In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2505 articles
A Huntress researcher demonstrated how custom Splunk Universal Forwarder configurations can route selected files to an attacker-controlled syslog server for exfiltration, and recommended controls to reduce the risk.
Cisco Talos analyzes Typhon Reborn V2, an information stealer with expanded sandbox and VM evasion, broad data collection, and Telegram-based exfiltration. Samples were observed in the wild, and multiple purchases suggest future use in attacks.
Huntress traced malicious 3CX DesktopApp updates for Windows and macOS through a multi-stage loader to encrypted payloads and command-and-control servers. DPRK attribution remained unconfirmed; users were urged to uninstall the client.
Wiz researchers found that poorly validated multi-tenant Azure AD apps exposed Microsoft applications, including Bing Trivia. They demonstrated search-result manipulation and an XSS attack that accessed Office 365 data from their test account.
Emotet resumed spam operations in March 2023, first using oversized Word documents to evade analysis, then switching to OneNote files that execute VBScript or JavaScript downloaders to install the malware.
Talos details YoroTrooper espionage campaigns active since June 2022, targeting CIS governments and other organizations. The actor used phishing, custom and commodity malware to steal credentials, browser data, screenshots and documents.
ThreatFabric analyzes Xenomorph.C, an Android banking trojan with an Accessibility-powered engine for automated transfers, MFA-code and cookie theft. A test configuration listed more than 400 banking and cryptocurrency targets.
Cisco Talos details Prometei v3 updates observed since November 2022, including a new domain-generation algorithm, self-updating mechanism and bundled web shell. Sinkhole data indicated more than 10,000 infected systems worldwide.
Wiz researchers estimated that an unknown actor compromised at least 10,000 websites, mainly targeting East Asian audiences, and used injected JavaScript to redirect some visitors. The initial access method and the actor’s precise motives remain unknown.
Talos says an unidentified actor used phishing emails and exposed RDP services to deploy MortalKombat ransomware or Laplas Clipper, stealing cryptocurrency. The report links MortalKombat to Xorist and analyzes both malware strains.
Huntress traced activity on two GoAnywhere MFT servers to likely exploitation of a zero-day vulnerability and a DLL resembling Truebot. The intrusion was contained before further activity, with a likely ransomware attempt assessed but not confirmed.
Huntress analysts traced a phishing-delivered maldocx through PowerShell environment-variable persistence, encoded and encrypted scripts, and .NET/RunPE stages to a Cobalt Strike beacon running under Notepad.
Cisco Talos analyzed LNK file metadata to track Qakbot and Gamaredon activity and link Bumblebee with IcedID and Qakbot, showing how metadata can reveal campaign relationships and help defenders improve detection.
ThreatFabric analyzes Hook, an Ermac-based Android banking malware linked to its original author, DukeEugene. It adds remote device control, file access, messaging and location surveillance, alongside banking-fraud capabilities.
Huntress analyzed OWASSRF, a Microsoft Exchange exploit chain involving CVE-2022-41080 and CVE-2022-41082. It demonstrated SYSTEM-level code execution using unprivileged OWA credentials and reported observed post-exploitation activity and detections.
Cisco Talos traces malicious Excel XLL add-ins from early use in 2017 to wider adoption by APT groups and commodity malware, detailing how they execute code and deliver payloads as VBA macro protections expand.
Huntress researchers used Shodan images to examine exposed, unauthenticated VNC systems, finding attempted GandCrab/REvil payload delivery using PowerShell, bitsadmin and FTP, plus a separate unidentified campaign.
Huntress found that Host-header manipulation could make a signed ConnectWise Control installer fetch and run a separate ClickOnce application on on-premises systems. The technique requires user approval and social engineering; cloud instances are not affected.
Wiz disclosed a PostgreSQL privilege-escalation and exposed-credentials chain in IBM Cloud Databases that enabled access to internal build repositories and a potential supply-chain attack path. IBM patched the issues; it reported no indication of further exploitation.
Cisco Talos analyzes altered LodaRAT variants, including removable-drive propagation and changed string decoding, and reports deployments alongside S500, RedLine and Neshta.
Cisco Talos analyzes phishing and malware campaigns using IPFS to host credential-harvesting pages and payloads, including Agent Tesla, reverse shells, destructive malware, and the Hannabi information stealer.
Huntress modified and tested a circulating macOS ransomware script, which creates an encrypted APFS drive, moves files onto it and sends the decryption password to an attacker-controlled machine. The script was last known to work on macOS Monterey.
Huntress researchers chained CVE-2022-36537’s ZK authentication bypass in R1Soft Server Backup Manager SE to root-level RCE and code execution on managed agents. A Feb. 2023 update, citing Fox-IT and SecurityWeek, reports exploitation on hundreds of servers.
Wiz found that attackers who knew a volume’s OCID could attach some OCI storage volumes to instances in another tenant, enabling unauthorized read/write access. Oracle fixed the flaw within 24 hours of being notified; no customer action was required.
