OpcJacker is a modular malware discovered in late 2022 that uses a custom VM-like configuration to conceal its logic and load additional payloads. It combines credential theft, clipboard hijacking for cryptocurrency, keylogging, screen capture, and remote-load…
ASEC reports a CHM-based APT technique where threat actors use Compiled HTML Help Files to execute malware via hh.exe, download a PowerShell script, and run it through mshta.exe. The operation culminates in persistence via the Run registry key and C2 communica…
LummaC2 is a new Infostealer sold on the dark web and spread by a threat group disguising it as illegal cracks and keygens. The campaign uses obfuscation, anti-sandbox checks, and C2 communications to exfiltrate data from targeted browsers and wallet apps. #Lu…
IcedID was delivered via malspam as an ISO image, which after mounting loaded a hidden LNK that ultimately dropped IcedID and a batch to disk, enabling domain-wide ransomware. The attackers used IcedID as a loader for Cobalt Strike, conducted extensive discove…
ASEC analyzes phishing email threats from March 5–11, 2023, focusing on attachments and FakePage credential-theft campaigns, with a breakdown of threat types, file extensions, and distribution cases. The post also lists attacker C2 URLs, notable keywords to be…
AsyncRAT is explored through a widely used OneNote spearphishing campaign that delivers an HTA downloader to load a PowerShell-based loader and decrypts/loads AsyncRAT payloads. The post also details AsyncRAT’s capabilities, persistence, defense evasion, scrip…
The Royal Ransomware encrypts files across all volumes, including network shares, using .Royal, .Royal_w, or .royal_u extensions and a tor-based README.TXT for attacker contact. It combines AES with a RSA public key embedded in the executable, deletes shadow c…
Securonix Threat Research documented the STARK#VORTEX campaign that uses Ukrainian-themed .chm (Microsoft Help) lure files to execute obfuscated JavaScript and PowerShell which download and deploy MerlinAgent payloads. The chain establishes persistence via a r…
ASEC analyzes weekly malware statistics from March 13–19, 2023, led by Infostealer at 43.8% and Backdoor at 34.5%, with RedLine and AgentTesla among the top detections. RedLine and AgentTesla dominated the top tiers with widespread C&C activity, credential the…
TACTICAL#OCTOPUS targets US entities with tax-themed phishing, delivering GuLoader/CloudEyE to drop additional payloads. The campaign uses heavily obfuscated VBScript and PowerShell, process hollowing, and multiple C2 channels (notably rebrand.ly) to evade det…
FortiGuard Labs tracked bursts of attacks in January and March exploiting Realtek CVE-2021-35394 and Cacti CVE-2022-46169, spreading ShellBot and Moobot malware. Moobot (a Mirai variant) can be controlled via a C2 server to conduct further attacks such as DDoS…
Proofpoint traces TA473, also known as Winter Vivern, exploiting a Zimbra vulnerability to access publicly facing webmail portals and target European government-related email accounts, with bespoke JavaScript payloads crafted for each portal. The researchers u…
ChinaZ DDoSBot has been found installed on poorly managed Linux SSH servers, turning compromised hosts into bots capable of performing DDoS attacks. The article details Linux and Windows variants, their C2 communications, persistence mechanisms, and defender g…
ShellBot is being distributed to poorly managed Linux SSH servers, leveraging SSH credential brute-forcing and IRC-based C2 channels to control infected hosts. The report details three ShellBot variants (LiGhT’s Modded perlbot v2, DDoS PBot v2.0, and PowerBots…
SentinelOne details a multi-stage supply-chain campaign that trojanizes the 3CXDesktopApp, loading shellcode and pulling ICO data from GitHub to deliver a 3rd-stage infostealer DLL. The operation also extends to macOS with separate stages (libffmpeg.dylib and …