In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2500 articles
Huntress surveyed more than 8,000 Azure tenants, finding Traitorware in about 10% and identifying over 500 Stealthware apps across partner tenants. It released Cazadora, an open-source script to audit tenant applications.
Talos research demonstrates how an attacker able to trigger Cloud Build jobs could use the build service account’s permissions to delete or encrypt Cloud Storage data, and identifies audit events and safeguards for defenders.
A technical comparison finds Azure’s device-code flow can let attackers obtain broadly scoped tokens after phishing a user, while Google Cloud restricts available scopes, limiting the attack’s potential. The author notes undocumented options may exist.
Darktrace describes RansomHub’s growing use and reports observed activity including network scanning, credential attempts, lateral movement via remote-management tools, data exfiltration, and file encryption.
Researchers found SmokeLoader samples and fake invoice and bank-statement PDFs in two open directories, revealing staging infrastructure and technical details of a campaign targeting Ukrainian organizations.
Bitdefender details a suspected Lazarus campaign using fake LinkedIn job offers and malicious code repositories to deploy cross-platform malware that steals credentials, files, and cryptocurrency data.
Hunt.io researchers linked suspected GreenSpot infrastructure to spoofed 163.com login and attachment-download pages. Some pages captured submitted credentials; the researchers found no evidence of credential exfiltration from one separate login-page cluster.
Aqua researchers found that prefix-based OPA Gatekeeper and Kyverno policies can be bypassed when repository constraints omit trailing slashes, potentially allowing unapproved container images. They describe a revised Gatekeeper policy and scanning recommendations.
Team Cymru used internet telemetry to trace SmartApeSG management hosts to active NetSupport RAT servers and observe a connection to a Quasar RAT C2. The relationship between some infrastructure and threat actor activity remains uncertain.
Cisco Talos analyzed a campaign targeting users mainly in Poland and Germany. Phishing attachments deliver PureCrypter, which can install the TorNet backdoor for persistent access, Tor-routed command-and-control, and execution of remote .NET assemblies.
Researchers found three additional servers linked to suspected SparkRAT activity, including macOS implants delivered through exposed directories. They describe C2 detection fingerprints, persistence behavior, infrastructure, and related indicators.
Talos observed increased use of hidden text salting in email threats during the second half of 2024. Attackers hide characters or content in HTML to confuse parsers, language detection, spam filters, and security engines.
Hunt researchers identified six active servers matching TLS certificate and JA4X indicators associated with suspected GhostWolf infrastructure, but say attribution to RedGolf/APT41 remains uncertain. A wolfSSL change also makes one certificate field unreliable for dete
Researchers found a VS Code extension posing as Zoom that added code to access Chrome cookies in version 0.2.2. It also contained hardcoded secrets for more than 20 services; the researchers reported it to Microsoft.
Wiz describes using honeypot data and cloud API patterns to identify credential abuse and link incidents to an actor it calls “Bapak.” In observed cases, the actor lacked permission to create the attempted ECS cluster.
Darktrace identified four RansomHub incidents attributed to ShadowSyndicate across customer networks, involving reconnaissance, data exfiltration, lateral movement and, in three cases, encryption.
Hunt researchers found a JustJoin-themed landing page on infrastructure linked to previously reported TA444/BlueNoroff activity. Related servers shared an SSH fingerprint, suggesting coordinated infrastructure management.
Researchers traced TLS certificate overlaps from the Cyberhaven Chrome extension compromise to 19 servers and domains with activity dating to early 2024. The infrastructure suggests a longer-running campaign, but links to Savvy Seahorse remain unconfirmed.
Researchers traced a Golang Cobalt Strike beacon to a server using VS Code dev tunnels for command and control. The investigation details beacon behavior and indicators, while noting that no specific target has been identified.
Wiz disclosed CVE-2024-43405, a Nuclei signature-verification bypass caused by mismatched Go regex and YAML newline handling. Crafted templates could execute unverified code; Nuclei 3.3.2 fixes it.
The article analyzes Mamba 2FA’s AiTM phishing tactics and describes Darktrace detections of compromised Microsoft 365 accounts, including unusual logins, mailbox-rule changes, and attempts to register authenticator apps.
Team Cymru links a Metasploit C2 IP and seven high-risk ASes to UK-registered hosting firms using virtual offices and overseas infrastructure, finding opaque records and leased IPv4 may enable abuse; it recommends stronger vetting and monitoring.
Cisco Talos analyzes how attackers abuse vulnerable Windows drivers to escalate privileges, load unsigned kernel code, and disable security tools, documenting ransomware use and explaining Windows mitigations and defensive measures.
Wiz researchers attribute an evolving Linux malware campaign to Diicot. The malware brute-forces weak SSH credentials, spreads in cloud environments, and establishes persistence; researchers suspect it mines cryptocurrency on non-cloud systems.
