Lumen Black Lotus Labs discovered the “Hiatus” campaign that compromises business-grade DrayTek Vigor routers to deploy HiatusRAT and a tcpdump variant, enabling remote access, SOCKS5 proxying, and packet capture. Lumen observed ~100 infected routers (primaril…
IceFire re-emerges with a Linux variant that targeted enterprise networks, expanding beyond its previous Windows focus. It exploits a deserialization vulnerability in IBM Aspera Faspex (CVE-2022-47986) to drop and execute a Linux payload that encrypts files an…
Cyble researchers describe BlackSnake, a Chaos ransomware-derived variant that integrates a clipper module to steal cryptocurrency addresses and supports affiliate-driven deployment. The malware uses language checks, process and directory discovery, registry-b…
ASEC reports the PlugX backdoor being installed through Sunlogin and AweSun remote control software via their remote code execution vulnerabilities, using a multi-stage dropper and DLL side-loading to decrypt and load PlugX in memory. The campaign links to Chi…
GoBruteforcer is a Golang-based botnet that targets web servers running phpMyAdmin, MySQL, FTP, and Postgres, using CIDR-range scanning and brute-force login to gain access. It then deploys an IRC-based C2 bot, a web shell, and persists via cron, with ongoing …
BatLoader continues to abuse Google Search Ads to deliver Vidar Stealer and Ursnif by masquerading as legitimate software and using Windows Installer and Python-based loaders to fetch and run payloads. The campaign also impersonates popular apps (ChatGPT, Zoom…
ASEC reports Netcat-laced campaigns targeting poorly managed MS-SQL servers, leveraging multiple tools (including Cobalt Strike, RasmanPotato, Stowaway, and SharpDecryptPwd) to gain control, escalate privileges, and move laterally. The operation employs LOLBin…
Mandiant, with SonicWall PSIRT, identifies a suspected Chinese campaign that maintains long-term persistence by running malware on an unpatched SonicWall SMA appliance, with capabilities to steal credentials, provide shell access, and survive firmware upgrades…
Indonesian company that operates in agricultural industry.
Fortinet FortiGuard Labs tracked the 8220 Gang’s use of ScrubCrypt to obfuscate and encrypt payloads and deliver a Monero-mining operation via a WebLogic vulnerability. The operation combines PowerShell-based loading, in-memory execution, registry-based persis…
Check Point Research traces the evolution of Sharp Panda tools into a newer Soul malware framework used against Southeast Asian government entities, culminating in late-2022 activity that loaded the Soul modular backdoor. The report links these campaigns to a …
GlobeImposter ransomware is being distributed by MedusaLocker actors, with evidence suggesting the RDP vector facilitates initial access. The operation deploys Mimikatz and port scanners among other tools to map networks, exfiltrate credentials, and extend the…
Fortinet’s FortiGuard Labs’ Ransomware Roundup highlights two notable variants, Sirattacker and ALC, detailing their execution methods, ransom notes, and observed activity, including Bitcoin wallet interactions associated with the Sirattacker actor. The report…
Two sentences summarizing the content. Trellix researchers document Qakbot’s evolution to OneNote-based malware distribution, showing how OneNote attachments deliver a loader DLL and the main Qakbot payload across multiple campaigns. The report also covers how…
Zscaler ThreatLabz analyzed Nevada, a Rust-based variant of Nokoyawa ransomware, noting strong code similarities across Nokoyawa versions and two parallel branches in different languages. The findings describe hardcoded and CLI-configured encryption, shadow-co…