Symantec details a new espionage campaign targeting Asian governments that uses DLL side-loading of legitimate software to load payloads, followed by credential theft and network-wide movement with a wide toolkit. The activity, spanning April–July 2022, hit a …
Arctic Wolf Labs analyzed a Lorenz ransomware intrusion that exploited CVE-2022-29499 on a Mitel MiVoice Connect appliance to gain initial access and deploy encryption with BitLocker. The attackers used LOLBins, Chisel tunneling, and FileZilla for data exfiltr…
Researchers at ESET identified a Linux variant of the SideWalk backdoor used by SparklingGoblin against a Hong Kong university in February 2021, and found close ties to Specter RAT and Windows SideWalk variants. The campaign reveals shared C2 infrastructure, C…
Cisco Talos reports Lazarus Group’s global campaign exploiting VMware Horizon vulnerabilities to gain long-term access to energy-sector targets, deploying VSingle, YamaBot, and the newly described MagicRAT implants. The activity shows post-exploitation, latera…
The article examines how third-party software can store credentials insecurely and how attackers can retrieve them to broaden access, with concrete examples across WinSCP, Git, RDCMan, OpenVPN, and various browsers. It also discusses protections in Cortex XDR …
Lampion, a banking Trojan, was analyzed as delivered through a phishing email that directs victims to a cloud-based link to obtain a ZIP file. The campaign uses a VBScript loader and WScript to fetch DLL payloads, which are injected into memory to steal bankin…
May 2022 saw an Emotet-driven intrusion that began with a phishing Excel document and culminated in a domain-wide compromise, Cobalt Strike beaconing, lateral movement, and data exfiltration via Rclone. Emotet has since resurfaced (with TrickBot support) and r…
TA453, an Iran-aligned actor, expanded its social engineering with Multi-Persona Impersonation (MPI), using multiple actor-controlled personas within a single email thread to boost campaign credibility. The technique targets researchers and nuclear security do…
PlugX is a long-running, modular RAT used by Asia-based threat actors like APT27, featuring a loader that combines a legitimate executable, a malicious module, and a malicious payload. The report traces six loader samples from 2012–2022, detailing DLL side-loa…
Cisco Talos identifies a new Lazarus Group remote access trojan named MagicRAT, deployed after exploiting publicly exposed VMware Horizon platforms. The malware, linked to TigerRAT and Lazarus infrastructure, includes persistence, reconnaissance, and the hosti…
Cyble Research & Intelligence Labs (CRIL) detail a Bumblebee loader infection chain circulated via spam campaigns and used as a downloader for post-exploitation frameworks. The chain starts with a password-protected VHD containing a LNK that runs a PowerShell-…
Monti ransomware gang emerged during a July 2022 incident, encrypting 21 servers after exploiting Log4Shell in a VMware Horizon setup and leveraging both traditional Conti-like TTPs and new tooling. The operation highlighted Monti’s mimicry of Conti, its use o…
Bronze President targeted government officials using PlugX payloads across multiple documents and delivery methods. The campaign involved malicious archives, shortcuts, DLLs, and encrypted payloads linked to PlugX, with identified C2 servers associated to the …
The article documents a rising ransomware trend called intermittent encryption, where attackers partially encrypt files to speed up infection and evade detection. It reviews several families adopting this approach (Qyick, Agenda, BlackCat/ALPHV, PLAY, Black Ba…
Unit 42 researchers describe MooBot, a Mirai variant, that leverages four D-Link vulnerabilities to seize control of exposed devices and deploy a botnet for DDoS attacks. The campaign downloads MooBot from a remote host, communicates with a C2 server, and incl…