to look legitimate, which runs PowerShell code linked to the FakeBat family an…
BlackCat operators introduced a new tool called Munchkin that uses a customized Alpine VM to deploy and propagate the BlackCat payload across remote machines and SMB shares. Unit 42 explains how Munchkin runs inside a VirtualBox VM, decrypts strings at runtime…
This write-up details MedusaLocker’s technical behavior, including privilege escalation via a UAC bypass, persistence through %AppData% duplication and registry entries, termination of backup/DB services, shadow-copy removal, and AES+RSA file encryption. It al…
Researchers analyze the cyber dimension of the Israel-Hamas conflict, highlighting hacktivist groups Cyber Av3ngers and Moses Staff and their impact on critical infrastructure. The analysis links the October 8 Dorad power station incident to Moses Staff leaks …
Qubitstrike is a sophisticated cryptojacking campaign targeting exposed Jupyter Notebooks, leveraging Codeberg for payload hosting and Discord for C2, with cloud credentials targeted for later exploitation. The operators deploy XMRig, Diamorphine rootkit, and …
Threat actors targeted obsolete ColdFusion 11 servers to gain access and pivot to deploying ransomware, using leaked LockBit 3.0 code, but Sophos blocked all attempts on a customer network. The activity ties to a threat actor calling itself BlackDogs 2023, who…