PUP.Optional.AdMax is Malwarebytes’ detection name for a family of browser extensions that are promoted in a deceptive way as ad blockers. Malwarebytes blocks the sites promoting them and provides remediation steps to detect and remove the PUP. #PUP.Optional.A…
Trend Micro’s analysis shows active exploitation of CVE-2022-26134 in Atlassian Confluence servers for cryptocurrency mining and other malware. The attacker uses an OGNL payload to trigger remote code execution, downloads ro.sh and ap.sh scripts, and ultimatel…
Crytox is a multi-stage ransomware that encrypts local and network drives using per-file AES-256 keys protected by a locally generated RSA key, while dropping the uTox messenger to enable victim-actor communication. It employs anti-analysis techniques (packing…
SocGholish is a JavaScript malware framework that uses social engineering toolkits masquerading as software updates to deploy malware on a victim’s system. Threat actors host malicious sites that lure users with fake browser updates, downloading an archive tha…
The FBI and CISA release a Cybersecurity Advisory detailing Iranian state actors, operating as HomeLand Justice, conducting destructive cyber operations against the Government of Albania in July and September 2022, including a year-long intrusion, ransomware-s…
In July 2022, during proactive threat hunting activities at a company in the media industry, Mandiant Managed Defense identified a novel spear phish methodology employed by the threat cluster tracked as UNC4034. Mandiant has identified several overlaps between this group and those we suspect have a North Korea nexus.
UNC4034 established communication…
Threat actors run credential-phishing campaigns that spoof U.S. government departments (DoL, DoC, DoT) to lure victims into submitting credentials via multi-step, convincingly branded PDFs and pages. The campaigns have evolved since 2019, improving email conte…
Fortinet’s Ragnar Locker Ransomware Roundup explains that Ragnar Locker encrypts files, exfiltrates data, and uses double extortion to pressure victims, including negotiations via a Tor-based site and leaking stolen information on a “Wall of Shame.” It also no…
Monster is a Delphi-based ransomware-as-a-service (RaaS) that hides its capabilities and uses configurable features to customize encryption and evasion, raising the risk of attribution confusion. The BlackBerry analysis details its encryption methods, use of I…
Fortinet’s FortiGuard Labs uncovered a Russian-language phishing email designed to deploy the Konni RAT linked to APT37, with persistence and C2 communications. The attack uses a Donbass.zip attachment containing decoy PowerPoint files and a malicious macro ch…
Cyble researchers uncovered a campaign that uses fake Zoom sites to spread Vidar Stealer to Zoom users. The malware drops binaries, injects into MSBuild, and communicates with C2 infrastructure via GitHub-hosted payloads and hardcoded addresses. #VidarStealer …
The blog analyzes three recent honeypot infections attributed to TeamTNT, suggesting renewed activity after their 2021 farewell. It details multiple campaigns (Kangaroo, Cronb, What Will Be) that reuse familiar TeamTNT tools and techniques, including misconfig…
FortiGuard Labs analyzed an Excel document that embeds a randomized payload and exploits CVE-2017-11882 to drop malware on Windows. The analysis traces how the document loads the embedded file, uses a vulnerability to execute code, downloads Formbook/Redline p…
CRIL researchers uncovered a fake Telegram download site that leads Windows users to a malicious MSI installer, which abuses Windows Defender components to operate a remote-access Trojan. The malware uses DLL side-loading, memory injection, and a C2 channel to…
Two sentences summarizing: A self-spreading malware bundle centers on the RedLine stealer, using cheats/cracks ads and YouTube video posts to propagate while stealing browser credentials and other data. The campaign combines loaders, startup persistence, and G…