In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2504 articles
Huntress describes Raspberry Robin’s USB-based infection chain, command variations, and RunOnce persistence, drawing on an August 2023 infection attempt that Microsoft Defender detected and removed before it completed.
Wiz Research analyzed seven cloud cryptomining incidents from summer 2023, tracing access through exposed Jupyter notebooks and vulnerable Apache Solr and documenting miners, persistence, spreading, and detection opportunities.
Talos found that .kids allowed registration of a controlled-interruption name used by SCCM clients, while several other domains return DNS records for nonexistent names, creating risks including misdirected email.
Talos details a Lazarus Group campaign exploiting a ManageEngine ServiceDesk vulnerability and reusing infrastructure to deploy CollectionRAT, DeimosC2 on Linux, and a malicious Plink tool.
Cisco Talos reports that Lazarus exploited ManageEngine ServiceDesk CVE-2022-47966 to compromise a European internet backbone provider and deploy QuiteRAT, a compact Qt-based remote access trojan related to MagicRAT.
Huntress traced a likely phishing infection from a tax-themed archive and Windows shortcut to an XWorm loader. The attack used a decoy W-2 PDF while downloading and launching malware, which established persistence with a scheduled task.
Huntress traced a week of activity indicative of an INC ransomware attack, from compromised-account RDP access and data staging to lateral movement and attempted encryption. The initial access method was undetermined.
Cisco Talos analyzed a Yashma ransomware campaign active since at least June 2023. The customized variant downloads ransom notes from GitHub, mimics WannaCry, persists through a startup-folder URL file, and wipes original files after encryption.
Huntress describes a BEC attack in which a compromised Azure administrator reset passwords, created additional admin accounts, and accessed multiple Microsoft 365 inboxes. The organization regained control after remediation.
Wiz researchers found Storm-0558’s compromised Microsoft key could have enabled forged tokens for more Azure applications than initially disclosed. Microsoft revoked the key, but detection remains difficult because many applications lack detailed logs.
Cisco Talos analyzed campaigns targeting government, military, business, and civilian users in Ukraine and Poland. Malicious Office files launch downloaders that extract payloads hidden in images, including AgentTesla, Cobalt Strike, and njRAT.
Huntress says it detected and stopped a suspected BEC attack on a U.S. logistics company, where an intruder used Microsoft 365 inbox rules to hide vendor emails and redirect payment discussions.
Wiz reports nearly 200 instances of PyLoose, a fileless attack that used exposed Jupyter Notebook services to run an XMRig miner in cloud workloads. The Python script loaded the miner into memory using Linux memfd.
ThreatFabric describes Letscall, a three-stage Android malware toolset targeting South Koreans. It steals personal data, enables spyware and call interception, and connects victims with criminal call operators through VoIP.
ThreatFabric reports Anatsa dropper campaigns on Google Play with over 30,000 installations, targeting banks in the US, UK and DACH. The Trojan steals financial data and enables device-takeover fraud.
Wiz assesses managed Kubernetes middleware in AKS, EKS and GKE, finding risky host access and describing privilege-escalation paths through Node Problem Detector and Fluent Bit, alongside mitigations and gaps in standard controls.
Cisco Talos detailed a campaign targeting Spanish-speaking users in the Americas that uses phishing, PowerShell, and DLL sideloading to deploy Horabot, a banking trojan, and a spam tool.
Huntress reconstructed exploitation of MOVEit Transfer’s SQL injection flaw, showing how it could lead to arbitrary code execution. The article details observed artifacts, hunting guidance and patches; Microsoft attributed the threat to Lace Tempest.
Huntress traced XMRig infections on multiple endpoints to TeamViewer access, followed by PowerShell scripts that downloaded and installed the miner. The team alerted affected customers and added detections.
Cisco Talos analyzes Intellexa’s Android spyware components ALIEN and PREDATOR, describing how they work together to evade Android protections, execute code, record audio, and collect device data.
Cisco Talos reports that RA Group, active since April 2023, used ransomware derived from leaked Babuk source code in attacks on organizations in the U.S. and South Korea, combining file encryption with threats to leak stolen data.
Huntress details active exploitation of PaperCut MF/NG flaws CVE-2023-27351 and CVE-2023-27350, explaining an authentication-bypass-to-SYSTEM RCE chain and observed post-exploitation payloads, including RMM tools and a crypto miner; it urges patching.
Wiz researchers chained container isolation flaws and excessive permissions in two Alibaba Cloud PostgreSQL services, exposing potential cross-tenant access and supply-chain attacks. Alibaba says all issues were mitigated and no customer data was compromised.
A Huntress researcher demonstrated how custom Splunk Universal Forwarder configurations can route selected files to an attacker-controlled syslog server for exfiltration, and recommended controls to reduce the risk.
