Sophos X-Ops MDR investigated two Microsoft 365 incidents where attackers used Microsoft Graph to compromise email accounts, manipulate permissions, and monitor activity. The linked activity across cases suggests a single actor or closely related group targeti…
QR codes are being exploited in rapid-fire phishing campaigns to harvest employee credentials, often via image-based emails that impersonate trusted brands. INKY reports hundreds of such QR code phishing emails across multiple industries, using tactics like Mi…
Elastic Security Labs has detected a new variant of the RustBucket malware targeting macOS, with added persistence and signature-reduction tactics in active development. The REF9135 operations attributed to the Lazarus Group (DPRK) show shifting infrastructure…
White Snake Stealer is an evolving information-stealer threat first highlighted in 2023, targeting browsers, crypto wallets, email clients, VPNs, and other applications to steal credentials and sensitive data. The article reviews the updated White Snake Steale…
Trigona is a rapidly evolving ransomware family that began activity in 2022 and has multiple Windows and Linux variants that encrypt files using AES and append the ._locked extension. Operators gain access via ManageEngine CVE-2021-40539, MSSQL brute-force and…
Wordfence warns of a critical, unpatched privilege-escalation vulnerability in the Ultimate Member WordPress plugin (versions up to 2.6.6) that is actively being exploited on sites running the plugin. The advisory provides a firewall rule, remediation guidance…
ASEC reports that the Crysis threat actor is deploying Venus ransomware in attacks, using RDP to access externally exposed systems and then dropping multiple malware strains. The operation leverages NirSoft tools and Mimikatz for credential access, conducts ne…
Deep Instinct researchers uncovered PhonyC2, a custom, continuously evolving C2 framework used by MuddyWater since 2021, including in an attack on the Technion and ongoing PaperCut exploitation. The analysis details the framework’s code, infection flow, persis…
Meduza Stealer is a Windows-targeted data thief designed to exfiltrate browser data, wallet extensions, and other sensitive artifacts while using country exclusions and a server check to stay stealthy. Uptycs analyzes its marketing, distribution, workflow, and…
Morphisec reports an active GuLoader (also known as Cloudeye) campaign targeting U.S. law firms, along with healthcare and investment firms, delivering Remcos RAT and other families via cloud hosting. The infection chain begins with a PIN-protected PDF lure, p…
ASEC reports a new malware variant distributed as an executable disguised with an HWP document extension, likely created by the Kimsuky threat group. The dropper uses a Base64-encoded PowerShell command, saves update.vbs, and downloads additional scripts from …
An analysis of a loader-based infection culminating in Remcos RAT activity, delivered through a phishing email that leads to a password-protected ZIP containing a VBScript and a Windows shortcut. The writeup traces the infection chain—from the email, through t…
ASEC documents a malware execution technique that leverages DNS TXT records — a relatively uncommon method that can aid in command retrieval and evasion. The activity includes phishing with a PPAM PowerPoint add-in, PowerShell-driven nslookup, DNS TXT data sto…
Akira ransomware has extended its reach to Linux with a new 64-bit ELF variant, targeting multiple sectors. It encrypts targeted files using a hardcoded RSA public key, appends a .akira extension, and leaves a hardcoded ransom note on infected systems. #AkiraR…
ASEC (AhnLab) used the RAPIT analysis system to summarize malware activity for June 5–11, 2023, highlighting Infostealer and downloader as the top categories. Leading threats were Amadey, AgentTesla, GuLoader, Lokibot, and Formbook, with distribution largely v…