FortiGuard Labs observed a new DDoS botnet named Enemybot, attributed to Keksec, that borrows code from Gafgyt and Mirai while using obfuscation and a Tor-hidden C2 to complicate takedowns. It targets routers from Seowon Intech and D-Link and leverages a wide …
The ASEC analysis details Excel-based malware campaigns that infect normal Excel files via VBA and can also act as downloaders or perform DNS spoofing. The malware drops components into the Excel startup path to auto-execute on Excel launch, enabling additiona…
SystemBC is a proxy malware that has been used by various attackers for years, functioning as both a proxy bot and a downloader for additional payloads. It has recently been distributed through SmokeLoader and Emotet and has featured in ransomware campaigns, i…
SolarMarker has evolved into a multi-stage threat delivering backdoors and infostealers, primarily via SEO-driven campaigns that lure users to download malicious documents. Itexfiltrates browser data, can transfer files, and executes commands from a C2, while …
A Cofense Phishing Defense Center report details a COVID-19 themed phishing campaign where threat actors impersonate companies to deploy fake COVID-19 forms and harvest credentials via online form builders. The campaign includes compromised sender addresses an…
Trend Micro Threat Research observed active exploitation of CVE-2022-22965 (Spring4Shell) enabling threat actors to weaponize and execute the Mirai botnet. The exploit chain drops Mirai in /tmp, changes permissions, and deploys a JSP web shell to execute comma…
FFDroider is a Windows-based credential and cookie stealer that targets social media platforms by harvesting browser data and using stolen cookies to access accounts. ThreatLabz (Zscaler) details its delivery, obfuscation, registry persistence, C2 communicatio…
Cybereason Nocturnus details a new espionage campaign by APT-C-23 targeting Israeli officials, featuring upgraded malware (Barb(ie) Downloader, BarbWire Backdoor, and VolatileVenom Android implant) and sophisticated social engineering to gain initial access. T…
Cado Labs documents the first publicly-known malware designed to run specifically inside an AWS Lambda environment, named Denonia, which uses DNS over HTTPS for its command-and-control lookups and mines Monero via an embedded XMRig variant. This cloud-focused …
Fortinet FortiGuard Labs analyzes a phishing-driven Remcos RAT campaign that delivers a malicious Excel macro to Windows users, initiating a multi-stage VBS/PowerShell payload chain. The malware uses a decrypted configuration block, process hollowing into RegA…
Parrot TDS is a pervasive traffic direction system that hijacks compromised web servers to deliver malicious campaigns such as FakeUpdate, reaching users worldwide. Avast Threat Labs notes it has been active since October 2021, with hundreds of thousands of us…
CaddyWiper is a Windows wiper that destroys data and wipes drives on Ukrainian infrastructure. It is delivered via Group Policy after compromising Active Directory, and follows WhisperGate, HermeticWiper, and IsaacWiper as the fourth observed in the same perio…
Researchers describe ongoing ISO-based campaigns that deliver AsyncRAT, LimeRAT, and other commodity malware via obfuscated VBScript in a multi-stage infection chain. The campaigns appear tied to a new version of the 3LOSH crypter, which embeds payloads with g…
McAfee Labs reports scammers exploiting Ukraine donation efforts by deploying crypto donation phishing sites and deceptive emails to harvest funds and personal data. The campaigns use fake chat boxes, donation verifiers, and counterfeit logos to appear legitim…
The diary documents a MetaStealer infection chain delivered via malicious Excel attachments that drop and persist a Windows EXE and DLL after macro execution and a VBScript loader. It also notes the malware abusing legitimate services like GitHub and transfer.…