Publicly available Slam Ransomware Builder lowers the barrier to entry for cybercriminals by offering free tooling, while presenting credible threats to enterprises. The article details Slam’s features, capabilities, and indicators of compromise to help defend…
Insikt Group profiles UAC-0113 infrastructure linked with Sandworm, highlighting ongoing Ukrainian targeting and the use of dynamic DNS masquerades as Ukrainian telecom providers to host C2 and payload delivery. The analysis shows a shift from DarkCrystal to C…
Symantec observes Webworm using customized versions of three older RATs (Trochilus, Gh0st RAT, and 9002 RAT) with decoy documents and loaders, in attacks linked to the Space Pirates group and aimed at government and IT/service targets across Asia. The activity…
A Word OOXML document (docx) is used as a downloader by embedding a frameset that loads a second-stage payload when opened. The phishing sample “Order Confirmation 22839.docx” first delivers a malicious RTF (“92.doc”) which downloads the final malware, the Red…
IRGC-affiliated cyber actors exploited known Fortinet FortiOS and Microsoft Exchange vulnerabilities, plus VMware Horizon Log4j flaws, to gain initial access and conduct ransomware-like operations involving data encryption and data extortion. The advisory outl…
Malvertising on the Microsoft Edge News Feed redirects users to tech support scam pages via the Taboola ad network. The operation uses a cloud-based infrastructure and fingerprinting to target victims while avoiding bots or blocks. #Taboola #EdgeNewsFeed #brow…
Attackers continue to abuse Google Sites and Microsoft Azure Web Apps to host cryptocurrency phishing campaigns targeting major wallets and exchanges, with new pages and targets emerging over time. The operation relies on two stages—SEO-driven first pages and …
SEKOIA analysts document PrivateLoader as a modular downloader that operatess within the ruzki Pay-Per-Install (PPI) service to download and execute multiple payloads, enabling broad distribution of malware. The report links PrivateLoader to ruzki’s PPI ecosys…
Cisco Talos reports a new Gamaredon APT campaign targeting Ukrainian government entities, leveraging spear-phishing with Russian invasion-themed Office documents and malicious VBScript macros to seed infection. The operation uses a multi-stage chain (LNK in RA…
Cyble researchers uncovered a tax-refund phishing campaign targeting Greek banking users that uses a JavaScript keylogger to capture credentials entered on a fake government-site. The attackers redirect victims to fake net banking login UIs for several banks, …
Cybereason GSOC analysts detail a technique that uses Notepad++ plugins to persist and evade security controls, including how a malicious DLL is injected via the plugin loading process and how PowerShell and Meterpreter are used to establish C2. The report als…
Cyble researchers uncovered a phishing campaign impersonating Japan’s National Tax Agency to steal V-Preca card details from Japanese taxpayers, combining fake NTA sites, smishing, and Android malware (FakeCop) with extensive C2 infrastructure. The operation e…
OriginLogger is a variant of the Agent Tesla keylogger and represents its successor with new configuration handling and deployment methods. The analysis covers its builder, string obfuscation, dropper workflow, and multi-channel exfiltration infrastructure, ty…
Secureworks CTU analyzed a June 2022 ransomware incident involving the Iranian COBALT MIRAGE group, highlighting continued use of known TTPs. The operation deployed ProxyShell exploits, web shells, and TunnelFish, encrypted servers with BitLocker, and left tra…
Trend Micro analyzed post-exploitation activity abusing CVE-2020-14882 WebLogic vulnerability to deploy Kinsing cryptocurrency-mining malware. The report details how Trend Micro Vision One and Cloud One Workload Security detected, blocked, and traced the attac…