Magniber continues to spread at high volumes by masquerading as Windows security updates and injecting into running processes to encrypt files. It then establishes persistence via the Task Scheduler and deletes volume shadow copies to hinder recovery, while le…
DroxiDat is a compact variant of the SystemBC backdoor used with Cobalt Strike beacons against a southern African electric utility, illustrating how MaaS-style toolsets enable stealthy reconnaissance and potential ransomware deployment. The report links this a…
United Tractors United Tractors is a heavy equipment distribution company headquartered in Jakarta, Indonesia.
Cyble Research and Intelligence Labs details a multi-stage AgentTesla infection chain delivered via a malicious CPL file embedded in a tax-themed spam email, which triggers PowerShell scripts and a .NET loader to inject AgentTesla. The campaign uses obfuscated…
ASEC reports the distribution of malware disguised as coin exchange and investment content, delivered as self-extracting executables and Word documents. The operation is attributed to the Kimsuky group, and it uses macros, scripting, and URL-based commands to …
ReversingLabs discovered a campaign of malicious PyPI packages (including VMConnect) that embed Base64‑encoded payloads in release artifacts to spawn processes, decode and execute secondary commands from a C2 server. The actors also published benign-looking Gi…
Authored by: Lakshya Mathur and Yashvi Shah As the Back-to-School season approaches, scammers are taking advantage of the opportunity to…
The post The Season of Back to School Scams appeared first on McAfee Blog….
Guardio Labs discovered an active campaign that abused a flaw in Salesforce’s Email-to-Case and Organization‑Wide Email flows to verify and send phishing messages from @salesforce.com addresses, directing victims to phishing pages hosted on Facebook’s apps pla…
Cisco Talos tracks an ongoing ransomware operation tied to a likely Vietnamese actor, using a customized Yashma variant that mimics WannaCry across multiple regions. The group downloads ransom notes from an actor-controlled GitHub repo via an embedded batch fi…
Big Head Ransomware is a nascent ransomware family first seen in May 2023, consisting of multiple variants and an elusive actor behind it. It uses deceptive methods such as fake Windows updates and malvertising, communicates with victims via Gmail and Telegram…
Insikt Group tracks BlueCharlie, a Russia-nexus threat group that’s evolving operations, with 94 new domains since March 2023.
FortiGuard Labs’ bi-weekly Ransomware Roundup covers the DoDo and Proton variants, detailing their infection vectors, encryption behavior, and observed indicators, along with Fortinet protections and recommended defenses. The report highlights DoDo as a Chaos …
Cleafy Labs reports that SpyNote spyware has been repurposed to perform aggressive banking fraud campaigns across Europe by abusing Android Accessibility services, media projection APIs, and built-in remote access workflows. The malware collects keystrokes, SM…
Metabase Q uncovered a LATAM-focused botnet named Fenix that targets taxpayers in Mexico and Chile through fake tax portals to steal credentials. The operation features a multi-stage infection chain, including phishing websites, a JS/JSE downloader, PowerShell…
Rhysida Ransomware Group emerged in May 2023 as a RaaS operation, targeting sectors such as education and manufacturing with double-extortion and public data leakage. The attackers use phishing and Cobalt Strike, encrypt data with RSA-4096 and ChaCha20, and ma…