Malvertising is used to carry out phishing by impersonating brands in search ads, targeting USPS package trackers. The campaign collects addresses, credit card details, and banking credentials through a dynamic phishing site. #USPS #JPMorganChase #Google #Clou…
ARCrypter ransomware, also known as ARCrypt, has evolved since 2022 to target Windows and Linux and now uses a Go-based Linux variant. Threat actors rely on victim-specific Tor mirror sites and TOX messaging, while favoring Monero for payments to preserve anon…
Lab52 detects a maldoc-based campaign targeting Chinese-speaking users, delivered via Chinese phishing and designed around a resume decoy. While the infection chain shares some traits with APT29, it features significant differences (Chinese-language decoy, pro…
Trend Micro investigated a malvertising campaign that lured users to a cloned WinSCP download page which delivered an ISO that deployed a trojanized Python environment and Cobalt Strike beacons, enabling AD discovery, credential theft, persistence, and lateral…
ReversingLabs’ researchers uncovered more than a dozen malicious npm packages used to power a dual-use campaign that blends phishing against Microsoft 365 users with software supply chain manipulation. Dubbed Operation Brainleeches, the campaign features two d…
TA453 (Charming Kitten) expands its espionage toolkit with new file types and cross‑platform Mac malware, deploying LNK infection chains and a PowerShell backdoor named GorjolEcho. Proofpoint and partners disrupted the operation, but TA453 continues targeting …
CRIL (Cyble Research and Intelligence Labs) reports the emergence of Underground Team Ransomware, a new strain that tailors ransom notes to victims and offers additional services such as vulnerability insights and data recovery guidance. The article details it…
ReliaQuest’s Threat Hunting Team traced a May 2023 incident to Gootloader, a JavaScript-based initial-access malware that can seed second-stage remote access tools and enable ransomware deployments. The assessment details Gootloader’s infection chain, the Syst…
Cloud‑native attackers are building a worm‑like campaign targeting exposed JupyterLab and Docker APIs, deploying Tsunami malware, cryptomining, and a backdoor while concealing infrastructure with proxies and DNS‑over‑HTTPS. Researchers attribute the activity t…
Neo_Net runs a global eCrime campaign targeting thousands of bank clients, focusing on Spanish and Chilean banks, from June 2021 to April 2023. The operation includes Ankarex Smishing-as-a-Service, phishing panels, and Android trojans to exfiltrate data via Te…
Check Point Research tracks a Chinese threat actor targeting European government ministries and embassies, using HTML Smuggling to deploy a PlugX variant across Eastern Europe. The SmugX operation overlaps with RedDelta and Mustang Panda, employs two infection…
Volexity analyzed a new POWERSTAR backdoor variant used by Charming Kitten that loads most of its functionality in memory and retrieves decryption and configuration components from remote cloud and IPFS-hosted files. The malware uses staged PowerShell loaders,…
Clipper malware variants Atlas Clipper, Keyzetsu Clipper, and KWN Clipper target cryptocurrency users by hijacking clipboard wallet addresses to divert transactions to attacker wallets. The variants use Telegram-based C2, mutex-based persistence, and several a…
Researchers describe the DDoSia project, a DDoS toolkit used by the NoName057(16) hacktivist group against countries critical of Russia, detailing how targets are chosen, decrypted, and attacked. The analysis covers Telegram-based distribution, an AES-GCM encr…
Avast researchers developed and released a decryptor for the Akira ransomware and outline how Akira encrypts files, generates keys, and drops ransom notes. The article also notes similarities to Conti and explains how to use the Avast decryptor on Windows (and…