Trustwave SpiderLabs observes HTML file attachments being used prominently in phishing spam, with HTML/HTM collectively accounting for about 14.09% of attachments, second only to EXE files. The report describes how these HTML attachments mimic sign-in pages an…
FortiGuard Labs analyzed an Excel document delivering Redline malware via CVE-2017-11882. The loader uses in-memory techniques and persistence via Task Scheduler to exfiltrate sensitive data to a C2 server over HTTP using a WCF SOAP channel. Hashtags: #Redline…
OnionPoison spreads a malicious Tor Browser installer via a popular Chinese YouTube channel, luring targets to download a compromised, less-private Tor variant. The malware collects sensitive data, can run shell commands, and communicates with a C2 using encry…
eSentire has observed a significant rise in SolarMarker infections delivered via drive-by download attacks that rely on social engineering to persuade users to execute malware disguised as document templates. SolarMarker is a modular information-stealing malwa…
Researchers analyzed a Go-based BlackByte variant and uncovered an advanced technique to bypass security products by abusing a legitimate but vulnerable driver (RTCore64.sys) to disable protection. The technique, a “Bring Your Own [Vulnerable] Driver” approach…
Fortinet FortiGuard Labs analyzes phishing-driven malware campaigns in Q3 2022, highlighting the use of HTML Smuggling, Excel 4.0 macros, Word VBA macros, and ISO image delivery to drop Emotet, Qbot, and Icedid. The report details multiple delivery chains and …
Researchers built a sinkhole for PseudoManuscrypt and mapped its infections by analyzing a custom UDP/TCP C2 protocol layered over KCP, including how L1/L2 messages are structured and parsed. The work reveals extensive domain-based C2 activity and a rapid botn…
LilithBot is a multifunction malware sold as Malware-as-a-Service by the Eternity group, distributed through Telegram and Tor, with modules for botnet operations, stealer, clipper, miner, and more. The campaign showcases evolving features, including anti-debug…
As endpoint detection and response (EDR) solutions improve malware detection efficacy on Windows systems, certain state-sponsored threat actors have shifted to developing and deploying malware on systems that do not generally support EDR such as network appliances, SAN arrays, and VMware ESXi servers.Earlier this year, Mandiant identified a novel malware ecosystem…
Avast released a MafiaWare666 ransomware decryptor tool for variants such as JCrypt and BrutusptCrypt. The ransomware encrypts files in user folders using AES, adds new extensions, and Avast’s decryptor guides victims through recovering their data, sometimes l…
Black Lotus Labs analyzed ~100 Go-based Chaos samples and found a cross‑platform, multi‑architecture botnet that persists, beacons to TLS C2s, steals or brute‑forces SSH credentials, exploits CVEs to propagate, and can run additional modules for DDoS and crypt…
New findings by R3D, with technical support from the Citizen Lab, document Pegasus infections of Mexican journalists and a human rights defender between 2019 and 2021, including an infection of opposition politician Agustín Basave Alanís in 2021. The report sh…
ESET researchers uncovered Lazarus APT campaigns in autumn 2021 that used Amazon-themed documents to target a Netherlands aerospace employee and a Belgian journalist, with data exfiltration as the goal. The operation combined multiple tools, including the BLIN…
CrowdStrike Falcon platform identified a supply chain attack tied to a trojanized Comm100 Live Chat installer, delivering a backdoor via a signed installer. The activity, with a suspected China nexus, involved a second-stage script, loader DLL, and multiple C2…
DeftTorero (Lebanese Cedar/Volatile Cedar) activity from late 2019 to mid-2021 shows a shift toward fileless/LOLBIN techniques and the use of public/offensive tooling to blend in with normal activity. The report details initial access via web shells (Caterpill…