An analyst investigates whether 64-bit malware is becoming more common by analyzing 217GB of ZIP archives from MalwareBazaar, applying YARA to differentiate 32-bit and 64-bit PE files. The study finds a rising but still-small share of 64-bit samples and highli…
Security researchers describe a phishing campaign attributed to 0ktapus that targets Okta identity credentials, using a large set of look-alike domains to harvest user data. The article catalogs hundreds of IPs and domains used in the campaign’s infrastructure…
Qbot (QakBot) infections surged in 2022, with Trellix SecOps documenting its evolving delivery vectors and detection strategies to outpace defenses. The post details Qbot’s infection chain, MITRE technique mappings, IOCs, and Trellix detection/hunting guidance…
IronDefense documented a unique Black Hat NOC environment where real malware activity and classroom demos co-exist, revealing notable infections like SHARPEXT, Shlayer, and NetSupport RAT. The findings highlight the challenges of defending a highly segmented, …
A Go-written ransomware named Agenda targets healthcare and education organizations in Asia and Africa, customizing payloads per victim with unique IDs and leaked credentials. It can reboot in safe mode, terminate server-related processes, and uses affiliate-s…
BleachGap is a single-executable ransomware variant analyzed by K7 Labs that functions as a stealer and encryptor, using in-memory encoding to evade detection and exfiltrates data to a Discord webhook. The campaign includes disabling security tools, enumeratin…
Cyble Research Labs analyzed a targeted .NET-based ransomware variant named Moisha, linked to the PT_MOISHA team. Moisha uses double-extortion to exfiltrate and encrypt data, while disabling defenses and threatening data leakage if payment isn’t made. #Moisha …
Threat actors abuse a compromised Microsoft Dynamics 365 Customer Voice account to send spoofed eFax notifications and lure recipients into credential phishing. The campaign spreads broadly across sectors by leveraging a legitimate service to host a fake eFax/…
Researchers analyze mhyprot2.sys, a vulnerable Genshin Impact anti-cheat driver, showing how a ransomware actor weaponizes it to bypass privileges and terminate antivirus processes. The case highlights how legitimate drivers can be abused for privilege escalat…
A phishing campaign spreading the AgentTesla information stealer targets businesses worldwide by sending spoofed emails with malicious disk images (.IMG/.ISO) named “Draft Contract”; the attack harvests browser and email credentials and other system data. A Po…
Kimsuky’s GoldDragon cluster is a multi-stage operation targeting Korea-related entities, evolving rapidly with new infection chains and a layered C2 network. The campaign starts with spear-phishing and uses HTML Application (HTA), VBScript, and mshta to fetch…
Threat actors distributing infostealers are gaining momentum by targeting victims seeking to illegally download pirated software. The analysis covers two infection chains—Case 1 with RedLine Stealer and Case 2 with RecordBreaker Stealer—highlighting evasion te…
Two sentences summarizing: U.S. CISA and MS-ISAC warn that multiple CVEs in Zimbra Collaboration Suite are being actively exploited in government and private networks, with attackers able to gain access and maintain persistence. The advisory provides patch gui…
Part 2 of the wiper series explains how threat actors exploit legitimate third-party kernel drivers to bypass detection and perform disk wiping in kernel space, focusing on ElRawDisk and EPMNTDRV. It also covers how these drivers are loaded (via Service Contro…
Attack activity targeting Ukrainian .ua domains has risen, with a wide range of attack types observed and a shift toward broad automated exploit attempts. The findings detail top vectors such as malicious IPs, malicious user-agents, and attempts to upload or d…