Global Mining’s Product Catalog is available for download. MINExpo 2012 Please Visit Global Mining Products Inc at MINExpo 2012 Booth No. 9144 Service and Repair Facilities 3 Location To Serve You Better Global Mining – USA Ph: 775-778-3410 Fax: 775-778-3418 Global Mining – Canada Ph: 604-538-0058 Fax: 604-541-2850 PT GloMinPro Indonesia
Morphisec identifies a highly evasive ProxyShellMiner campaign that leverages ProxyShell flaws to gain access to Windows Exchange servers and deploys a multi-stage coin-mining operation across an organization. The campaign uses domain-wide persistence, obfusca…
The ESXiArgs ransomware campaign exploited CVE-2021-21974 via the OpenSLP service to remotely execute code on exposed ESXi servers. VMware patched the vulnerability in early 2021, while Trellix details how attackers probe the internet for unpatched systems, en…
Paradise ransomware is being distributed via exploitation of the AweSun vulnerability, with the same actors previously linked to Sunlogin-related BYOVD and Sliver C2 campaigns. The attackers use AweSun-generated cmd/PowerShell to install DP_Main.exe, encrypt f…
DarkBit ransomware targeted a large Israeli university with politically motivated aims, and Cyble Research and Intelligence Labs analyzed its Go-based binary, encryption behavior, and public messaging around motives. The attackers’ ransom note, Twitter bio, an…
SecurityScorecard’s STRIKE Team investigates a ransomware incident affecting a major U.S. city housing authority and concludes with moderate confidence that the event involved ransomware, despite past false claims by LockBit. The analysis ties activity to a kn…
Zscaler ThreatLabz researchers analyzed a government-targeting campaign that uses Havoc, an open-source post-exploitation C2 framework, to blend evasive techniques with multi-stage delivery and execution. The operation leverages a downloader chain, a signed sh…
Mirai variant V3G4 emerged in 2022, leveraging numerous vulnerabilities to propagate across Linux-based IoT devices and convert them into a botnet capable of DDoS and other attacks. It uses hardcoded C2 domains, XOR-based decryption, string encryption, and a s…
Bitsight profiles Mylobot, a proxy botnet that turns infected hosts into proxies controlled by a C2, with a downloader that expands the network via WillExec and links to BHProxies. The operation features extensive hardcoded and encrypted domain lists, large DN…
Cyble Research & Intelligence Labs (CRIL) highlights a spike in fake donation schemes exploiting the Turkey–Syria earthquake, where scammers impersonate charities to harvest personal data and funds. The attackers host phishing sites, redirect victims to legiti…
Threat actors distribute Pybot DDoS disguised as a Discord Nitro generator bundled with illegal cracks and keygens. The campaign uses a DRPU Setup Creator installer to drop a downloader that persists at startup, fetches the Pybot payload, and launches a Python…
Bitdefender researchers describe opportunistic threat actors abusing CVE-2021-21974 to target VMware ESXi, leveraging OpenSLP (port 427) for pre-auth remote code execution and deploying ESXiArgs ransomware against VM files. The advisory covers attack patterns,…
AsyncRAT is being distributed through Windows CHM (CHM) files, with a multi-stage chain that downloads and executes payloads via mshta, VBScript, and HTA. The campaign culminates in a fileless AsyncRAT deployment featuring anti-VM, keylogging, and screenshot c…
ReversingLabs identified aabquerys, a malicious npm package that downloads second and third stage malware payloads to systems that have downloaded and run the npm package. This incident highlights growing open source supply chain risks in npm, PyPi, and GitHub…
Dalbit (Moonlight) is a threat group tracked by AhnLab’s ASEC, which has conducted 50+ attacks against Korean companies since 2022 using open-source tools, WebShells, and proxy-based C2 infrastructure through *.m00nlight.top. The operation progresses from init…