In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2503 articles
Huntress analysts correlated Defender, PowerShell, Exchange, and web-server logs to investigate commands sent to an unpatched Exchange endpoint. The activity appeared consistent with a scan; Defender remediated the commands, and the customer was urged to update.
The article analyzes how compromised IAM identities could gain EKS access and escalate privileges, and demonstrates intercepting Pod Identity tokens and temporary credentials from a host-network pod to access cloud resources.
Hunt IO researchers identified 30+ servers linked to suspected ShadowPad activity using certificates spoofing Dell. Twelve exposed HTTP on port 53; researchers also noted impersonating domains and possible infrastructure clusters.
Wiz analyzes Microsoft’s Midnight Blizzard breach, outlining a likely OAuth-permission abuse chain from a password-sprayed, MFA-less test account to corporate mailbox access, plus Entra ID hunting queries and mitigation advice.
Cisco Talos details a campaign active since at least 2021 that used the Zardoor backdoor, Windows utilities and reverse-proxy tools to maintain access to a Saudi Islamic nonprofit and periodically exfiltrate data.
Huntress analysts found files extracted from an MSSQL database, including scripts intended to create accounts and launch remote-access and tunneling tools. They found no evidence the files ran before the customer was notified and the issue addressed.
Huntress analysts traced ransomware attempts on two endpoints to TeamViewer access. A batch file launched a DLL-based payload; security software blocked further attempts on one endpoint, and activity remained limited to the affected machines.
ThreatFabric analyzes an updated Chameleon banking trojan distributed via Zombinder. The malware targets Android users, including in the UK and Italy, and can interrupt biometric prompts, prompt users to enable accessibility, and support device takeover.
Huntress analysts reconstructed an intrusion involving brief TeamViewer access, curl downloads, Dokan driver use, PowerShell data collection, and data exfiltration. They could not determine whether the actor dumped credentials.
Cisco Talos details Lazarus’s Operation Blacksmith campaign, which exploited Log4Shell on exposed VMware Horizon servers and deployed three DLang malware families, including NineRAT, which uses Telegram for command and control.
Cisco Talos details a campaign targeting Uzbekistan’s Ministry of Foreign Affairs and users in South Korea with SugarGh0st, a customized Gh0st RAT variant delivered through malicious Windows shortcuts and JavaScript.
Huntress analysts observed an attacker use finger.exe on an MS Exchange server to download a file and send directory and process names to a remote endpoint over unencrypted TCP port 79.
Huntress traced unauthorized access on two healthcare-sector Windows servers to shared ScreenConnect access, followed by additional remote tools, payload delivery, reconnaissance and account creation. It could not determine whether the pharmaceutical vendor was breached
Huntress reports active exploitation of Confluence CVE-2023-22518 by Nov. 3, 2023, followed by PowerShell-delivered Cerber ransomware. It explains the vulnerable restore endpoint and recommends patching, reducing exposure, and defense in depth.
ThreatFabric reports that SecuriDropper uses session-based package installation to bypass Android 13 Restricted Settings and deliver SpyNote spyware and banking trojans, including Ermac. Researchers say they cannot confirm a direct link to Zombinder.
Cisco Talos details an Arid Viper campaign targeting Arabic-speaking Android users with spyware disguised as dating-app updates. The malware can suppress security notifications, steal sensitive data, and install additional malicious apps.
Hunt describes two open-directory malware delivery cases: one involving AsyncRAT and BITS, and another using a Python executable and Fernet-encrypted shellcode detected as Cobalt Strike-related.
Talos links YoroTrooper to likely Kazakhstan-based operators who disguise activity as Azerbaijani and target CIS governments. The group uses credential-harvesting phishing, compromised websites, and evolving custom implants across several programming languages.
Talos links a campaign active since early August 2023 to Qakbot affiliates, who used phishing to deliver Ransom Knight ransomware and Remcos. The activity continued after the FBI seized Qakbot infrastructure, which Talos says may have affected C2 servers but not spam.
ThreatFabric researchers linked Android DragonEgg to LightSpy and analyzed its modular spyware, finding capabilities to steal private data, track precise locations, record calls and extract WeChat Pay transaction history.
Huntress analyzed intrusions across multiple organizations involving possible NetScaler exploitation, phishing, and social engineering. It detailed shared post-compromise techniques but could not determine the attackers’ goals or conclusively link the activity to a past
ThreatFabric analyzed a Xenomorph campaign distributed through phishing pages posing as Chrome updates. It targets over 100 banking and crypto apps, with more than 3,000 downloads in Spain and additional activity in the US and Portugal.
Cisco Talos attributes HTTPSnoop and PipeSnoop backdoors to a new intrusion set targeting Middle East telecoms. The implants masquerade as security software and use HTTP(S) requests or named pipes to deliver and execute shellcode.
Huntress describes Raspberry Robin’s USB-based infection chain, command variations, and RunOnce persistence, drawing on an August 2023 infection attempt that Microsoft Defender detected and removed before it completed.
