Cyble researchers uncovered Chrome extensions that hijack browsers and redirect user searches for monetary gain, affecting over two million users. The extensions modify default search engines, open persistent tabs, and route traffic through multiple redirects …
This post explains how Fortinet researchers debugged a multi-stage .NET malware chain used for Warzone RAT by exporting and running each stage independently, then dumping the next stage for analysis. It covers building a wrapper app to run KeysNormalize.dll, r…
Researchers at Cado Labs report the re-emergence of WatchDog, a threat actor known for cryptojacking cloud resources. The new campaign targets East Asian Cloud Service Providers using a shell script and a Monero wallet, revealing defense evasion, competitive m…
Earth Preta spear-phishing campaigns targeted governments, academia, and research sectors worldwide, distributing TONEINS, TONESHELL, and PUBLOAD through Google Drive links. The activity is attributed to Earth Preta (Mustang Panda/Bronze President), with new i…
Venus ransomware, also known as Goodgame, operates as a standalone legacy package with links to Zeoticus and has been encrypting files globally since August 2022. It relies on publicly exposed RDP and common attack techniques rather than sophisticated malware,…
ARCrypter is a previously unknown ransomware family that emerged in Latin America (notably Chile, with Invima involvement) and has expanded to victims in China and Canada, featuring a two-stage dropper and payload and a ransom note delivered before encryption.…
The article surveys more than twenty wiper families, examining trends, techniques, overlaps, and how actors—from activists to nation-states—use destructive software in 2022. It also discusses defense tips and the complexities of attribution, highlighting how w…
An online banking fraud group calling itself the Disneyland Team uses Punycode-based domains to spoof banks and harvest credentials, often coordinating with Gozi 2.0/Ursnif malware to drain accounts. They employ a Web-based control panel, fake bank pages, and …
Symantec links a state-sponsored activity to Billbug (aka Thrip/Lotus Blossom), targeting a certificate authority and government/defense agencies across Asia since March 2022. The operation employs dual-use tools and backdoors (Hannotog and Sagerunex), uses St…
DTrack is a Lazarus group backdoor used across a wide range of targets, including financial environments, a nuclear power plant, and targeted ransomware campaigns. The analysis highlights a multi-stage deployment with decryption and obfuscation, plus expanding…
FortiGuard Labs reports that RapperBot has re-emerged in October 2022 as a DDoS-focused IoT botnet aimed at game servers, leveraging Telnet brute-forcing with embedded credentials to propagate. The campaign maintains a similar C2 protocol to earlier RapperBot …
DAGON Locker ransomware is being distributed in Korea, often via phishing emails, and operates as a ransomware-as-a-service with variable distribution strategies. It uses a memory-resident 64-bit EXE and employs strong encryption with ChaCha20 and RSA-2048, wh…
Cyble Research Labs uncovered Typhon Stealer and its updated variant Typhon Reborn, crypto-miner/stealer tools marketed for hire with wallet theft, keystroke monitoring, and anti-analysis features. Typhon Reborn adds stronger anti-analysis, expanded data colle…
Emotet resurfaced in early November 2022 after a four-month hiatus, resuming high-volume email campaigns and acting as a delivery network for other malware families. Proofpoint notes significant changes to Emotet’s lures, payloads, modules, loader, and packer,…
Two-sentence summary: The article describes using a Python script to extract and summarize HTTP CONNECT requests from PCAPs captured at a honeypot, illustrating how such traffic can reveal proxy-based tunneling activity. It also notes that larger datasets may …