ThreatLabz reports an update to the Ares banking trojan that adds a domain generation algorithm (DGA) mirroring Qakbot’s DGA, likely to extend infection lifetimes and monetize compromised systems. The update includes C2 fallback via DGA, web inject testing, an…
Wordfence alerted to an actively exploited zero-day vulnerability in BackupBuddy that allowed unauthenticated file downloads from WordPress sites. Nearly 5 million attacks were blocked since August 26, 2022, and a patched version 8.7.5 was released on Septembe…
Joint FBI/CISA/MS-ISAC advisory details Vice Society’s ransomware operations, highlighting their methods, IOCs, and recommended mitigations for education-sector defenders. It notes that Vice Society uses variants such as Hello Kitty/Five Hands and Zeppelin and…
Play is a new ransomware family that mirrors Hive and Nokoyawa, suggesting shared operators and attack infrastructure. It differentiates itself with AdFind-based Active Directory discovery and a blend of LOLBins, GPO-based deployment, and double-extortion tech…
Avast Threat Labs details Bobik, a .NET Remote Access Trojan that now functions as a DDoS module within a botnet used by the pro-Russian group NoName057(16) to target Ukraine and nearby countries. The report maps the botnet’s C2 infrastructure, the multi-stage…
DangerousSavanna is a two-year campaign targeting financial institutions in French-speaking Africa, employing spear-phishing and a diverse set of infection chains to deploy PoshC2 and AsyncRAT. The operation features evolving lures, modular payloads, and exten…
Cyble Research and Intelligence Labs (CRIL) detected active PowerShell Empire infrastructure being used in the wild, including multiple infections and post-exploitation activities leveraging the Empire framework. The article details Empire’s listener/stager/ag…
IBM X-Force/MDR analysis connects Raspberry Robin infections with the Dridex malware and the Russia-based Evil Corp, revealing shared loader structures, anti-analysis techniques, and a workflow that leverages USB-based initial access. The report traces the inf…
BianLian emerged as a relatively new ransomware actor deploying Go-based malware and using LOL (Living off the Land) techniques to move laterally while evading EDR during encryption. They exploited initial access vectors like ProxyShell and SonicWall VPNs, rap…
SafeBreach Labs uncovered a new targeted remote access Trojan named CodeRAT that targets Farsi-speaking developers using a Word document with a DDE exploit. It features a versatile command set, uses Telegram bot API for C2 and public file-upload services for e…
ASEC researchers identified a malicious HWP document that exploits OLE objects and a Flash vulnerability (CVE-2018-15982), using embedded links to trigger execution. The attack drops files in %TEMP%, hides OLE objects, and can download and run additional paylo…
EvilProxy is a productized phishing service on the dark web that enables MFA bypass via reverse proxy and session cookie theft, expanding attacks against mainstream online services and software supply chains. It targets developers and end-users with campaigns …
BumbleBee is described as a refactored, modular backdoor evolved from BookWorm, featuring a two-app architecture (server/controller and client/slave) with layered deployment and a loader chain that uses a legitimate executable to run shellcode. The campaign ap…
Magecart threat actors target Magento-based online stores by injecting JavaScript skimmers into checkout pages to steal payment data. The skimmer loads an overlay form from an embedded JS file, collects card details and personal information, obfuscates and exf…
Bitdefender’s deep-dive analyzes a corporate espionage operation targeting a small U.S. technology company, detailing how initial access was gained through an unpatched internet-facing vulnerability and how attackers staged months of data exfiltration. The ope…