First introduced in July 2022, Icarus Stealer is an infostealer that uses an hVNC capability to create a hidden desktop for covert navigation on infected machines. It packs a wide range of features (2FA bypass, rootkit, macros, VBS payloads, CCleaner, Bot Kill…
Hydrochasma targets medical laboratories and shipping organizations in Asia in an intelligence-gathering campaign that relies on publicly available tools and living-off-the-land techniques. The operation, active since October 2022, appears focused on informati…
Two office-document threat vectors are described: attackers are moving from VBA macros to malicious Microsoft Office Add-ins, specifically XLLs, to deliver payloads. The article details a Raccoon Stealer V2 campaign that uses obfuscated .NET installers loaded …
DarkCloud Stealer is a multi-stage information-stealer that can exfiltrate data via SMTP, Telegram, Web Panel, and FTP, and is distributed through spam campaigns with a customizable builder for grabber and clipper features. Researchers observed a rise in DarkC…
PetroChina Indonesia is a company that operates in the Oil & Energy industry. It employs 251-500 people and has $25M-$50M of revenue. The company is headquartered in Jakarta, Jakarta, Indonesia
A WordPress ad-fraud operation abuses a backdoored plugin named fuser-master to turn dozens of blogs into fraud machines that load and refresh ads via a hidden popunder flow triggered by a special entrypoint URL. The plugin simulates human browsing (scrolling,…
EclecticIQ analyzes three cases of cyberattacks likely linked to the Gamaredon APT group, targeting the Security Service of Ukraine, Culver Aviation, and Latvian/NATO allies with phishing, HTML smuggling, and CVE-2017-0199 Word exploits. The report notes overl…
Security researchers report that the BlackCat ransomware group briefly claimed an attack on a major U.S. electronic health record (EHR) vendor, but the entry disappeared within days. STRIKE analysis links possible BlackCat activity to its ExMatter/Fendr exfilt…
FortiGuard Labs’ ransomware roundup analyzes CatB, detailing its Windows-focused dropper, DLL sideloading, anti-analysis checks, and a high ransom demand. It also covers infection methods, payload behavior, and Fortinet protections and guidance. #CatB #FortiGu…
Trend Micro researchers attribute a new backdoor to the Earth Kitsune threat group, delivered via a watering hole operation and social engineering. The campaign blends patched installers, Chrome native messaging persistence, ECC-based cryptography for C2, and …
Brute Ratel, a Red Team framework, has been abused by attackers including APT29 to conduct cyber intrusions, with methods such as ISO-delivered LNK files used for DLL sideloading of version.dll. The article also details the framework’s technical underpinnings,…
Two sentences summarizing the content: GlobeImposter has spanned multiple campaigns and rebrands, with the TZW ransomware identified as a new variant that shares infrastructure and techniques with GlobeImposter. The findings show shared onion-based victim port…
Earth Yako is an intrusion set linked to Operation RestyLink/EneLink, with newly observed TTPs and infrastructure for cyberespionage against Japanese researchers and think tanks (also some Taiwan targets). The campaign features multiple malware families (Mirro…
DarkBit is a new ransomware strain that targeted Technion in Israel, encrypting files and demanding a Bitcoin ransom. The group uses a branded onion site and social media to publicize the attack and promote geopolitical messaging. #DarkBit #Technion #Onion #To…
ASEC analyzed RedEyes (ScarCruft/APT37) activity in Korea, revealing the group’s use of the Hangul EPS vulnerability CVE-2017-8291 to spread malware via steganography and a new M2RAT backdoor that employs shared memory for C2. The operation combines persistenc…