eSentire’s Threat Response Unit tracks a Russian-speaking threat group behind a campaign named Resident, targeting manufacturing, commercial, and healthcare sectors with backdoors, Cobalt Strike loaders, and the Rhadamanthys stealer. The operation spreads via …
Tag: THREAT HUNTING
Microsoft’s guidance explains how CVE-2023-23397 enables a secret Net-NTLMv2 hash leak via Outlook reminders and outlines Forest Blizzard (STRONTIUM), a Russian state-sponsored group linked to GRU Unit 26165, as an actor exploiting this vulnerability to access…
MacOS threat actors are increasingly focusing on data theft rather than ransom, exfiltrating session cookies, keychains, SSH keys, and other sensitive data to monetize or enable espionage. The article outlines where these data assets reside, how attackers acce…
Brute Ratel, a Red Team framework, has been abused by attackers including APT29 to conduct cyber intrusions, with methods such as ISO-delivered LNK files used for DLL sideloading of version.dll. The article also details the framework’s technical underpinnings,…
Bitdefender researchers describe opportunistic threat actors abusing CVE-2021-21974 to target VMware ESXi, leveraging OpenSLP (port 427) for pre-auth remote code execution and deploying ESXiArgs ransomware against VM files. The advisory covers attack patterns,…
CrowdStrike Falcon platform identified a supply chain attack tied to a trojanized Comm100 Live Chat installer, delivering a backdoor via a signed installer. The activity, with a suspected China nexus, involved a second-stage script, loader DLL, and multiple C2…
MuddyWater has maintained a long-term infection campaign targeting Middle East countries since late 2020, with recent samples suggesting it may still be active. The campaign centers on compressed attachments containing Word documents with VBA macros that drop …
Purple Fox malware evolved from an exploit kit used by RIG EK into an independent threat that deploys a multi-stage, stealthy infection chain featuring a rootkit, LOLBIN abuse, and privilege escalation via public CVEs. The analysis maps observed behaviors to M…
Trend Micro’s Threat Hunting team analyzed a series of CMD-based ransomware variants, culminating in YourCyanide, a multi-stage malware that uses layered downloads and heavy obfuscation. The family evolves from GonnaCope through Kekpop and Kekware, employing D…