Web application vulnerabilities are like doorways: you never know who or what will walk through. Between December 2021 and July 2022, the Mandiant Managed Defense and Incident Response teams responded to three UNC961 intrusions at different organizations that each started in similar fashion. Two of these victims were under the protection…
The article analyzes the March 2023 NullMixer malware operation, highlighting how opportunistic attackers used malvertising and cracked software to infect thousands of endpoints across Europe, including Italy and France. It also details a MaaS/PPI ecosystem de…
BitSight analyzes the Tofsee botnet, showing a proxy plugin that routes most traffic via HTTPS to popular sites, including Russian targets. It also details spam delivery via compromised sites and Masari mining activity, with fastpool.xyz as a working pool and …
Researchers uncovered Mélofée, a Linux-targeted implant with a kernel-mode rootkit tied to Winnti and Chinese state-sponsored actors, featuring evolving capabilities such as a SelfForwardServer. The analysis traces multiple samples, their infrastructure, and l…
Guardio Labs found a new FakeGPT Chrome extension variant that forks a legitimate open-source “ChatGPT For Google” project to hide malicious code that steals Facebook session cookies. The extension encrypts those cookies with AES and exfiltrates them via a cus…
Microsoft’s guidance explains how CVE-2023-23397 enables a secret Net-NTLMv2 hash leak via Outlook reminders and outlines Forest Blizzard (STRONTIUM), a Russian state-sponsored group linked to GRU Unit 26165, as an actor exploiting this vulnerability to access…
Intezer traces Bitter APT activity targeting the Chinese nuclear energy sector in an Asia-Pacific espionage campaign, ties it to prior Bitter APT tooling including CHM/Excel payloads and Microsoft Office exploits. The operation uses social engineering with lur…
Cyble Research and Intelligence Labs uncovered a Malware-as-a-Service platform named “Cinoshi” that bundles a stealer, botnet, clipper, and cryptominer, with free stealer and web-panel access. The MaaS includes a web panel for build configuration, botnet task …
Earth Preta orchestrates a long-running cyberespionage operation involving multiple APT subgroups (724, 1358, 5171) with a centralized development unit, targeting a range of sectors and regions and expanding to maritime and government entities. The study highl…
Magecart campaigns are exploiting client-side obfuscation to load skimmers during checkout, using Hunter to conceal JavaScript code and inject malicious forms. The techniques culminate in encoded credit card data stored in a cookie and exfiltrated via POST, al…
The article analyzes the Dark Power ransomware gang, detailing its Nim-based ransomware, encryption techniques (AES-CTR), and anti-forensic tactics such as service and process termination, log clearing, and extensive file/folder exclusions. It also covers the …
MacStealer is a macOS stealer distributed via DMG that is controlled over Telegram, marking a new platform for stealer operations. It exfiltrates browser credentials, Keychain data, and files, sending stolen data via HTTP POST to a C2 and to Telegram channels/…
MacOS threat actors are increasingly focusing on data theft rather than ransom, exfiltrating session cookies, keychains, SSH keys, and other sensitive data to monetize or enable espionage. The article outlines where these data assets reside, how attackers acce…
Proofpoint catalogs three IcedID variants—Standard, Lite, and Forked—and notes a shift from banking-focused activity to payload delivery, including ransomware. It links the Forked variant to Emotet infections and multiple threat actors (TA581, TA578, TA551, TA…
ThreatLabz (Zscaler) analyzes a new DBatLoader campaign active in Europe that delivers Remcos RAT and Formbook to manufacturing companies and other businesses. The operation uses WordPress-hosted payloads with authorized SSL certificates, multi-format obfuscat…