Fortinet FortiEDR uncovered a Moses Staff campaign targeting Israeli organizations, leveraging ProxyShell exploits to deploy web shells and a multi-component backdoor for espionage, data exfiltration, and payload delivery. The operation includes a loader that …
Remcos RAT was delivered via a phishing email that attached a double-compressed archive, then unpacked to reveal an obfuscated VBScript dropper. The dropper uses a COM object (MSXML2.XMLHTTP.3.0) to fetch a Powershell-based payload and culminates in a Remcos p…
ModifiedElephant is a decade-long threat actor targeting India-based human rights activists, defenders, academics, and lawyers to plant incriminating digital evidence for arrests. The group relies on spearphishing with publicly available remote access trojans …
ShadowPad is an advanced modular RAT deployed by Chinese government–sponsored actors since at least 2017, with broader activity by MSS and PLA-linked groups globally since 2019. CTU analysis shows ShadowPad uses in-memory decryption, DLL loaders sideloaded by …
GlowSpark is a multi-stage maldoc campaign linked to Actinium, using legitimate-looking documents and targeted delivery to infect Ukrainian/Eastern European targets. The operation relies on obfuscated Visual Basic scripts, sandbox evasion, and selectively deli…
Unit 42 outlines a renewed Emotet infection method that uses an Excel 4.0 macro in a phishing email to stage PowerShell payloads and finally deliver the Emotet binary. The approach relies on obfuscated macros, a highly obfuscated HTML application, and multiple…
FortiGuard Labs details an NFT-themed lure that hides a BitRAT infection in an Excel XLSM file, downloaded via Discord and executed through a malicious macro. The malware chain includes batch and PowerShell steps, a .NET downloader, DLL injection, persistence,…
Picus Security analyzes LockBit 2.0 ransomware, detailing its evolution as a RaaS operator, its anti-detection techniques, and its methods to disrupt victim recovery and logging. The post also lists IOCs and maps LockBit 2.0 behaviors to MITRE ATT&CK technique…
Proofpoint details TA2541, a persistent cybercrime actor targeting aviation, aerospace, transportation, manufacturing, and defense sectors since 2017, primarily deploying remote access trojans (RATs) such as AsyncRAT. The group uses aviation- and travel-themed…
Sansec tracked a mass Magento 1 compromise affecting hundreds of stores, with about 374 stores infected in a single day as part of a broader breach impacting 500+ shops. Attackers loaded a payment skimmer from naturalfreshmall.com and left numerous backdoors a…
Check Point Research analyzes TrickBot’s modular architecture and anti-analysis techniques, highlighting how TrickBot targeted customers of 60 high-profile financial and tech companies using web-injects and credential theft. The article describes key modules l…
Researchers link VBA-based samples to threat actors in South Asia, showing code reuse across groups such as Transparent Tribe, SideCopy, Donot, and Hangover through final payloads like CrimsonRAT and ObliqueRAT. The findings emphasize shared VBA patterns, cros…
Lorenz ransomware has evolved with customized attacks against organizations worldwide, often demanding large ransom fees. Cybereason links Lorenz to ThunderCrypt and notes that while a No More Ransom decryptor exists, it is limited and often ineffective. #Lore…
TA402, a Palestinian-aligned APT, has deployed NimbleMamba, a new implant intended to replace LastConn, in targeted Middle East campaigns. The operation blends geofenced links, actor-controlled domains, and Dropbox-based C2/exfiltration with redirects to legit…
SolarMarker is a .NET information stealer and backdoor distributed via novel MSI installers and PowerShell-based deployment. SophosLabs describes how the campaign used SEO poisoning, deceptive web pages, and a multi-stage redirect and persistence technique to …