ThreatLabz details a campaign delivering Agent Tesla via a configurable “Quantum Builder,” which creates LNK, HTA, and ISO payloads to execute a multi-stage infection. The campaign uses obfuscated PowerShell, LOLBins, and UAC bypass techniques to obtain admin …
Threat actors increasingly rely on unsigned DLL loading to execute payloads, enabling stealthy operations by abusing signed processes. The investigation highlights Stately Taurus (PKPLUG/Mustang Panda) and Selective Pisces (Lazarus Group) and shows how unsigne…
Mass malicious mailing campaigns are moving toward targeted-style operations, impersonating real companies and delivering malicious attachments. The payload is Agent Tesla, a credential-stealing malware that can exfiltrate data through various channels and per…
NullMixer acts as a dropper delivering a wide range of malware families by redirecting users from cracked software sites through SEO-driven pages. It drops numerous trojans and stealers, including SmokeLoader, RedLine Stealer, PseudoManuscrypt, ColdStealer, an…
Two sentences summarizing the article: ReversingLabs details a malicious npm package masquerading as Material Tailwind that installs via a postinstall script to download a password-protected ZIP containing a Windows executable. The campaign employs obfuscated …
LockBit 3.0 is distributed via phishing emails disguised as job applications, using NSIS installers that deliver a nested payload. It encrypts user files, disables security services, and leaves a ransom note and wallpaper changes, with AhnLab detailing detecti…
Coreid’s ransomware ecosystem continues evolving with Noberus, expanding cross-platform encryption and a growing data-exfiltration focus, supported by Exmatter and credential-stealing tools like Eamfo. Symantec/Sentinel Labs note ongoing affiliate updates and …
Recorded Future analyzes TA413, a Chinese state-sponsored group, detailing campaigns against the Tibetan community and the adoption of new capabilities, including the LOWZERO backdoor and exploitation of zero-days such as CVE-2022-1040 and Follina. The report …
Threat actors targeted GitHub users with a phishing campaign impersonating CircleCI to harvest credentials and 2FA codes, affecting many organizations even though GitHub itself was not breached. Attackers leverage stolen credentials to persist, access private …
May 2022 intrusion used BumbleBee as the initial access vector to deploy Cobalt Strike and Meterpreter across the network. The actors delivered a hidden DLL via an ISO/LNK chain, then moved laterally with RDP/SMB and remote access tools before being evicted; t…
I found a simple batch file (2.bat) that drops a Remcos RAT using an old fodhelper UAC bypass to gain high privileges. The dropper decodes embedded Base64 with certutil, then downloads and launches the malware chain, including a PowerShell-based stage that att…
Domain shadowing is a stealth DNS hijacking technique where attackers create malicious subdomains under compromised domains, leveraging their benign reputation to carry out phishing, malware distribution, and C2 activities. Palo Alto Networks introduces an aut…
Two-sentence analysis of the leaked LockBit 3.0 builder, detailing how it generates RSA keys, embeds resources, and produces encryptor/decryptor payloads, with implications for potential LockBit forks. The piece highlights the tool’s capabilities and mentions …
Magento 2 template attacks now deploy backdoors via injected template code to install a Linux RAT and web backdoors, enabling persistent access and remote command control across potentially multi-node clusters. Variants include 223sam.jpg attack, health_check.…
NFT-001 is a crypto/NFT malware campaign that evolved into a more evasive staged downloader delivering Remcos RAT, with phishing used to lure victims and a multi-stage payload chain designed to bypass defenses. The threat actor relies on private messages, DLL …