Three crimeware families—DarkGate, LokiBot, and Emotet—are described with their infection chains and capabilities, including a four-stage DarkGate loader, a LokiBot phishing campaign, and an Emotet resurgence via OneNote attachments. The report highlights memo…
An e-mail-based malspam campaign delivered a small LNK dropper that pretends to be a Purchase Order PDF. The LNK ultimately downloads a PDF lure, a BAT file, and two obfuscated .NET binaries that are loaded reflectively in memory, with low VirusTotal detection…
Remcos is a remotely accessible trojan for Windows that has been actively developed and sold since 2016, enabling attackers to build botnets and steal data. The article outlines its distribution via phishing emails with macros, frequent updates from the vendor…
Introduction In this blog post, we will provide an update on our continued analysis and tracking of infrastructure associated with…
CISA analyzed seven samples of a novel Barracuda Email Security Gateway backdoor named SUBMARINE that persists in the appliance SQL database and preloads a shared object into the BSMTP daemon to execute commands with root privileges. The intrusion uses a malic…
CISA analyzed two SEASPY ELF samples that target vulnerable Barracuda Email Security Gateway appliances (CVE-2023-2868) and persist as a fake “BarracudaMailService”. The backdoor uses libpcap to sniff SMTP traffic for a magic string and, on match, opens a TCP …
CISA analyzed 14 samples of Barracuda exploit payloads that leverage CVE-2023-2868 to perform command injection and install Base64-encoded reverse shells on affected Barracuda Email Security Gateway appliances. The reverse shells create OpenSSL-based encrypted…
Trend Micro discovered two related Android malware families—CherryBlos and FakeTrade—used in cryptocurrency-mining and financial scam campaigns that distribute malicious APKs via fake social posts and phishing websites. CherryBlos abuses Android Accessibility …
AhnLab ASEC highlights a campaign where malware installers masquerade as legitimate Korean VPN and software download files, distributing Sliver C2 and MeshAgent through a dedicated program developer’s ecosystem. The operators use Go-based malware, anti-sandbox…
Reptile is an open-source Linux kernel rootkit that conceals files, processes, and network traffic, and adds a reverse shell with a port-knocking trigger for C&C communication. It has been observed in Korea-targeted attacks and shows similarities to Syslogk an…
Trustwave SpiderLabs details a new version of the Rilide Stealer for Chromium-based browsers that adapts to Chrome Manifest V3, featuring modular code and data exfiltration to Telegram as well as interval-based screenshots. The report covers multiple campaigns…
RedLine Stealer is an information-stealing malware that harvests credentials and other sensitive data from browsers and apps, and it can deliver other malicious programs like ransomware, RATs, trojans, and miners. It leverages social engineering to spread via …
Doctor Web uncovered a Windows-focused campaign using Trojan.Fruity.1, a modular downloader that can deploy Remcos RAT or other malware. The attack employs fake installers, multi-stage infection, steganography, and anti-detection tricks to increase success. #T…
Proofpoint identifies WikiLoader, a sophisticated downloader used in multiple Italian-focused campaigns, notable for its evasion techniques and modular, multi-stage chain that culminates in Ursnif delivery. The malware is thought to be rentable to multiple cyb…
Ransomware is increasingly delivered via URLs as threat actors rotate hostnames, paths, and filenames to evade defenses. The report covers how attackers abuse hosting providers and public services, with case studies involving STOP/DJVU, Raccoon Stealer, and Sm…