Snake Keylogger is a .NET-based malware that focuses on stealing credentials, keystrokes, screenshots, and clipboard data. The article walks through multi-stage unpacking, heavy obfuscation, runtime DLL loading, process hollowing for payload execution, persist…
Researchers tracked the Lazarus group using DLL Side-Loading (T1574.002) to run a malicious DLL via legitimate Windows processes. The attackers staged a backdoor (mi.dll) loaded from the same folder as the host process (wsmprovhost.exe) and used open-source Bu…
Trend Micro researchers document a QAKBOT-driven intrusion that escalates to Brute Ratel C4 and Cobalt Strike payloads attributed to Black Basta operators, highlighting a shift toward commercial C2/attack emulation tools in real-world ransomware campaigns. The…
Security researchers outline detection strategies for the Caffeine phishing service platform, including endpoint and network indicators. They provide YARA rules, domain infrastructure details, and defensive best practices to mitigate PhaaS-based phishing campa…
The article examines how Office CustomXMLParts can secretly store and execute a payload, using a hex-encoded DLL embedded in XML and retrieved via VBA in documents. It shows how a YARA rule and code structure detect and decode the payload, and notes that such …
The article documents BazarCall’s evolution from email bait to phone-based social engineering that prompts victims to download malware, including BazaarLoader and other families such as Trickbot, Gozi IFSB, and IcedID. It outlines a three-phase attack (bait, a…
Cybersecurity analysts from CISA analyzed HyperBro malware samples linked to a Defense Industrial Base incident, detailing a backdoor capable of file transfer, keystroke logging, and remote command execution. The report covers four analyzed files, a C2 endpoin…
CRIL identified a malicious site cloud-spoofer.xyz that redirects users to a Discord channel to buy a FiveM unban spoofer. The tool is modified to download AsyncRAT and a stealer from remote servers, delivering malware to gamers. #CloudSpoofer #FiveM #Discord …
Team Cymru’s Recon/BARS analysis dissects IcedID (BokBot) campaigns from September 2022, shedding light on Stage 1 downloader C2 infrastructure, delivery chains, and victim telemetry to reveal how threat actors evolve infrastructure across campaigns. The post …
CISA’s Malware Analysis Report examines CovalentStealer, a data-exfiltration malware used against a Defense Industrial Base (DIB) organization by suspected APT actors, detailing its file-enumeration, targeting, and upload workflow. The malware leverages embedd…
LockBit 3.0 is distributed via Word documents that masquerade as job applications and trigger malicious macros to deploy encryption. The operation leverages PowerShell, mshta, and VBScript backdoors, with evasion techniques such as renaming components to avoid…
Earth Aughisky (Taidoor) remains a long-running APT, gradually adapting its malware toolkit across Taiwan and Japan. The post catalogs Earth Aughisky’s malware families, their connections to other groups, and potential strategic shifts, highlighting a broader …
BlackBerry Research & Intelligence uncovers a Mustang Panda operation targeting Myanmar that uses PlugX malware delivered via legitimate HP utilities embedded in RAR archives. The campaign employs DLL side-loading and domain-based C2 infrastructure masqueradin…
Researchers from DCSO CyTec uncovered Maggie, a novel backdoor for Microsoft SQL servers hidden as an Extended Stored Procedure DLL called sqlmaggieAntiVirus_64.dll. Maggie runs commands, interacts with files, and can function as a network bridge with a SOCKS5…
Cyble Research and Intelligence Labs (CRIL) tracked phishing campaigns distributing a fake ransomware that does not encrypt files but renames them, drops ransom notes, and threatens payment. The campaign uses masquerading techniques (double extensions like Sex…