An ASEC analysis uncovers a malicious LNK file disguised as a normal HWP document, bundled with a text file impersonating the National Tax Service. The attack chain uses PowerShell to run payloads, iterates through multiple VBScript/Batch components, and exfil…
EclecticIQ details Mustang Panda’s campaign against government and public-sector targets in Asia and Europe, delivering a modified PlugX variant via malicious ISO images embedded with LNK shortcuts and employing DLL hijacking, in-memory loading, and a multi-st…
Proofpoint researchers report a rising trend of malware delivery via OneNote attachments in email campaigns from December 2022 to January 2023, spanning multiple threat actors and broad targets. End users must interact with embedded OneNote content to execute …
IcedID has shifted from email-based delivery to drive-by infections delivered via Google Search Ads that target common enterprise applications. The TRU team explains how ads, cloaking, and a Cobalt Strike foothold are used to compromise endpoints and deliver I…
INKY uncovered a widespread Southwest Airlines credential harvesting phishing campaign that uses newly created domains to lure victims via a fake survey and gift-card offer. The scam escalates from impersonation and enticing branding to a credential-harvesting…
VectorStealer is an information-stealer capable of harvesting data from browsers, chat apps, and .rdp session files, enabling threat actors to perform RDP hijacking and remote access. It is sold via a web panel and Telegram channel, uses the KGB Crypter and Ko…
Rapid7 observed attackers using Microsoft OneNote to deliver base64-encoded payloads that decrypt to Redline Infostealer or AsyncRat, via a multi-stage chain starting with a phishing OneNote attachment. The analysis details how a hidden batch script launches a…
Unit 42 researchers describe a machine learning pipeline that analyzes memory-based artifacts from a hypervisor-based sandbox to detect evasive malware like GuLoader. The article discusses limitations of static and sandbox analysis and demonstrates how memory-…
The ASEC analysis tracks CoinMiners targeting Korean and overseas users, detailing cases of Ethereum Classic mining and related tooling. It covers distribution methods (Discord, dnSpy disguises), involved malware families, wallet addresses, and the broader tre…
Magniber is a ransomware family that exploits a wide range of public-facing vulnerabilities and uses layered execution, evasion, and delivery techniques to encrypt targeted files. It also employs typosquatting, fake installers, and signature bypass methods to …
Infostealer was the leading malware category in the Jan 16–22, 2023 period, accounting for 43.0% of samples, followed by downloader (30.06%) and backdoor (19.9%). The report highlights BeamWinHTTP, AgentTesla, Formbook, SmokeLoader, and Pony as top families, w…
BlueBravo is a threat group linked to Russian APT activity (AP T29/NOBELIUM and SVR) and deployed GraphicalNeutrino via a compromised site lure themed around ambassadors. It also increasingly uses legitimate Western services like Notion for C2 to blend malware…
TrickGate is a transformative, shellcode-based packer-as-a-service used to conceal malware from security tools since 2016 and has wrapped a wide range of threats including Cerber, Trickbot, Maze, and Emotet. The packer’s core building blocks—shellcode loader, …
Resecurity identifies Nevada Ransomware as a relatively new ransomware family with an active affiliate platform on the RAMP underground. It operates a Windows and Linux/ESXi locker, supports post-exploitation workflows, and uses a TOR-based affiliate portal to…
Secureworks CTU researchers link Moses Staff and Abraham’s Ax as likely the same operator tied to COBALT SAPLING, based on similarities in iconography, videos, and leak-site infrastructure. The groups share multilingual WordPress leak sites, near-identical bra…