Symantec details Cicada (a China-linked APT) widening its espionage activity, targeting governments and NGOs across multiple regions with Exchange server exploits, custom loaders, and backdoors such as Sodamaster and Mimikatz loader, plus tools like VLC and Wi…
FIN7’s intrusion landscape evolves from LOADOUT and GRIFFON in 2020 to POWERPLANT as the main PowerShell-based backdoor in 2021, with BEACON acting as a secondary access path and extensive PowerShell tradecraft continuing to shape their operations. The report …
Colibri Loader is a malware family that delivers and manages payloads onto infected PCs. A new campaign delivers Mars Stealer as the final payload, using a novel persistence technique that combines a scheduled task with PowerShell and a remote template injecti…
Malicious Word documents impersonating AhnLab are being distributed to corporate users to trigger macros. The attack chain downloads a second Word file containing a VBA macro, uses Windows Media Player to auto-run the code, downloads additional payloads, and p…
Morphisec Labs detects a new Remcos Trojan infection chain delivered through financial-themed phishing emails that lure users to open a malicious Excel file. The multi-stage attack uses VBScript and PowerShell to fetch further payloads from a C2, employs persi…
VajraEleph is described as a South Asia-based threat actor linked to state-backed activity, carrying out a nine-month campaign targeting Pakistan and other regional interests. The article outlines the group’s organization, tactics, and multi-stage operations, …
The Stolen Images campaign used IcedID as the initial access vector to drop Cobalt Strike beacons, leading to Conti ransomware deployment across a domain. The operation blended off-the-shelf remote-access tools (Atera, Splashtop), multiple Cobalt Strike server…
A Lazarus threat actor campaign used a Trojanized DeFi application to deliver a full-featured backdoor, targeting cryptocurrency and DeFi services through multi-stage C2 infrastructure hosted on South Korean servers. The backdoor communicates via HTTP with RC4…
Beastmode, a Mirai-based DDoS campaign, rapidly expanded its exploit arsenal in early 2022 by adding multiple TOTOLINK-focused vulnerabilities, enabling broader device infections and botnet growth. The campaign leverages publicly released exploit code, uses shell scripts downloaded via wget, and culminates in a suite of DDoS capabilities; users are urged to update affected firmware. #Beastmode #Totolink
Threat actors run a tax-season phishing campaign impersonating the IRS to trick targets into downloading malware. The attack chain uses an IRS-themed lure, a captcha step, an XLL file, and a ZIP payload that installs Netsupport Manager as a remote access Troja…
Trend Micro’s Managed XDR team uncovered a campaign where SocGholish drops a BLISTER loader that in turn delivers the LockBit ransomware, highlighting layered evasion and loader-to-beacon chaining. The investigation details how these loaders operate together, …
Securonix Threat Labs analyzes a currently unpatched zero-day in Spring Core (Spring4Shell) and its potential for remote code execution, outlining exploit mechanics, scope, and defense. The report covers how the vulnerability differs from Log4j, mitigation/det…
Check Point Research shows how state-sponsored APT groups are exploiting the Russia-Ukraine war to run cyber-espionage campaigns worldwide, using war-themed spear-phishing, decoy documents, and multi-stage payloads against financial, governmental, and energy s…
Talisman is a PlugX variant that loads a modified DLL via a signed benign binary to decrypt and execute a backdoored payload with plug-in capabilities. The campaign is attributed with medium confidence to the Chinese state-backed RedFoxtrot group, targeting So…
A SentinelOne analysis examines Hive Ransomware’s IPfuscation technique, which hides a shellcode payload by encoding ASCII IP addresses that are translated into binary to form the shellcode. The write-up covers IPfuscated, UUIDfuscation, and MACfuscation varia…