Bad Magic is a Russo-Ukrainian conflict–related APT campaign delivering a modular malware stack starting with a ZIP delivered via a phishing-like lure, then a malicious LNK that leads to an MSI dropper. The operation unfolds as PowerShell-based loaders and a P…
CrowdStrike observed eCrime adversaries shifting from macro-based delivery to OneNote attachments, embedding HTA, CMD, and JSE payloads to drop second-stage loaders. After Microsoft patched the MOTW vulnerability in ISO files (CVE-2022-41091) in November 2022,…
Uptycs Threat Research Team uncovered HookSpoofer, a new C#-based infostealer spread via bundlers that includes keylogging and clipper capabilities and exfiltrates stolen data to a Telegram bot. It’s inspired by StormKitty and uses in-memory loading of a hidde…
Lazarus’ FudModule subverts kernel protections by leveraging a vulnerable Dell driver to elevate to ring 0 and tamper with telemetry data streams to hide its activities. The article also outlines practical, detection-focused strategies such as monitoring ETW d…
Winter Vivern is investigated by SentinelLabs with observations from the Polish CBZC and Ukraine CERT, revealing a new wave of espionage campaigns linked to pro-Russian objectives. The APT targets governments and private entities globally, using tailored lures…
Sophos X-Ops observed continued exploitation of Microsoft Exchange servers using the OWASSRF chain that leverages CVE-2022-41080 and CVE-2022-41082 to achieve ProxyShell/ProxyNotShell-style access. The campaigns targeted high-profile entities such as Rackspace…
BianLian continues to operate and expand its victim list while shifting its monetization from encrypting files to data-leak extortion, with tailored threats aimed at pressuring targets. The group maintains a Go-based backdoor for remote access and operates a r…
Check Point Research provides an in-depth analysis of the dotRunpeX injector and its evolution, detailing both the old and new versions and how they are protected by virtualization (KoiVM) and obfuscation (ConfuserEx). The report explains how dotRunpeX acts as…
Cisco Talos has identified a new espionage actor named YoroTrooper active since at least June 2022, targeting CIS governments, embassies, and a EU health care agency and WIPO. The group uses Python-based information stealers, commodity RATs (AveMaria/Warzone, …
An in-depth look at APT-C-36 campaigns shows ties to Hagga/Aggah and documents a five-stage infection chain that ends with NjRAT/LimeRAT, including memory-resident techniques and evolving C2 infrastructure. The analysis highlights spearphishing with OLE-trigge…
CatB ransomware uses MSDTC DLL hijacking to drop and load its payload, then encrypts files while attempting to steal browser data and credentials. It employs sandbox evasion, DLL injection, and service abuse to survive analysis and deliver its ransom demands, …
In part one on North Korea’s UNC2970, we covered UNC2970’s tactics, techniques and procedures (TTPs) and tooling that they used over the course of multiple intrusions. In this installment, we will focus on how UNC2970 utilized Bring Your Own Vulnerable Device (BYOVD) to further enable their operations.
During our investigation, Mandiant consultants…
Since June 2022, Mandiant has been tracking a campaign targeting Western Media and Technology companies from a suspected North Korean espionage group tracked as UNC2970. In June 2022, Mandiant Managed Defense detected and responded to an UNC2970 phishing campaign targeting a U.S.-based technology company. During this operation, Mandiant observed UNC2970 leverage…
The article analyzes Fortinet FortiOS vulnerability FG-IR-22-369 (CVE-2022-41328) and its targeted exploitation of FortiGate and FortiManager devices, revealing multiple IoCs and several malware components used for persistence and control. The findings indicat…
Juniper Threat Labs analyzes email traffic to reveal how malicious files propagate via attachments, macros, and exploits, based on a random sample of one million files from 2022. The findings show that most malicious files are first-stage downloads, often deli…