In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2508 articles
Cisco Talos details SQUIRRELWAFFLE malspam campaigns that use stolen email threads and malicious Office documents to infect systems, then deliver Qakbot or Cobalt Strike. The article analyzes the loader, C2, and evasion methods.
Cisco Talos details a campaign targeting Afghan and Indian entities with malicious documents exploiting CVE-2017-11882, custom document infectors, and RATs including dcRAT, QuasarRAT and AndroRAT.
Talos found a fake Amnesty International site offering anti-Pegasus software that installs Sarwent RAT, enabling remote access, command execution and data theft. The actor’s identity and motives remain uncertain.
Cisco Talos details a campaign targeting Indian government and military personnel with phishing lures, malicious archives, and compromised websites to deliver Netwire and Warzone RATs, with file-enumeration tools also observed.
Talos linked aviation-themed campaigns using AsyncRAT and njRAT to an actor active since at least 2013, tracing domains, handles, crypters, and infection chains. Researchers assess the actor is likely based in Nigeria.
Wiz detailed four OMI vulnerabilities affecting Azure Linux VMs, including unauthenticated remote root execution and local privilege escalation. Its research explains authentication failures and notes fixes in OMI 1.6.8-1.
Huntress analysts traced a suspicious Run Key to a DLL that contacted an IP address associated with Vawtrak. Static analysis and debugging exposed the decoded network-communication payload.
Talos translated a leaked Conti playbook and analyzed its tools and tactics, including Active Directory reconnaissance and credential theft. The detailed instructions could lower the barrier for less-experienced affiliates to carry out ransomware attacks.
Talos reviews prevalent threats observed Aug. 20–27, describing malware behaviors and sample-based IOCs for families including LokiBot, Remcos, Phorpiex, and Tofsee, alongside detection coverage.
Huntress analyzed a suspected targeted attack using a scheduled task to launch staged PowerShell malware. The code bypassed AMSI, contacted a look-alike domain, and prepared an Empire beacon, but analysts could not retrieve the final payload.
Huntress reported active ProxyShell exploitation of unpatched Exchange servers, 164 compromised hosts in four days, and more than 200 hidden webshells across monitored systems. It urged patching and checks for webshells in unusual locations.
Talos analyzed a Neurevt variant targeting Mexican financial users. Delivered through obfuscated PowerShell, it establishes persistence, evades defenses, captures keystrokes and screen data, and exfiltrates information to command-and-control servers.
Huntress traced a startup-folder shortcut through six payload stages to a likely URSU RAT, documenting its process-hollowing loader, anti-analysis checks, persistence, and command-and-control capabilities.
Talos summarizes malware observed Aug. 6–13, including Kuluoz, Razy, Remcos, Ursnif, Qakbot and others, with behaviors, sample-derived indicators of compromise and detection coverage.
Talos analyzed a Vice Society ransomware attack that used PrintNightmare for lateral movement and detailed the group’s tactics, including credential theft, defense evasion, backup targeting, and data exfiltration.
Wiz reported three AWS cross-account vulnerabilities that could let attackers read or write to other customers’ accounts. AWS fixed its policies, but Wiz’s sample found many customer environments remained vulnerable because users needed to update their own policies.
Researchers found that registering specially named zones with managed DNS providers could redirect Windows dynamic DNS traffic, exposing internal network details. Amazon and Google fixed the issue; other providers may remain vulnerable.
Huntress examined the Kaseya VSA ransomware attack’s authentication bypass and why it affected a reported 50–60 MSPs. It found no confirmed explanation for how attackers obtained the Agent GUIDs needed to exploit the flaw.
Huntress traced a Kaseya VSA attack that encrypted over 1,000 businesses through about 30 MSPs. Its investigation identified the exploit chain and ransomware deployment, and Huntress later validated Kaseya’s on-premises patch.
Huntress analyzed a PowerShell service command whose decoder uses host and user details as a key. Analysts recovered a payload that stages Meterpreter for in-memory execution.
Huntress analysts traced Cobalt Strike malware from a suspicious RunOnce key through obfuscated PowerShell and five in-memory binaries, detailing registry-based staging, process injection, evasion tactics and beacon behavior.
Huntress dissects a hidden batch and PowerShell launcher that decodes a Base64-encoded, GZIP-compressed payload, allocates memory for shellcode, and runs it in a new thread. The shellcode itself was not analyzed.
Huntress describes finding a Windows foothold where attackers used ngrok tunnels to expose RDP and VNC, with a renamed client, hidden script, and persistent UltraVNC server.
Huntress analysts traced a suspicious .NET executable that compiled and loaded a DLL, extracted a payload disguised as an embedded image, and concealed malware capabilities including password theft and keylogging.
