Brute Ratel’s config decoding update shows that Brute Ratel now uses a dynamic key to decrypt its onboard configuration, though the hardcoded key still exists for decrypting some strings. The article walks through RC4-based encryption, base64 decoding, and two…
BlackCat (ALPHV) ransomware has risen to prominence with a Rust-based framework, triple extortion tactics, and a growing affiliate network that leverages diverse attack vectors. Trend Micro highlights evolving TTPs—from Emotet-assisted initial access to privat…
LODEINFO underwent multiple upgrades in 2022, expanding its backdoor capabilities, encryption, and evasion techniques while continuing to target primarily Japanese entities. The article details complex C2 communications, 64-bit memory injection, and evolving b…
Trend Micro analyzed an LV ransomware intrusion tied to ProxyShell and ProxyLogon exploits affecting a Jordan-based company, highlighting double-extortion and expanding affiliate activity. The report details the infection chain—from Exchange vulnerabilities an…
Two-sentence summary: The Magniber ransomware has evolved rapidly in 2022, shifting file extensions, injection techniques, and UAC bypass methods to dodge anti-malware detection. The analysis highlights frequent format changes and registry-focused tactics, alo…
Dormant Colors describes a widespread campaign of malicious browser extensions that infect millions of users via malvertising, then covertly load and update weaponized code to harvest data and enable targeted fraud. The investigation exposes a robust, globally…
Checkpoint’s Brand Phishing Report for Q3 2022 shows DHL as the brand most impersonated in phishing attempts (22%), with Microsoft (16%) and LinkedIn (11%) following; Instagram also enters the top ten due to a blue-badge phishing campaign. The report highlight…
Two security analyses reveal attacks against vulnerable Apache Tomcat servers that are not up to date, using JexBoss to install a WebShell and gain control with Meterpreter. The attackers then use a Base64-encoded PowerShell downloader to fetch and run scripts…
A malware dropper uses Outlook.com email as its command-and-control channel, polling a mailbox via IMAP and exfiltrating results back through email. The Python-based dropper decrypts a payload with AES, executes commands via a shell, and uses base64/ROT13 enco…
Wordfence Threat Intelligence monitored exploit attempts targeting CVE-2022-42889, aka Text4Shell, across millions of sites and observed payloads in DNS, script, and URL prefixes aimed at remote code execution. Most activity leverages DNS prefix probes to cont…
In April, VMware patched CVE-2022-22954, but attacks exploiting remote code execution via server-side template injection persisted, delivering Mirai variants, RAR1Ransom, and GuardMiner payloads to exposed VMware Workspace ONE Access and Identity Manager insta…
Attackers increasingly abuse legitimate remote-control tools to secretly take control of infected systems and evade detection. The article surveys backdoor and RAT families and real-world cases where tools like AnyDesk, TeamViewer, and VNC are misused for remo…
Cyble researchers describe Temp Loader and Temp Stealer, malicious tools advertised on the Dark Web that bundle with cracked software to drop a loader and an information stealer. The malware targets crypto wallets and various data sources, uses anti-VM and Run…
Palo Alto Networks analyzes trends in web threats by examining malicious landing and host URLs, including where they are hosted, their categories, and associated malware families, with a focus on cryptominers, JS downloaders, web skimmers, and redirects. The r…
Daixin Team is a ransomware and data extortion group focused on Healthcare and Public Health sector targets in the U.S., using VPN compromises and credential theft to deploy ransomware on ESXi servers and exfiltrate data. The FBI/CISA/HHS advisory details TTPs…