ASEC reports that attackers are leveraging a Gnuboard 4-based site to host fake Kakao and Naver login pages aimed at credential theft. Attribution points to the Kimsuky group, noting deceptive links and autocompletion behavior designed to trap users. #Kimsuky …
Huntress linked a February 2023 GoAnywhere MFT-related intrusion to a zero-day vulnerability and a Truebot-like post-exploitation activity, leading to a mitigation before a ransomware event could unfold. The effort highlighted how certutil and rundll32 were us…
HTML smuggling is a rising method used by criminals to deliver malware via HTML attachments and archives masquerading as legitimate brands. The Trustwave SpiderLabs piece catalogs campaigns by Qakbot, IcedID, Cobalt Strike, and Xworm that abuse HTML smuggling …
Malicious Google Ads were used to promote AWS credential phishing pages, delivered through a multi-hop redirection chain that ends at a legitimate AWS login page. The operation includes a proxy Blogspot page, anti-analysis JavaScript, and Brazil-linked infrast…
The advisory outlines ongoing DPRK state-sponsored ransomware activity targeting Healthcare and Public Health Sector organizations and other critical infrastructure, detailing TTPs, IOCs, and cryptocurrency ransom payments. It also describes how actors acquire…
BP Lawyers Corporate Law Firms merupakan Konsultan Hukum Indonesia, Jasa Pembuatan Kontrak Kerja Bisnis di Jakarta Terbaik, Berpengalaman dan Profesional.
NewsPenguin, a previously unknown threat actor, targeted organizations in Pakistan using spear-phishing tied to the Pakistan International Maritime Expo & Conference (PIMEC-2023) and delivered a multi-stage payload. The final espionage tool is XOR-encrypted wi…
ESXiArgs is a ransomware variant that targeted exposed ESXi hypervisors by exploiting CVE-2021-21974 via OpenSLP to deploy a Python-based backdoor and a web shell. The campaign encrypts virtual machine data using RSA and Sosemanuk, overwrites ransom notes on t…
ASEC’s analysis reveals Quasar RAT being distributed via a private Home Trading System (HTS) called HPlus, used by illicit investment groups to lure victims and install malware. The campaign shows HTS masquerading as legitimate investment services, delivering …
SentinelLabs documented the first Linux ELF variant of Cl0p ransomware, which includes a flawed encryption routine that can decrypt files without paying. A free decryptor for this Linux variant was released by SentinelLabs. Hashtags: #Cl0p #Cl0pELF #Linux #Sen…
Sliver backdoor was installed via Sunlogin vulnerability exploitation, with threat actors using BYOVD to disable security products and deploy a reverse shell alongside Gh0st RAT and XMRig CoinMiner. The report details Sliver’s capabilities, the Sunlogin RCE at…
The ESXiArgs ransomware campaign targets VMware ESXi servers by exploiting a two-year-old OpenSLP heap overflow vulnerability (CVE-2021-21974) to deploy encryption across near 1,000 servers worldwide, with France, the US, and Germany heavily affected. The atta…
ASEC’s RAPIT analysis summarizes malware weekly stats from January 30 to February 5, 2023, highlighting downloader as the top category, followed by Infostealer and backdoor. The leading families were SmokeLoader, BeamWinHTTP, Formbook, Quasar RAT, and RedLine,…
ASEC reports Magniber distribution in Korea disguised as MSI Windows installers, using MOTW bypass and base64-encoded links to evade blocking. The campaign leverages MSI Custom Actions to execute a Magniber DLL, deletes volume shadow copies to hinder recovery,…
Proofpoint tracks a new financially motivated threat actor cluster, TA866, linked to the Screentime activity that uses custom tools WasabiSeed and Screenshotter to gather victim information via screenshots before deploying additional payloads. The operation le…