Researchers documented the first evidence of attackers abusing Kubernetes RBAC to backdoor clusters, using DaemonSets to hijack resources and mining Monero across numerous targets. The activity highlights how misconfigurations can enable persistence and widesp…
RTM Locker marks the RTM group’s first Linux ransomware binary, targeting Linux, NAS, and ESXi hosts, and appears inspired by Babuk’s leaked source code, using ECDH Curve25519 and ChaCha20 for file encryption. Uptycs provides detection guidance with XDR and YA…
TrafficStealer uses Docker containers to generate revenue by proxying users’ traffic and manipulating ad engagement, turning honeypots into monetization machines. Attackers leverage public container images and automation via YAML to scale the operation, while …
JPCERT/CC documented an attack around February 2023 that targeted a crypto asset exchanger with Parallax RAT delivered via spam emails directing victims to a Google Drive link. The operation used OneNote files with embedded VBS, a PowerShell payload, Windows s…
Gh0st RAT is a decades-old open-source remote administration tool that still shows up in phishing campaigns, including against a European medical technology organization, highlighting its enduring availability and adaptability. While once tied to nation-state …
Tomiris is a Russian-speaking threat actor whose operations target CIS government and diplomatic entities, deploying a wide range of burners, backdoors, and file stealers across multiple campaigns and languages. The analysis links Tomiris to Turla toolsets lik…
A malicious PyPI package named termcolour reappeared in March as a three-stage downloader, illustrating how repurposing an abandoned package name can seed a supply-chain attack. The incident shows how PyPI’s name-reuse policy and lack of visibility into who re…
Educated Manticore is an Iran-aligned threat cluster that has evolved its toolset to deploy a newer PowerLess variant via ISO-based lures targeting Israel. The operation uses a multi-stage infection chain with a mixed-mode .NET loader and in-memory execution t…
Identifying Connected Infrastructure and Management Activities Introduction This blog post seeks to build on recent public reporting on…
OCX#HARVESTER is a threat campaign by Securonix Threat Labs leveraging the More_eggs malware suite to target financial-sector victims, with activity observed from late 2022 through early 2023 and new C2 infrastructure shifts. The campaign uses image-based LNK …
Cyble researchers report Qakbot’s evolving delivery using OneNote attachments that drop CHM files, which load a PowerShell script to download and execute a DLL via rundll32. This method—along with embedded ISO content and hardcoded URLs—helps Qakbot evade dete…
Symantec’s Threat Hunter Team links a broader X_Trader software supply chain attack to multiple victims, including two critical infrastructure organizations in the energy sector in the U.S. and Europe, plus two other financial trading firms. The operation uses…
EvilExtractor is a Windows-focused info stealer with modular components that exfiltrate browser data, credentials, and system information to an attacker’s FTP server, and it includes a Kodex ransomware capability. FortiGuard Labs links its phishing delivery, P…
Unit 42 researchers document a surge in ChatGPT-related scams, including domain squatting and copycat services that abuse OpenAI branding to lure users into malware or data theft. The article presents phishing, malware delivery, crypto and financial scams, and…
Trend Micro details a new ViperSoftX campaign that hides its loader in illicit software packages and uses DLL sideloading, advanced encryption, and anti-analysis techniques to steal cryptocurrency wallets and passwords. The operation targets both consumers and…