Microsoft researchers uncovered a campaign targeting internet-facing Linux-based systems and IoT devices that uses a patched OpenSSH to take control of devices and deploy cryptomining malware, backdoors, and rootkits. The operation leverages a hijacked OpenSSH…
RedEyes (APT37/ScarCruft/Reaper) targeted individuals such as defectors and activists, using a CHM-based initial access chain and a GoLang backdoor that leverages the Ably real-time messaging platform for command-and-control, along with a wiretapping-infosteal…
Unit 42 outlines a Mirai variant campaign targeting IoT devices since March 2023, exploiting a wide set of IoT vulnerabilities to recruit devices into a botnet used for DDoS and other attacks. The campaigns share infrastructure and malware characteristics, wit…
Kopeechka.store offers to rent established email addresses to expedite large-scale account signups for criminal campaigns, dramatically cutting costs for spammers. Researchers link the service to Mastodon spam campaigns by quotpw, crypto scam networks like Imp…
FortiGuard Labs analyzed Condi, a DDoS-as-a-service botnet that spreads by exploiting CVE-2023-1389 on TP-Link Archer AX21 routers and has been expanding since May 2023. The post details Condi’s propagation, C2 protocol, attack methods, and the threat actor’s …
ASEC tracked the Kimsuky group’s use of CHM files for malware distribution in May, applying a variety of subject topics to deceive targets. The CHM payload executes malicious scripts via a shortcut object, downloads additional components, and exfiltrates user …
MULTI#STORM is a phishing-driven campaign that deploys a Python-based loader to drop multiple RAT payloads over OneDrive links, culminating in Warzone RAT and Quasar RAT infections. The operation uses obfuscated JavaScript, PowerShell payloads, and UAC-bypass …
Mallox ransomware is distributed to poorly managed MS-SQL servers using BAT files, a fileless tactic that leverages PowerShell and CMD to download and execute payloads like Mallox and Remcos RAT. It injects via process hollowing into MSBuild.exe, terminates pr…
The Flea (APT15) group deployed a new backdoor called Graphican to target foreign ministries in the Americas during late 2022 to early 2023, expanding its toolkit for intelligence-gathering campaigns. Graphican uses Microsoft Graph API and OneDrive for its C2 …
During routine detection maintenance, our Mac researchers stumbled upon a small
set of files with backdoor capabilities that seem to form part of a more complex
malware toolkit. The following analysis is incomplete, as we are trying to
identify the puzzle pieces that are still missing.
As of now, these samples are still largely undetected and very little
information is available about any of them. The earliest mention we could find
is an anonymous April 18 upload on VirusTotal (IoC A), as well
The article details how SeroXen uses the latest BatCloak batch-obfuscation engine and a modified Quasar RAT builder to produce fully undetectable (.bat) loaders that decrypt and reflectively load a .NET payload via obfuscated PowerShell. It explains the multil…
eSentire’s Threat Response Unit tracks a Russian-speaking threat group behind a campaign named Resident, targeting manufacturing, commercial, and healthcare sectors with backdoors, Cobalt Strike loaders, and the Rhadamanthys stealer. The operation spreads via …
Check Point Research identified ongoing phishing campaigns that abuse legitimate form services to harvest credentials and exfiltrate data, helping attackers evade detection. The attackers rely on HTML attachments masquerading as login pages and employ services…
Vidar threat actors continue evolving their backend infrastructure, rotating IPs and increasingly anonymizing management activity with VPNs and Tor, while centralizing control on my-odin.com for affiliates. The update traces ongoing infrastructure changes thro…
ASEC tracked phishing email threats focusing on attachments used to deliver malware via downloaders, infostealers, and fake login pages during the week of June 4–10, 2023. The report details attack types, distribution methods, notable cases, and practical user…