FortiGuard Labs describes a new LockBit ransomware campaign that uses a multi-stage, defense-evasion approach to bypass AV/EDR, including .img containers, UAC bypass, and auto-login persistence. The campaign targets Spanish-speaking firms in Mexico and Spain, …
CYFIRMA analyzes EXFILTRATOR-22, a new post-exploitation framework marketed via Telegram and YouTube with anti-analysis capabilities and an affiliate model. The actors use domain fronting and CDN infrastructure to conceal C2 traffic and promote a subscription-…
Unidentified threat actor(s) have deployed MortalKombat ransomware alongside a GO variant of Laplas Clipper in a financially motivated campaign since December 2022, using phishing and an automated loader to drop payloads. The operation also leverages RDP scann…
Microsoft OneNote is becoming a growing vector for malware delivery, as threat actors embed malicious payloads in OneNote documents distributed via phishing emails and other deceptive tactics. Across multiple case studies, attackers use obfuscation and scripti…
An ISC SANS diary documents an IcedID (Bokbot) infection that uses .url and WebDAV to fetch and run its payload, including a 64-bit DLL retrieved from mandalorecnote.com. The report catalogs the WebDAV activity, the payload delivery chain, and the IOCs and inf…
Trend Micro’s MxDR team found x32dbg.exe, a legitimate Windows debugger, being used to sideload a PlugX variant via DLL Search Order Hijacking. The operation establishes persistence across multiple locations, uses scheduled tasks and Run keys, and culminates i…
Threat actors are weaponizing ChatGPT’s popularity to spread malware and phishing campaigns across Windows and Android, using fraudulent pages and typosquatted domains to lure victims into downloading malicious payloads. The campaigns distribute stealer malwar…
Team Cymru tracks infrastructure linked to the IcedID threat, revealing a Chilean IP involved in accessing IcedID BackConnect/C2 activity and related DNS services. The findings show a network of domains, VPN usage, and tools frequently associated with IcedID o…
Publicly released PoC for CVE-2022-39952 in FortiNAC enables threat actors to perform arbitrary file writes and potentially deploy web shells on vulnerable systems. The article highlights exposed FortiNAC instances, affected versions, and urges timely patching…
TA569 operates a prolific injection-based operation delivering SocGholish and other payloads, functioning as an initial access broker and potentially a pay-per-install service. The campaigns rely on diverse injections, Traffic Distribution Services, and reinfe…
Blackfly (also known as APT41, Winnti Group, Bronze Atlas) continues targeting Asia, focusing on the materials and composites sector and hitting two subsidiaries of an Asian conglomerate to steal intellectual property. Researchers detail a late-2022 to early-2…
Securonix Threat Labs details multiple PowerShell methods attackers use to hide invoke-expression (IEX) execution, including string splitting, character substitution, variable extraction, wildcard “globfuscation”, reordering, DNS TXT retrieval, and XOR-encoded…
Magniber has relaunched its campaign by delivering MSI installers through Edge and Chrome, after shifting away from the old IE vulnerability. It uses a loader that injects Magniber into user processes, persists via Run registry keys, and downloads a new instan…
Bitdefender Labs observed a global wave of opportunistic attacks exploiting CVE-2022-47966 in ManageEngine products, with 2,000–4,000 internet-facing servers potentially vulnerable. The advisory documents four attack clusters (Initial Access Brokers, Buhti Ran…
ESET researchers analyzed Wslink and its WinorDLL64 payload, a backdoor that loads in-memory modules and communicates over an existing Wslink connection. The backdoor collects extensive system information, manipulates files, and executes commands, with Lazarus…