Malware configurations reveal attacker campaigns and behaviors by exposing in-memory configuration data, as demonstrated with IcedID’s encrypted stage-one and stage-two configurations decoded through dynamic analysis. The article also outlines how to scale con…
Two sentences summarizing the content here. EclecticIQ links a spearphishing campaign against Poland’s healthcare sector to Vidar Infostealer, with overlaps to Djvu and LockBit 2.0 ransomware activity, and describes how Vidar collects sensitive data and exfilt…
Raspberry Robin is a global USB-based malware campaign that acts as a loader, delivering ransomware operators and other loaders to target networks. It propagates via infected USB drives, uses legitimate Windows binaries to execute payloads, and relies on compr…
Atomic Stealer is a macOS infostealer sold via Telegram with multiple variants (A, B, C) and a web panel for campaign management. The article details how each variant operates, what data it targets (keychains, crypto wallets, browser data), and provides indica…
SentinelLabs reports ongoing Kimsuky operations using a new ReconShark component, delivered via targeted spear-phishing, OneDrive-hosted documents, and malicious macros. ReconShark functions as a reconnaissance tool that exfiltrates system and defense-detectio…
BlackBit is a LokiLocker ransomware variant that operates under a RaaS model and shows signs of being in early development with targeted persistence and evasion capabilities. The strain deploys multiple defense-evasion techniques, persistence mechanisms, and u…
A large-scale “Malverposting” campaign abusing Facebook Ads has pushed adult-themed promoted posts that lead to ZIP downloads containing masqueraded executables; the operation is linked to a Vietnamese threat actor and is estimated to have surpassed 500k infec…
Unit 42 analyzed over 67 million malicious URLs, domains, and IPs observed in H2 2022, highlighting trends in phishing, malicious JavaScript, and web skimmers, including a case study on a Tranco top 1 million site. The report notes concentration of hosting in …
The article analyzes BlackByte, a Russian-based ransomware operation operating as a RaaS that uses double-extortion and has evolved its techniques since 2021, including a shift from C# to GoLang and the use of legitimate tools. It also highlights notable incid…
Checkpoint Research tracks how ROKRAT’s deployment has evolved into LNK-based, multi-stage infection chains that bypass macro restrictions, showing a shift from documents with macros to oversized LNK loaders. The campaigns target South Korean affairs, link to …
Earth Longzhi, a subgroup of APT41, has resurfaced with new techniques targeting Taiwan, Thailand, the Philippines, and Fiji, including DLL sideloading and BYOVD driver abuse to disable defenses. The campaign also introduces stack rumbling via IFEO, RPC-based …
CRIL researchers describe AresLoader, a multiclass loader used to spread LummaStealer and IcedID via a disguised GitLab repo, targeting Citrix users. The malware uses multi-stage delivery, dynamic API resolution, and various anti-analysis techniques to evade d…
ASEC reports ongoing campaigns where XMRig CoinMiner is installed on poorly managed Linux SSH servers, using SHC-built malware and creating backdoor SSH accounts for persistence. The attacks, attributed to the KONO DIO DA threat actor, involve dictionary/dicti…
The ASEC weekly malware statistics summarize the top families by distribution from November 21–27, 2022, led by AgentTesla and SmokeLoader. The post also details their command-and-control infrastructure and common disguise techniques such as invoices and purch…
Rapture is a ransomware family observed in March–April 2023 that is packed with Themida and shows similarities to Paradise yet behaves distinctly. The attackers leverage memory-based execution via a Cobalt Strike beacon, staged through PowerShell and WMI, to d…