Uptycs reports a new campaign where WSHRAT acts as a dropper for Agent Tesla through a multi-stage infection chain emphasizing evasion techniques like steganography and in-memory DLL loading. The campaign begins with phishing emails containing GZ and R00 archi…
A phishing site impersonating AnyDesk delivered a stealer named Mitsu Stealer by tricking victims into downloading a malicious Anydesk.exe. The malware exfiltrates browser credentials, wallet data, and Discord tokens via a Discord webhook and even attempts to …
BianLian ransomware, written in Go, encrypts files at high speed using concurrent processes and targets a wide range of industries across several countries. The operation includes a ransom note with contacts via Tox or email and hints at manual deployment with…
This fourth post in a four-part series examines the rarely used “helper” techniques wipers employ to augment data destruction, such as manipulating VSS, filling disk space, and altering boot configurations. It covers methods like shadow-copy deletion, space-fi…
CYFIRMA’s analysis focuses on Infostealer Prynt, a commodity malware used in Malware-as-a-Service campaigns with a hidden backdoor, notably through process injection into a legitimate AppLaunch.exe workflow to exfiltrate data. It collects system information, f…
Checkmarx identified roughly 200 malicious NPM packages linked to the crime group LofyGang that abused typosquatting, sub-dependencies, and legitimate cloud services to distribute credential-stealing and Discord-targeted malware. The actors used Discord bots a…
Budworm is resurfacing in the U.S. targeting high-value entities with a mix of malware and openly available tools, including DLL side-loading via legitimate processes and C2 infrastructure hosted on VPS services. The campaign centers on HyperBro, with occasion…
8220 Gang continues to infect misconfigured cloud workloads by exploiting outdated Docker, Apache, WebLogic, and Log4J services and expanding its cryptocurrency-mining botnet. It rotates infrastructure, uses PureCrypter MaaS, and distributes miners via Discord…
Cyble Research & Intelligence Labs (CRIL) uncovered a mass tech support scam ecosystem that uses phishing sites impersonating Microsoft and Apple support to push fake Windows Defender alerts. Victims who contact the fake helplines are then compromised via remo…
WIP19 is a Chinese-speaking threat cluster targeting telecommunications and IT service providers in the Middle East and Asia, using a stolen DEEPSoft certificate to sign multiple malware components. The operation features mature tooling (including SQLMaggie an…
Cisco Talos uncovers a new all-in-one offensive framework, Alchimist, with a GoLang-based C2 and a companion RAT called Insekt that targets Windows, Linux, and Mac, featuring a Chinese web UI and remote administration. The dropper/c2 stack includes MacOSX expl…
Malware is increasingly distributed via ISO files, with multiple families adopting the method. Qakbot has shifted from Excel macros to ISO-based delivery, alongside AsyncRAT, IcedID, and BumbleBee. #Qakbot #ISOFiles
FortiGuard Labs details a Ukrainian-military-themed Excel XLSM document that hides a multi-stage loader which ends with Cobalt Strike Beacon on the victim’s machine. The campaign uses macro-based delivery, obfuscation, shortcut-based execution, and scheduled-t…
Downloader ranked top with 38.2%, followed by info-stealer with 35.1%, ransomware with 14.7%, backdoor with 11.6%, and CoinMiner with 0.4% for the week of September 26th to October 2nd, 2022. Top families included BeamWinHTTP, Smokeloader, Stop Ransomware, Vid…
Attackers increasingly rely on legitimate remote access tools and backdoors to infiltrate networks, move laterally, and harvest data. The article surveys common backdoors, RATs, and remote control tools (e.g., AnyDesk, TeamViewer, ToDesk, AveMaria) used in rea…