A hitherto unknown attack group named Clasiopa was observed targeting a materials research organization in Asia, wielding a distinct toolset that includes a custom backdoor (Atharvan). The operation exhibits multiple defense-evading and data-exfiltrating techn…
Checkmarx researchers uncovered a mass-spam campaign in the NPM ecosystem where automated processes published thousands of malicious packages that link to phishing campaigns. The operation involved automated package creation, masquerading as legitimate entries…
Stealc is a copycat information stealer advertised by Plymouth, drawing on Vidar, Raccoon, Mars and Redline. Sekoia.io analyzes its features, C2 communications, infection chain, and ongoing development, noting its rapid uptake among cybercriminals. #Stealc #Vi…
Rhadamanthys is a two‑component information stealer consisting of a loader and a main module that exfiltrates credentials from KeePass, browsers, VPN clients, chat apps and cryptocurrency wallets. It employs VM‑based obfuscation, a custom embedded file system,…
ASEC reports that the RedEyes group (ScarCruft/APT37) targeted individuals in Korea by exploiting the CVE-2017-8291 HWP EPS vulnerability and delivering malware via steganography. They reveal a new backdoor, M2RAT (Map2RAT), that uses a shared memory channel a…
Royal ransomware has expanded its targets to Linux-based ESXi servers, introducing a Linux variant that encrypts files on virtualization hosts. The analysis outlines how the Linux variant uses ESXi tooling and traditional encryption (AES/RSA) to disrupt data c…
Qakbot (QBot) is spread through multiple OneNote- and script-based channels, including OneNote attachments, WSF/JS/JSE/HTA paths, and HTML applications, each delivering a DLL payload that is executed via Rundll32 and often injected into processes. The campaign…
HardBit 2.0 is a ransomware variant observed from late 2022 that encrypts data after stealing sensitive information, negotiating ransom rather than paying a fixed bitcoin amount. It combines data theft, encryption, and multiple defense-evading and persistence …
Researchers from ReversingLabs found a surge of malicious PyPI packages masquerading as HTTP libraries, using typosquatting and deceptive naming to distribute downloaders and info stealers. The campaign shows how open-source repositories continue to be abused …
8220 Gang is a low-skill crimeware actor known for infecting cloud hosts via SSH brute forcing and exposed services. The article walks through an educational SOC investigation of the group’s infection script, payloads, and infrastructure to help analysts track…
A Malwarebytes analysis describes a multilingual Magecart skimmer that fingerprint users by collecting IP addresses, user-agents, and payment data. The skimmer uses a Cloudflare endpoint API to extract IP and user-agent after card data is captured, then inject…
The article details anti-forensic techniques used by the Lazarus group, focusing on data hiding, artifact wiping, and trail obfuscation to conceal malicious activity and hinder analysis. It outlines how these techniques are implemented, provides examples, and …
A new threat cluster has been targeting telecommunication providers in the Middle East and abusing Microsoft, Google and Dropbox cloud services.
Redline Stealer has re-emerged with new TTPS-detection findings, detailing its infection chain, data-theft capabilities, and persistence mechanisms. The article outlines how the malware spreads, what data it targets, and the indicators that security teams can …
Security researchers warn of a widespread ESXiArgs ransomware campaign exploiting CVE-2021-21974 in VMware ESXi, with warnings issued starting February 3. SecurityScorecard’s STRIKE and ASI analyses reveal affected ESXi versions and IPs involved in potential e…