Lazarus Group targeted Korea by exploiting the Log4j CVE-2021-44228 vulnerability on unpatched VMware Horizon to install NukeSped and related components. The operation includes NukeSped backdoors, INFOSTEALER, and Jin Miner modules, with data exfiltration and …
Space Pirates is an Asia-rooted advanced threat group whose activities span several backdoors and loaders, targeting government and aerospace/energy sectors in Russia, Georgia, and Mongolia. The report ties Space Pirates to multiple other APTs and tooling exch…
Unit 42 analyzes a multi-stage attack that begins with a malicious Compiled HTML Help (.chm) file delivered inside a 7z archive and culminates with Agent Tesla loading and exfiltrating data via FTP. The operation uses obfuscated JavaScript and PowerShell acros…
FortiGuard Labs reports a Chaos ransomware variant that appears to side with Russia, delivering destructive payloads and offering no decryption option. The malware encrypts small files with AES-256 (RSA-wrapped keys) and fills larger files with random data, wh…
Trend Micro’s Managed XDR investigated a Kingminer botnet attack that targeted an MSSQL server by abusing obfuscated PowerShell and VBScript, leading to a fileless miner deployment. The findings trace the attack chain from initial exploitation through payload …
KurayStealer is a Python-based malware builder that harvests passwords and screenshots and exfiltrates them to Discord via webhooks. The tool is offered in free and VIP versions, with OSINT linking the author to Spain and a presence on YouTube and Discord. #Ku…
Onyx is a ransomware observed in April 2022 that encrypts files, appends the .ampkcz extension, and leaves a readme.txt ransom note. It uses several evasion, persistence, and exfiltration techniques, including process checks, startup-folder modifications, and …
Threat actors lure Germans with updates about the Ukraine crisis via a decoy Baden-Württemberg site, delivering a PowerShell-based RAT that can steal data and execute commands. The operation uses AMSI bypass, creates a persistent scheduled task, and exfiltrate…
Secureworks CTU researchers analyzed COBALT MIRAGE’s ransomware operations in the United States, spotting two intrusion clusters: Cluster A uses BitLocker/DiskCryptor for opportunistic ransomware, while Cluster B pursues targeted intrusions with some ransomwar…
Fortinet FortiGuard Labs uncovered a phishing campaign that delivers three fileless malware families on Windows via a malicious Excel Add-In with VBA macros, leveraging WMI, HTML/JavaScript, and PowerShell to load and execute payloads. The operation uses persi…
Quantum Locker is a fast, human-operated ransomware strain linked to MountLocker that encrypts data within hours of infection, often leaving defenders little time to respond. Cybereason Nocturnus classifies the threat as HIGH, notes a RansomOps playbook, and h…
Two sentences: Researchers observed a rapid exploit campaign against F5 BIG-IP CVE-2022-1388, deploying web shells and Mirai-era malware within days. The events highlight the danger of exposed devices and the need for secure configurations and timely patching.…
TA578, identified by Proofpoint as the threat actor behind the Contact Forms campaign, is pushing ISO files for Bumblebee malware through thread-hijacked emails. The analysis compares two May 2022 infection chains and notes similarities to the Contact Forms op…
On May 4, 2022, F5 released a security advisory for a remote code execution vulnerability in the iControlREST component of its BIG-IP product tracked as CVE-2022-1388. Threat actors can bypass authentication and run arbitrary code on unpatched systems, with ma…
Proofpoint profiles Nerbian RAT, a Go-based malware with aggressive anti-analysis and evasion capabilities that uses COVID-19 themes to lure victims. The attack chain starts with a maldoc phishing email, drops a Go-based loader UpdateUAV.exe, which then retrie…