Raccoon is an info-stealer malware offered as malware-as-a-service since 2019, capable of stealing passwords, cookies, autofill data, and cryptocurrency wallet data from browsers. The campaign uses phishing campaigns and trusted Windows components to drop, exe…
Browser extensions can be convenient, but many disguise real threats, collecting data, showing affiliate ads, or even stealing credentials. The report documents several malicious and unwanted extension families (WebSearch, DealPly, AddScript, FB Stealer) and e…
UNC3890 is an Iran-linked threat cluster tracked by Mandiant that targets Israeli shipping, government, energy and healthcare organizations using social-engineering lures and watering holes. The operation leverages a backdoor (SUGARUSH), a credential stealer (…
Sonatype uncovered secretslib, a PyPI package that masquerades as a secrets-management library but secretly runs an in-memory Linux cryptominer, a technique used by fileless malware. The incident also involved identity impersonation of a real Argonne National …
Shuckworm (also known as Gamaredon or Armageddon) is a Russia-linked group that has focused on Ukraine since 2014, conducting espionage and information-stealing campaigns. Symantec’s observations detail the infection chain, malware families, and IOCs tied to a…
Cyble Research Labs analyzes Onyx ransomware, a .NET-based threat that uses double extortion, exfiltrating data before encryption and renaming its leak site to VSOP NEWS after a period of inactivity. The analysis highlights its encryption methods (.ampkcz exte…
Cyble Research Labs uncovered MikuBot, a new Windows botnet that steals data and runs hidden HVNC sessions for remote access, with USB propagation and the ability to download and execute additional malware. The actor markets MikuBot with a panel, uses encrypti…
Iron Tiger’s operation against Mimi chat installers shows a supply chain compromise delivering HyperBro on Windows and rshell on macOS/Linux across multiple targets. The campaign spans three major platforms, uses code obfuscation, and establishes C2 communicat…
Conti Group, a globally renowned ransomware operation, has recently targeted high-value sectors by exploiting Exchange vulnerabilities to launch targeted campaigns against affluent firms. The report also covers BruteSql Group and links to Conti activity, inclu…
Trend Micro tracks CopperStealer’s new campaign, which distributes a malicious Chromium-based browser extension to steal cryptocurrencies and wallet keys. The operation uses a multi-stage dropper, heavy JavaScript obfuscation, and browser-configuration manipul…
Cyble researchers uncovered a phishing site impersonating Lindesbergs Kommun that delivers Typhon Stealer via a crafted .lnk file and PowerShell to download the payload. The stealer harvests data from browsers, wallets, gaming apps, and messaging tools, with e…
Attackers distribute XMRig Monero CoinMiner via Korean webhards by disguising the miner as a game installer and bundling it with cracked software. The payload downloads xmrig.exe, config.json, and MsDtsServer.exe, installs a startup shortcut for persistence, a…
Raspberry Robin is a worm that spreads via infected external disks and downloads its payload through msiexec from QNAP cloud accounts, using TOR for its C2 channel. It executes payloads via system binaries (rundll32.exe, shell32.dll) and elevates with fodhelpe…
ThreatLabz analyzes a large-scale AitM phishing campaign targeting enterprise Gmail/G Suite users, showing strong overlap with a prior Microsoft email-targeted attack. The operation used multi-stage URL redirection, client-side fingerprinting, and MFA-bypass c…
DeathStalker’s VileRAT campaign targets foreign exchange and cryptocurrency venues with a multi-stage infection chain, involving spearphishing, DOTM remote templates, VBA macro stomping, VileDropper and VileLoader loaders, and a Python-based VileRAT. The repor…