Legion, a cloud-focused credential-harvesting tool, has a new update adding SSH credential abuse and expanded cloud-service targeting, including .env credential extraction from misconfigured Laravel apps. The update broadens environment-file discovery, adds “K…
DUCKTAIL is a .NET-based infostealer from Vietnam that targets Social Media Business/Ads accounts to harvest cookies and hijack sessions for ad fraud. It concentrates on HR and Marketing professionals, uses social engineering and ZIP-delivery via file-sharing …
Cyble Research and Intelligence Labs (CRIL) uncovered Invicta Stealer, promoted via social platforms with a free builder on GitHub to amplify reach. The malware targets browsers, wallets, gaming apps, and password managers, exfiltrating data through a Discord-…
Mandiant identified COSMICENERGY, a novel OT/ICS-oriented malware designed to disrupt electric power by interacting with IEC 60870-5-104 devices (RTUs) used in power transmission and distribution. The malware appears tied to red-team activities linked to Roste…
Volt Typhoon is a China-based state-sponsored actor targeting US critical infrastructure with stealthy post‑compromise credential access and network discovery. The campaign relies on living-off-the-land techniques and traffic proxying through compromised devic…
Phishing campaigns leveraged compromised Microsoft 365 accounts and .rpmsg encrypted emails to deliver deceptive messages. Victims are guided through a sequence of hosted pages (Adobe and Microsoft services) before entering credentials on a fake Microsoft 365 …
<p>They act like they don’t see🙈 our ransom note🗒 , or they just don’t negotiate🤝with cyberterrorists💣. They restore their backups and think ignoring us🙉 makes us go away. So now we also restore their backups, for all of you.</p> <p>Harita Group is dedicated to mining, logging rainforests🐒😭 to plant palm oil monocultures, coal, and anything else that’ll make them a profit through destroying their countries’ environment. Their Swiss🇨🇭🇭 partner Glencore is well documented for it’s human rights and environmental abuses in Latin America, including hiring paramilitary killers to drive indigenous off their lands so they can steal it. We think it’s likely they operate the same in Indonesia and journalists will like to look through their emails
Two security researchers analyze Agrius’ use of Moneybird, a targeted ransomware variant, against Israeli organizations and reveal its sophisticated yet narrowly-focused approach. The findings show Moneybird is a new tool in Agrius’ arsenal, with bespoke encry…
ASEC documents renewed campaigns distributing SparkRAT through a VPN installer, aided by GoLang-based droppers and MeshAgent to enable remote control via MeshCentral. The operation mirrors past activity but shifts to GoLang malware while expanding remote-deskt…
The article highlights a rising wave of double-extortion ransomware campaigns, with new strains and groups expanding to protect and monetize stolen data. It discusses Rhysida, 8Base, MalasLocker and others, their techniques, victims, and recommended defenses. …
CRIL uncovered MDBotnet, a Russian-linked malware strain designed to carry out DDoS attacks using HTTP/SYN flood techniques. The malware uses a multi-stage update and persistence mechanism, downloading updater and bot components from a C2 and then executing co…
With operations spread throughout the mineral-rich Indonesian archipelago, ANTAM undertakes all activities from exploration, excavation, processing through to marketing of nickel ore, ferronickel, gold, silver, bauxite and coal.
Lazarus Group is confirmed targeting Windows IIS web servers, using DLL side-loading to deploy in-memory malware through Wordconv.exe and a malicious msvcr100.dll. The operation decrypts data with Salsa20, attempts credential theft, and moves laterally via RDP…
DarkCloud is distributed through spam emails with a dropper that also deploys ClipBanker, enabling credential theft and clipboard-based wallet address replacement. The malware family uses persistent startup via Run keys and exfiltrates data via SMTP or Telegra…
A Data-Driven Approach based on Analysis of Network Telemetry This blog post seeks to draw out some high-level trends and anomalies based…