Silicon Valley Bank’s collapse in March 2023 heightened risks for startups and the broader fintech ecosystem, attracting threat actors who exploited the event with crypto-focused phishing campaigns. CRIL (Cyble Research & Intelligence Labs) identified suspicio…
MedusaLocker ransomware operates via RDP vulnerabilities and phishing, evolving into a RaaS model where developers and affiliates share profits from encrypted victims. It targets healthcare, education, and government sectors worldwide, using a sophisticated ch…
A malicious Chrome extension marketed as “Quick access to Chat GPT” (FakeGPT) hijacks the browser context to steal session cookies, harvest Facebook business/ad account data via the Graph API, and exfiltrate that data to attacker-controlled worker domains befo…
Securonix Threat Labs highlights five persistent ransomware IOCs used to inhibit system recovery: vssadmin (shadow copy deletion), WMI/wmic (shadow copy deletion), wbadmin (delete backups), bcdedit (disable recovery), and PowerShell (shadow copy deletion). The…
Two sentences: Netskope Threat Labs observed a 17x increase in traffic to malicious pages hosted on DigitalOcean, driven by new campaigns of tech support scams mimicking Windows Defender and by phishing pages targeting financial institutions and webmail users.…
ESET linked a campaign to the Tick APT group targeting an East Asian data-loss prevention (DLP) software developer, where attackers trojanized installers and compromised update servers to spread malware to the company’s customers. The operation involved Shadow…
ASEC/ASEC Security Emergency Response Center (AhnLab) reports Mallox ransomware distribution in Korea, targeting vulnerable MS-SQL servers. The malware disguises as a DirectPlay-related program, downloads a Base64-encoded DLL, uses PowerShell and process injec…
NOBELIUM (APT29) has launched a targeted EU campaign aimed at governments assisting Ukraine, utilizing geopolitically themed lure content tied to Poland’s diplomatic activity. The operation combines weaponized HTML/ISO dropper techniques and Notion-based C2 th…
Microsoft Threat Intelligence tracks DEV-1101 (now Storm-1101) for developing and promoting an open-source AiTM phishing kit that enables high-volume campaigns and MFA bypass via reverse-proxy session hijacking. The post details the tool, its campaign workflow…
Volexity describes how the AVBurner tool (attributed to the SnakeCharmer/Earth Longzhi actor) disables EDR/AV by patching Windows kernel process-creation callback entries so security drivers appear loaded but are neutered. The post shows how to detect this tam…
A detailed look at a Mirai payload generator shows how Linux devices were being abused to deliver Mirai payloads across multiple architectures using web, FTP, and TFTP services. The post also describes a backdoor created via a rogue root account and multi-arch…
Emotet malware activity has resumed, delivering non-password-protected ZIP attachments containing Office documents with macros that download and execute the Emotet DLL. Modern Emotet can be used for ransomware, DDoS, and credential theft, and can spread across…
Prometei v3 continues to evolve with updated execution-chain modules, self-updating capabilities, and a bundled Apache webserver with a PHP web shell, expanding both Windows and Linux variants. The threat remains financially driven, targeting a wide global vic…
A new ATM malware variant named FiXS has been identified by Metabase Q, targeting Mexican banks and other LATAM institutions by leveraging a vendor-agnostic approach to ATM XFS middleware and an external keyboard for its criminal operators. The malware uses a …
A CHM-based malware campaign attributed to the Kimsuky group has been identified, delivered via password-protected email attachments disguised as North Korea-related interview requests to exfiltrate user data. The malware uses a shortcut object to execute comm…