Fortinet FortiGuard Labs analyzed malicious Microsoft Office documents that abused legitimate sites MediaFire and Blogger to deliver two malware variants: Agent Tesla and njRat (Bladabindi). The operation uses a multi-stage chain—VBA macros, mshta, and PowerSh…
Check Point researchers detail Bumblebee loader’s rapid evolution, shifting delivery formats (ISO and VHD) and its move toward broader victim reach, plus how it loads encrypted configurations and communicates with its C2. They also note payload differences by …
Operation In(ter)ception continues Lazarus’ macOS malware activity, using decoy job postings for Coinbase and Crypto.com to lure victims and install a multi-stage payload. The campaign features persistence via a LaunchAgent, staged download components, and har…
Securonix Threat Labs uncovered a covert campaign targeting military contractors, leveraging sophisticated PowerShell-based stagers, multi-layer obfuscation, and robust C2 infrastructure. The attackers used spearphishing with a .lnk shortcut, extensive anti-an…
Water Labbu is a threat actor that parasitically hijacks scam DApp websites by injecting malicious JavaScript to steal cryptocurrency. The campaign uses injected payloads and delivery servers to obtain wallet permissions and drain USDT balances, disguising act…
DJVU ransomware masquerades as legitimate software or decoy files and often partners with other threats to download information stealers for data exfiltration. It evolved from STOP ransomware, adding obfuscation and a highly flexible infection chain that inclu…
Sygnia attributes Cheerscrypt and Night Sky to the same actor, Emperor Dragonfly, a China-based group that rebrands payloads across campaigns. The investigation shows Emperor Dragonfly deploys Windows and ESXi ransomware, uses open-source Go tools, and conduct…
eSentire’s Threat Response Unit details a Redline Stealer campaign against a manufacturing customer, delivered via a malicious Mozilla Thunderbird setup hosted on a lookalike thunderbiird[.]com and distributed in an ISO. The attacker uses an obfuscated AutoIT …
Bl00dy is a newly discovered ransomware strain that uses double extortion and leaks victim data via Telegram rather than hidden Tor channels. It encrypts files with CryptoAPI, renames them with a .bl00dy extension, drops ransom notes, and propagates laterally …
Symantec details Witchetty’s expanded toolset, including Backdoor.Stegmap and the LookBack backdoor, which use steganography and a GitHub-hosted bitmap loader to hide and deliver payloads. The operation is tied to TA410 and Cicada/APT10, with past and present …
GTSC’s security team documented a 0-day remote code execution vulnerability in Microsoft Exchange being actively exploited in August 2022, leading to webshell deployment, credential dumping, and lateral movement. They provided a temporary, community-focused re…
Part 3 of a four-part series on wiper malware analyzes how input/output controls (IOCTLs) and related Windows kernel interfaces are weaponized to gather disk information, manage disk volumes, and destroy data. It highlights IOCTLs used by DriveSlayer and other…
Void Balaur is a prolific cyber mercenary group expanding its hack-for-hire campaigns globally through 2022, continuing to adapt its operations despite disruptions to its advertising personas. The group targets a broad mix of individuals and organizations, foc…
Unit 42 reveals a polyglot CHM file used to deliver the IcedID information stealer, weaving deception to evade detection by showing a benign decoy window first and launching malicious activity on a second run. The threat chain includes phishing with a ZIP, an …
CRIL researchers traced a malicious domain used in a spear-phishing campaign to steal Office 365 credentials and to host a new information stealer, Doenerium Stealer, which masquerades as legitimate Windows tools and is available on GitHub. The malware exhibit…