ASEC’s weekly malware statistics for March 27–April 2, 2023 show backdoors dominate at 54.9%, followed by downloaders (22.9%) and infostealers (20.6%), with ransomware and coin miners making up smaller shares. The top families were RedLine, Amadey, AgentTesla,…
Money Message is a newly found ransomware family that can encrypt network shares on Windows and Linux, using admin credentials embedded in its config to access network resources. It employs double extortion by exfiltrating data before encryption and publishing…
Symantec tracks a new loader called Verblecon (Trojan.Verblecon) used in low-reward attacks to install cryptocurrency miners and potentially steal Discord access tokens, with greater danger if leveraged in ransomware or espionage. First spotted in January 2022…
Sysdig’s Threat Research Team (TRT) uncovered proxyjacking, where attackers leverage the Log4j vulnerability to gain access to a container and then turn compromised pods into proxy servers to monetize IP addresses via proxyware services such as Pawns.app, IPRo…
Two sentences summarizing the article: Check Point researchers identified a new ransomware strain named Rorschach that was deployed against a US-based company, notable for its lack of branding and autonomous capabilities. The malware combines novel evasion, ul…
Typhon Reborn V2 is a rebuilt information stealer with significantly enhanced anti-analysis, anti-VM, and obfuscation capabilities, designed to evade security researchers and detections. It exfiltrates collected data via Telegram and is sold cheaply on undergr…
Mandiant analyzes CVE-2021-44228 (Log4Shell) exploitation against MobileIron Core, detailing four adversaries and their post-exploitation actions. It catalogs IOCs, maps observed behaviors to MITRE techniques, and outlines defensive guidance and validation ste…
Volexity analyzed a supply-chain compromise of the 3CX Desktop App in which a malicious ffmpeg library inserted into signed installers decoded encrypted blobs, fetched staged payloads, and reflectively loaded a 64-bit information-stealer dubbed ICONIC/ICONICST…
A sophisticated new toolset is being used to harvest credentials from multiple cloud service providers, including AWS SES and Microsoft Office 365.
Cyble detailed Cl0p Ransomware’s global activity, highlighting its shift to a Ransomware-as-a-Service model, double extortion, and multi-vector infection techniques across industries and regions. It also notes Linux variants and a public leak site, with techni…
Rhadamanthys is a feature-rich infostealer that debuted on the dark web and has drawn attention for its expansive, “everything on a bagel” design. The Check Point Research analysis covers its multi-stage loader, forensic methods to resolve in-memory API calls,…
Fortinet FortiGuard Labs’ bi-weekly Ransomware Roundup highlights Dark Power and PayME100USD, outlining their file-encrypting behavior on Windows and the actor’s apparent data-leak threats, with Fortinet-provided protections and best practices. The report note…
The Mantis threat group (Arid Viper/Desert Falcon) continues targeting Palestinian organizations with a refreshed toolset and a persistent presence across networks. The campaign centers on updated Micropsia and Arid Gopher backdoors, credential theft, and data…
FusionCore is a European threat actor group that operates Malware-as-a-Service and hacker-for-hire operations, offering a wide catalog of custom malware and a ransomware affiliate program. They leverage phishing as their main initial-access vector, run a websh…
ASEC researchers detected Nevada ransomware distribution, noting its Rust-based implementation and the use of the .NEVADA extension for encrypted files. The malware supports command-line options to tailor encryption, creates README.txt ransom notes with a Tor …