QakBot (Qbot) uses obfuscated Regsvr32-based execution to load its DLL payload, often by moving or renaming system binaries and triggering execution via LNK and batch files. The threat starts with phishing delivering a password-protected ZIP/ISO, leading to us…
ViperSoftX is a long-running information stealer that hides inside large system log files and uses multi-stage PowerShell payloads to drop VenomSoftX, a browser extension that performs man-in-the-browser attacks to steal cryptocurrency. The campaign spreads ma…
Zscaler ThreatLabz documents four under-documented groups carrying out payment card skimming against Magento and PrestaShop e-commerce stores, with activity since mid-2022 and a spike during the holiday season. The campaigns rely on heavily obfuscated JavaScri…
IBM X-Force reports that RansomExx has been rewritten in Rust as RansomExx2, targeting Linux with a Windows variant likely in development. The rewrite highlights Rust’s cross-platform appeal and the ransomware’s continued use of AES-256 encryption with RSA-pro…
Microsoft researchers warn that vulnerable Boa web servers embedded in IoT SDKs create supply-chain risk across critical infrastructure by enabling attackers to silently access networks and gather information. The post highlights Boa prevalence, CVEs in RealTe…
Cybereason’s Global SOC is tracking a wide Black Basta ransomware campaign that leverages QakBot (QakBot) to gain entry and move laterally in U.S.-based organizations. The campaign ties QakBot infections to rapid deployment of Black Basta, including DNS disrup…
Check Point Research warns of a sharp rise in fake shopping-related sites and phishing campaigns ahead of Black Friday, including impersonation of Louis Vuitton and DHL delivery scams. The report highlights lookalike domains, malicious emails, and delivery-the…
Hive ransomware operates as a ransomware-as-a-service (RaaS) that has victimized thousands across sectors like Healthcare and Public Health, encrypting data and threatening leaks. The advisory inventories Hive’s TTPs, IOCs, and mitigations, including initial a…
Recorded Future’s Insikt Group analyzes the threat landscape around the 2022 FIFA World Cup in Qatar, covering state-sponsored cyber operations, cybercrime, influence operations, and physical security threats. The assessment finds no imminent disruptive cyber …
Researchers identify the WASP threat actor behind a Python package campaign that delivers a polymorphic WASP Stealer via PyPI and uses steganography to hide its payload. The malware targets Discord accounts, wallets, and other files, exfiltrating data through …
Cisco Talos discusses new LodaRAT variants (including a VenomRAT-derived S500 drop) observed in 2022, their how-it-works changes, and how LodaRAT appears alongside RedLine and Neshta in attack chains. The post highlights C2 beacon changes, added removal-to-dri…
Trellix researchers identify World Cup/Arab-region themed email campaigns that impersonate FIFA and related entities to deliver phishing pages and malware to organizations. The top malware families seen are Qakbot, Emotet, Formbook, Remcos, and QuadAgent, with…
AXLocker, Octocrypt, and Alice ransomware families are analyzed, detailing AXLocker’s file encryption alongside its Discord token theft, and presenting Octocrypt and Alice as RaaS-style offerings with builder tools and wallet-based ransom models. The piece emp…
Aurora began as a Golang MaaS botnet advertised by Cheshire and Zelizzard, and evolved into an infostealer adopted by multiple traffers, with activity that later slowed and then resurged in different forms. Sekoia.io’s analysis shows multifaceted data collecti…
Unit 42 researchers present a machine learning approach to predicting the maliciousness of .NET samples by analyzing the DoubleZero wiper. The study shows how .NET-specific structures, unmanaged API calls, and plain-text strings can reveal malicious intent bey…