Lumen Black Lotus Labs uncovered a multi-year campaign that infected SOHO routers with an ARM-targeted Linux RAT named AVrecon to build a covert residential proxy network used for activities like ad fraud and password spraying. The botnet employed a multi-stag…
Trustwave’s honeypot network across six countries reveals how Mirai, Mozi, and Kinsing botnets targeted enterprise applications to upload web shells and recruit devices into botnets for DDoS or cryptomining. The report details leveraging PoCs and CVEs (GoAnywh…
DomainNetworks runs a snail-mail scam that dresses up as a bill for domain-related services to chill people into paying for non-existent offerings. The investigation traces a web of front entities, domain registrations, and aliases (including Sammy Sam Alon and UBSagency) used to obfuscate the operation. #DomainNetworks #USDomainAuthority #TheDomainsVault #UBSagency #SammySam_Alon #ShmuelOritAlon #EliranBenz #Houzz #WebListingsInc
In the first half of 2023, Mandiant Managed Defense has observed a threefold increase in the number of attacks using infected USB drives to steal secrets. Mandiant tracked all of the cases and found that the majority of the incidents could be attributed to several active USB-based operation campaigns affecting both…
Wordfence Threat Intelligence tracked a targeted exploit campaign against WooCommerce Payments CVE-2023-28121, which allowed unauthenticated attackers to obtain administrative privileges on vulnerable sites. The attackers used a multi-stage workflow including …
Replace Rapid7 tracks a staged Blackmoon/KRBanker campaign that started in late 2022, focusing on evasion and persistence rather than credential theft to drop multiple unwanted programs and linger in victims’ environments in the USA and Canada. The operation u…
Trend Micro analyzes the Big Head ransomware family and its multiple variants, detailing their infection chain, embedded resource decryption, dropped binaries, and operational behaviors. The report highlights use of AES and RSA for encryption, Telegram-based c…
Cloaked Ursa (APT29) expanded its diplomatic-target espionage with novel, individual-focused phishing lures, including a Kyiv BMW-for-sale campaign that targeted embassies. The operation uses dual C2 channels (Microsoft Graph API and Dropbox) and sophisticated…
Fortinet FortiGuard Labs analyzed malicious Microsoft Office documents that exploit CVE-2021-40444 and CVE-2022-30190 to drop LokiBot onto Windows systems. The campaign uses a VBA macro and an injector chain to download payloads, load LokiBot into memory, and …
Talos identifies UNC1151/GhostWriter-led campaigns targeting Ukraine and Poland’s government, military, and civilians to steal information and maintain persistent remote access. The operations span from April 2022 to at least July 2023, with attribution tying …
An actor behind a cloud credentials-stealing campaign expands from AWS to Azure and Google Cloud Platform, introducing modular tooling, Docker-targeting propagation, and data exfiltration to AnonDNS. Research notes similarities to TeamTNT and highlights ongoin…
SCARLETEEL 2.0 expands into AWS Fargate and Kubernetes, refining its cloud-focused toolkit to steal credentials, escalate privileges, and mine cryptocurrency while evading newer security controls. Sysdig Threat Research Team documents a more resilient C2 archi…
Aqua Nautilus analyzes TeamTNT’s reemergence with an aggressive cloud campaign targeting Docker, Kubernetes, Jupyter, and other cloud-native services, deploying a broad arsenal of scripts, backdoors, and malware to rapidly infect exposed systems. The operation…
ThreatFabric documents Letscall, a multi-stage vishing toolkit that blends phishing, spyware, and VOIP manipulation to hijack calls and exfiltrate data from victims in South Korea, with potential expansion to the EU. The campaign uses a downloader, a second-st…
Cyble researchers uncovered a Trojanized TeamViewer installer that drops njRAT, a Remote Access Trojan, onto Windows machines, leveraging trusted software to lure victims. The campaign enables keystroke logging, data collection, and C2 communication while pers…