The Government CSIRT reports an active cyber security incident affecting a government service, attributed to ransomware targeting Microsoft and VMware ESXi servers. The malware encrypts VM-related files (changing them to a .crypt extension) and leaves a ransom…
Zscaler ThreatLabz reveals that Prynt Stealer’s builder contains a secret backdoor that exfiltrates victims’ data to a private Telegram chat watched by the builder’s developers, and that Prynt Stealer, WorldWind, and DarkEye are nearly identical variants. The …
ChromeLoader, also known as Choziosi Loader, has evolved through multiple versions since late 2021, complicating atomic indicator-based detections. The analysis tracks its execution chain from obfuscated PowerShell to a Chrome/Edge/Firefox extension, detailing…
Securonix Threat Labs uncovered a Golang-based GO#WEBBFUSCATOR campaign that leverages a James Webb image and obfuscated Go payloads to infect targets. The attack chain starts with a phishing Office attachment, downloads a malicious template, and uses DNS-base…
Proofpoint’s Threat Research Team links a long-running TA423/Red Ladon espionage operation to a 2022 ScanBox phishing campaign targeting Australian government, offshore energy, and international entities in the South China Sea. The operation impersonates Austr…
AsyncRAT is explored as an open-source remote administration tool that attackers abuse via a fully undetected downloader, delivered from an Amazon S3 bucket and followed by a PowerShell-based second stage. The analysis traces the infection flow from the FUD ba…
PureCrypter is a MaaS-type loader that promotes and downloads other malware families through a two-part downloader/injector architecture, leveraging hundreds of C2s to sustain distribution. It employs image-based masquerading, multiple encoding/encryption sche…
The ASEC analysis team reports the ongoing distribution of malicious Word documents targeting individuals tied to national defense and North Korea, with filenames referencing real people. The embedded macros download PowerShell scripts, collect host informatio…
A Korean-targeted intrusion campaign leveraged FRP-based reverse proxy techniques to gain unauthorized external access to internal networks, often starting with vulnerable IIS or MS Exchange servers. The operation included Webshells (ASPXSpy), privilege escala…
An ASEC analysis outlines a multi-stage malware chain beginning with a VBScript downloader fetched via curl that ultimately fetches and runs a malicious HWP document. The attackers use persistence, dynamic command delivery, and shelling out to remote scripts, …
Mitiga uncovered an advanced business email compromise (BEC) campaign that targets executives via Office 365, combining high-end spear-phishing with adversary-in-the-middle (AiTM) techniques to bypass MFA and achieve persistence. Attackers monitor significant …
BlueSky ransomware is an emerging threat observed since mid-2022 that spreads through trojanized downloads and phishing emails, with rapid encryption and outbound lateral movement in Windows environments. It uses multi-stage PowerShell droppers, SMB-based prop…
Check Point Research uncovered Nitrokod, a Turkish-based crypto-miner campaign that hides malware in legitimate-looking apps like Google Translate Desktop and has infected machines across 11 countries. The operation uses a multi-stage infection chain with long…
Cyble researchers report a threat actor began releasing MiniStealer’s builder and panel for free, with Parrot Stealer allegedly based on MiniStealer. The campaign targets Windows systems and steals data from Chromium-based browsers and FTP applications, signal…
Remcos RAT is a remote access trojan sold by Breaking Security, marketed for legal use but widely used for malicious operations, including the potential to build botnets. It can capture screenshots, log keystrokes, and exfiltrate data to attacker servers, with…