LOCKBIT claimed to have compromised IL&FS in February 2023 and began a triple-extortion leak wave, threatening data deletion if demands weren’t met. The report covers the LOCKBIT Green variant, leaked data samples, and practical cybersecurity recommendations. …
Sysdig’s Threat Research Team uncovered SCARLETEEL, a sophisticated cloud-attack operation that started in a Kubernetes pod and escalated into AWS to steal proprietary software and credentials. The operation leveraged Terraform state and AWS services to move l…
WhiteSnake is a cross-OS infostealer targeting Windows and Linux, offering multi-channel data theft capabilities and ongoing updates via threat actors. It exfiltrates collected data through a Telegram bot and is marketed with a MAAS-style model; the Linux vers…
Unit 42 researchers uncover a LokiBot distribution campaign delivered via business email compromise (BEC) phishing emails, with an ISO payload that ultimately drops LokiBot. The analysis covers the loader and obfuscation, a persistence mechanism, and an HTTP-b…
Bitdefender Antispam Labs warns of a fresh phishing campaign that uses a copycat ChatGPT platform to swindle eager investors. The scam targets several countries, leveraging unsolicited emails, a fake investment platform, and a call-center style operation to ha…
Two sentences: Trellix researchers warn that job-themed phishing and malware campaigns surge in economic downturns, targeting job seekers and employers with fake resumes, fake documents, and malicious links. The campaigns leverage typosquatted domains and well…
Threat actors are abusing OneNote’s embedded files feature in phishing campaigns by hiding and executing payloads behind embedded pictures. The article explains how this technique works, how to detect it with YARA rules, and how Microsoft blocks many of these …
MQsTTang is a new Mustang Panda backdoor that uses MQTT for C2 and operates as a single-stage, minimally obfuscated tool. The campaign targets government and diplomatic entities, employs spearphishing distribution with decoy filenames, and includes anti-analys…
Older malware can still pose a threat, as FortiGuard Labs documents a renewed MyDoom campaign that uses aged tools in new phishing lures and C2 techniques. The campaign deploys UPX-packed payloads, masquerades as legitimate Windows processes, and relies on rot…
Trend Micro’s Managed XDR team uncovered a spear-phishing campaign targeting hospitality staff that delivers RedLine Stealer via oversized multi-stage payloads. The operation uses Dropbox/Bitly links, a PowerShell-based loader chain, and WMI-based data exfiltr…
ThreatLabz analyzes the Snip3 Crypter, a multi-stage RAT loader offered as a crypter-as-a-service, which deploys new TTPs to deliver DcRAT and QuasarRAT across multiple industries via spear-phishing. The campaigns repeatedly evolve techniques to evade detectio…
Blind Eagle (APT-C-36) targeted Colombia and nearby Latin American entities with spear-phishing PDFs impersonating the DIAN tax authority to deploy a multi-stage infection chain, culminating in AsyncRAT payloads hosted via Discord. The campaign uses in-memory …
Trend Micro’s report details Iron Tiger’s update to SysUpdate, adding Linux-targeting capabilities and new C2 features, including DNS-based communication. It also notes hardened loading techniques, signed binaries abuse, and a lure using a chat application, in…
Microsoft OneNote is increasingly used as a carrier to deliver malware via phishing attachments, exploiting benign file formats to bypass defenses. The piece traces its evolution, highlights sample campaigns and loader stages, and outlines layered defenses org…
BlackLotus is a real UEFI bootkit that bypasses Secure Boot on up-to-date Windows 11 systems and establishes persistence via a MOK enrollment, delivering a kernel driver and HTTP downloader to fetch additional payloads. It exploits CVE-2022-21894, uses self-si…