LockBit 3.0, also known as LockBit Black, demonstrates advanced anti-forensic and rapid encryption tactics, including log clearing, service deletion, and Windows Defender evasion. The campaign gains initial access via SMB brute-forcing from various IPs and useā¦
FortiGuard Labs tracked a campaign using malicious Excel VBA macros (OLE Compound File) to cryptojack Windows systems for Monero. The attackers deliver a .NET payload, load a miner via process hollowing, and maintain persistence through Task Scheduler while exā¦
The article explains how to reconstruct Gootloader registry payloads using off-host Python scripts and CyberChef workflows, as well as on-host PowerShell decoding. It also catalogs technical indicators, network signals, and YARA rules related to GOOTLOADER, FOā¦
Realtek CVE-2021-35394 exploitation surged in 2022, with tens of millions of attempts targeting the Realtek Jungle SDK remote code execution vulnerability and a significant shift to delivering IoT malware. The campaign affected hundreds of device models acrossā¦
Security researchers at eSentire TRU unravel the operator behind Golden Chickensābadbullzvenomāconnected to VENOM SPIDER, with links to FIN6, Cobalt Group, and Evilnum. The report details the malwareās modular components, evolving campaigns, and defense recommā¦
ASECās weekly briefing analyzes phishing email threats from January 8ā14, 2023, highlighting attachments as the main delivery method for Infostealer, FakePage, and other malware families, including OneNote (.ONE) extensions. It also outlines case distributionsā¦
Unit 42 analyzes PlugX variants hidden on USB devices, detailing novel USB infection and hiding techniques as part of a broader Black Basta-related investigation. The findings show USB-based persistence, stealthy file hiding, and multiple PlugX variants linkedā¦
Trend Micro researchers uncovered Mimic, a new ransomware that leverages the Everything toolās APIs to locate files for encryption and operates with multiple defense-evading capabilities. The malware appears linked to Conti-inspired tooling and dropped componeā¦
Threat actors are increasingly using Go (Golang) to develop crossāplatform information stealers, with Titan Stealer highlighted as a recent example. The article covers Titan Stealerās Go-based builder, its C2 infrastructure and dashboards, the data it collectsā¦
Two agencies warn defenders about the malicious use of legitimate remote monitoring and management (RMM) software, showing how attackers abused tools like ScreenConnect (ConnectWise Control) and AnyDesk via phishing to steal funds and gain backdoor access. Theā¦
Two sentences summarizing the content: Scammers impersonate recruiters to target job seekers amid tech layoffs, using fake postings, portals, and forms to harvest personal data and potentially extort victims. The campaign relies on newly registered domains, coā¦
GuLoader is an advanced shellcode downloader that uses anti-analysis tricks to evade detection and hinder reverse engineering, and its campaign remains ongoing through 2022. Trellix observed threat actors increasingly delivering GuLoader via NSIS-based installā¦
TA444 is a North Koreaāsponsored threat actor that has tested a wide range of infection methods in 2022 and remains financially motivated, with a strong shift toward cryptocurrency-related theft. The group blends traditional APT techniques with a startup-like ā¦
SentinelLabs tracks DragonSpark, a cluster of opportunistic East Asiaātargeted attacks that leverage the SparkRAT open-source RAT and Golang-based runtime source-code interpretation to evade static analysis. The activity is attributed with high likelihood to aā¦
Emotet has returned after a period of dormancy, expanding its toolkit with new evasion and propagation methods and heavily leveraging phishing campaigns to drop multiple payloads. It now features an SMB spreader for lateral movement, a Chrome data-stealer moduā¦