Rapid7 analyzes exploitation activity surrounding CVE-2022-47966, a pre-authentication RCE in ManageEngine on-premise products, noting public PoC code and ongoing compromises since January 2023. Organizations using affected products should patch and monitor fo…
Kronos malware has reemerged with increased functionality and is now observed alongside ransomware, with activity reported in Mexico. IBM Security Trusteer warns the campaign could spread to North America and Europe, urging stronger email filtering and offline…
Trend Micro telemetry links Vice Society to manufacturing attacks and notes the group has evolved from using known ransomware variants to developing a custom ransomware builder, potentially hinting at a ransomware-as-a-service model. The group continues to emp…
Mandiant tracks a suspected China-nexus operation that exploited Fortinet FortiOS SSL-VPN CVE-2022-42475 as a zero-day, deploying a backdoor named BOLDMOVE on Windows and Linux and targeting internet-facing devices. The campaign highlights how such devices ena…
Analyst1 presents a human-centric examination of the LockBit operation, tracing its evolution from ABCD to LockBit Red/Black and detailing the personalities, inter-gang dynamics, and operational innovations behind one of the world’s most prolific ransomware or…
HUMAN’s Satori Threat Intelligence and Research Team dismantled a sophisticated malvertising operation named VASTFLUX that injected JavaScript into ad creatives to stack multiple video players behind a single banner and fraudulently register views. The operati…
A CYFIRMA report details a phishing campaign that delivers GuLoader to download Remcos RAT via a heavily obfuscated VBScript loader. The operation uses PowerShell, LNK shortcuts, and in-memory process injection to establish C2 and persistence. #GuLoader #Remco…
eSentire’s TRU analyzes Raspberry Robin’s multi-stage infection chain, starting with infected USB drives and fetching DLL payloads from compromised QNAP servers before delivering SocGholish and triggering C2 communications. Analysts foresee potential future us…
Researchers from Uptycs detail a Titan Stealer campaign sold via a Telegram channel, featuring a configurable builder to tailor data theft. The malware targets browser credentials, crypto wallets, FTP client data, screenshots, system information, and other fil…
Confiant reports a cookie-stuffing campaign by DatalyMedia that uses cloaking, hidden iframes, and multi-domain redirection to inflate ad conversions across programmatic platforms, with a Black Friday uptick. The analysis maps the actors, laundering traffic pa…
Bitdefender researchers document ProxyNotShell/OWASSRF exploit chains targeting on-prem Microsoft Exchange, outlining how SSRF can lead to backend access and how multiple exploit chains culminate in RCE and payload deployment. The report also walks through rea…
Cyble Research and Intelligence Labs document a rising Amadey bot campaign spreading via phishing sites and spam, acting as a downloader and loader for additional malware while stealing browser data and crypto wallet information. The campaign employs persisten…
The article explains how attackers exploit jQuery and JavaScript to inject malicious code into legitimate websites, including disguising malware as legitimate jQuery plugins and stealing credentials through deceptive login forms. It also outlines an incident r…
Huntress shares their take on the ConnectWise Control vulnerability discussions, arguing there was no demonstrated exploit at the severity level claimed and advocating for responsible disclosure and collaboration. They emphasize social engineering and phishing…
Team Cymru analyzes Vidar’s evolving threat infrastructure, highlighting domain shifts, proxy configurations, and anonymization methods (including Tor and Hola VPN) that complicate analysis. The post also covers a two-tier management architecture, payload upda…