Two sentences summarizing the article: Quick Heal researchers examine how malware bypasses User Account Control (UAC) to gain admin privileges, enabling ransomware to encrypt system files. The piece details three CMSTP-based UAC bypass methods (malicious INF f…
Cyble Research & Intelligence Labs details a new BAT loader used to disseminate RATs and stealers via OneNote attachments delivered through spam emails. The article walks through the infection chain, the obfuscated BAT loader, in-memory .NET payload loading (Q…
ASEC’s weekly malware statistics for January 23–29, 2023 categorize threats by family, with downloader as the largest share, followed by Infostealer and backdoor. The report highlights BeamWinHTTP as the top downloader, with SmokeLoader, Formbook, AgentTesla, …
IceBreaker APT is a newly tracked threat targeting the gambling/gaming sector in the run-up to ICE London, employing social-engineering to lure a customer-service agent and delivering a two-stage payload chain. Researchers describe a modular Node.js-based back…
FortiGuard Labs detected a zero-day in a PyPI package named “web3-essential,” published by a newly joined user known as ‘Trexon’ on January 26, 2023. The package downloads and executes a Go-based binary to steal sensitive data and exfiltrate it via a Discord w…
VSTO Add-Ins can be weaponized to deliver and execute code via Office documents, offering persistence across Office sessions. The article details local and remote VSTO attack flows, including user prompts to enable Add-Ins, encoded PowerShell payloads, and a r…
A Mirai-driven botnet variant is dropping Medusa, a Python-based botnet, onto Linux targets to perform DDoS, ransomware, brute-force attacks, and data exfiltration. The article details the Medusa botnet’s client, C2 communications, attack methods, and the IOCs…
Fortinet’s FortiGuard Labs highlights the Trigona ransomware in its bi-weekly Ransomware Roundup, detailing its double-extortion approach of encrypting endpoints and threatening to leak exfiltrated data. The report covers suspected infection vectors (emails, R…
AveMaria distribution campaigns evolved through seven case studies in 2022, showcasing multiple delivery formats and evolving execution steps to evade detection. ThreatLabz notes ongoing updates to AveMaria’s chain, including new techniques like custom downloa…
Two sentences summarizing the intrusion: An August 2022 incident began with a malicious Word document carrying a VBA macro that installed a PowerShell-based implant, established persistence via scheduled tasks, and used a renamed AutoHotkey-based keylogger to …
Checkmarx researchers tracked a persistent threat actor they named PYTA27 who distributed multiple malicious Python packages to PyPI and GitHub, evolving from plain-text payloads to obfuscated and multi-stage stealers that target Discord and crypto-wallets. Th…
Threat actors are increasingly using OneNote attachments in spam campaigns to deliver Qakbot and other malware families. The infection chain drops an HTA loader via mshta, downloads a Qakbot DLL, and then executes it, enabling credential theft and lateral move…
SentinelLabs detected a cluster of virtualized .NET loaders, named MalVirt, distributed via malvertising to deliver Formbook/XLoader infostealer payloads. The loaders use KoiVM-based virtualization and anti-analysis techniques, rely on a Windows Process Explor…
HeadCrab is a novel, memory-resident Redis malware that has quietly compromised Redis servers worldwide since 2021, forming a botnet of at least 1,200 servers. It loads a custom Redis module via SLAVEOF/master replication, operates entirely in memory to evade …
Trend Micro analyzes a December 2022 campaign attributed to APT34, deploying a new .NET backdoor (MrPerfectInstaller) to steal credentials and exfiltrate data via compromised mailbox accounts. The attackers leverage Microsoft Exchange Web Services to relay sto…