Two Zscaler ThreatLabz reports reveal WarHawk, a new backdoor used by the SideWinder APT to target Pakistan, delivering Cobalt Strike via a multi-module loader that includes KernelCallBackTable injection and a Pakistan Standard Time check. The campaign leverag…
RDP is commonly used for initial compromise and lateral movement, including via wrappers when native remote desktop support is unavailable. The article also covers how attackers add user accounts, drop RDP-related malware, and employ credential theft and sessi…
Security researchers tie the Spyder Loader (Trojan.Spyload) to a long-running intelligence-gathering operation called Operation CuckooBees, active since at least 2019 and targeting intellectual property. The loader is a 64-bit PE DLL derived from sqlite3.dll, …
FortiGuard Labs’ Ransomware Roundup analyzes Royal ransomware, detailing its Windows-based encryption, command-line operation, shadow-copy deletion, and ransom workflow via Tor, along with Fortinet protection and defender guidance. It notes the potential for a…
SafeBreach Labs uncovered a new fully undetectable PowerShell backdoor that disguises itself as part of the Windows update process and has targeted about 100 victims. The attack chain starts with a malicious Word document (Apply Form.docm) and culminates in C2…
ESET researchers uncovered a Lazarus campaign in fall 2021 that targeted a Netherlands aerospace employee and a Belgian political journalist via spearphishing attachments, leading to a multi-tool intrusion set. Notably, it marked the first publicized real-worl…
URSNIF’s LDR4 variant marks a shift from banking fraud to remote access capabilities, dropping banking modules in favor of enabling VNC and remote shell access on compromised machines. It introduces API call obfuscation, a redesigned configuration/storage stru…
Trend Micro’s honeypots detected cryptocurrency mining activity targeting cloud and container environments, with actors using Docker API abuse and worm-like propagation that resembles TeamTNT’s arsenal, though WatchDog may be mimicking or behind the campaign. …
Check Point Research analyzes Black Basta’s delivery and evasion techniques, highlighting how the dropper and payload are prepared to bypass analysis and encrypt data while moving laterally. The piece details the delivery stages, anti-debug/anti-analysis trick…
Two zero-day Exchange vulnerabilities, CVE-2022-41040 and CVE-2022-41082 (ProxyNotShell), are being actively exploited in the wild, with over 1.6 million exploit attempts observed across 4 million protected websites. The activity shows GET-based probing agains…
Palo Alto Networks describes a proactive detector that spots potentially malicious newly observed domains (NODs) by ingesting WHOIS data, DNS traffic, and passive DNS signals, enabling earlier detection of abuse as domains become active. The system analyzes mi…
Ransom Cartel emerged as a ransomware-as-a-service operation around late 2021, showing double-extortion techniques and notable overlaps with REvil, including possible ties to REvil’s code and infrastructure. The report analyzes Ransom Cartel’s TTPs, comparison…
Emotet has re-emerged as a 64-bit variant with a multi-stage decryption and C2 communications workflow. The analysis highlights its loading sequence, encrypted resources, inner DLLs, and cryptographic changes (ECC and bcrypt.dll) compared with earlier versions…
Threat researchers reverse-engineered Brute Ratel C4 (BRC4) and its Badger agents, building a defender-focused analysis and an Atomic-C2 simulator to test detections. The study maps BRC4 behaviors to MITRE techniques, highlighting an ISO-based initial access c…
CRIL identified a phishing site impersonating Convertio that delivers the RedLine Stealer payload. The campaign uses a ZIP containing a shortcut to download BAT files, bypass Defender, and install an EXE that exfiltrates data to a C2 server. #RedLineStealer #C…