In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2501 articles
Wiz researchers attribute an evolving Linux malware campaign to Diicot. The malware brute-forces weak SSH credentials, spreads in cloud environments, and establishes persistence; researchers suspect it mines cryptocurrency on non-cloud systems.
Wiz Research traced JINX-2401 activity across AWS environments, where compromised IAM keys were used to create users and Bedrock policies. Service Control Policies blocked the observed model-access attempts; Wiz recommends restricting Bedrock access and monitoring Cloud
Aqua Security researchers found about 336,000 internet-exposed Prometheus servers and exporters, which could leak sensitive data, enable denial-of-service attacks through pprof endpoints, or expose users to malicious exporters via RepoJacking.
Hunt IO identified three IPs and associated domains linked to Oyster backdoor activity, using TLS and web-page fingerprints to track infrastructure. Shared SSH keys connected one IP to 20 others, though the links do not prove malicious intent.
Huntress analyzes Malichus, malware delivered through exploitation of a Cleo software vulnerability, detailing its staged loaders, Java backdoor, custom C2 protocol, command execution, configuration access, and file exfiltration capabilities.
Hunt researchers linked newly observed domains and servers returning “Million OK!!!!” and displaying Naver branding to suspected Kimsuky infrastructure, identifying recurring domains, certificates, hosting, and server traits.
A crafted pull-request branch name reportedly exploited an Ultralytics GitHub Actions workflow, leading to PyPI releases 8.3.41 and 8.3.42 containing XMRig cryptomining code. The versions were removed; users are advised to uninstall and restore affected systems.
Researchers traced a Japanese delivery-themed smishing campaign to MoqHao. It served localized Apple ID phishing pages to iOS users and a malicious Android APK, using Apple iCloud, VK, and dynamic DNS infrastructure.
Researchers linked seven Cobalt Strike 4.10 team servers through a rare watermark and shared configuration, finding brand-impersonating domains and extracted beacon samples. They also observed a separate, unexplained cluster using watermark 1.
Hunt researchers found XWorm samples in exposed directories disguised as familiar software. Examples included a batch script that appeared to disable Windows Defender and a campaign using fake gift-card shortcuts to deliver malware that exfiltrated data to Telegram.
Aqua researchers detail Matrix’s campaign, which uses weak credentials, exposed services and known vulnerabilities to compromise IoT devices and servers, expand a DDoS botnet, and sell attack services through Telegram.
Huntress traced two intrusions to RDP brute force, documenting PsExec-based lateral movement, a renamed MeshAgent, WDigest credential exposure and a retroactive hunt linking the same tradecraft across environments.
Hunt IO correlates SSL/TLS certificates, domains, and servers with suspected DarkPeony infrastructure, linking one domain to a PlugX-related malicious file and sharing a query to help defenders hunt for similar infrastructure.
ThreatFabric describes Ghost Tap, a cash-out tactic relaying NFC traffic from a device with a stolen card linked to a mobile payment service to a mule at a retailer, and outlines fraud indicators for financial institutions.
Researchers analyzed a XenoRAT dropper delivered as an Excel XLL, protected with ConfuserEx and Excel-DNA. The chain used a decoy PDF and led to a XenoRAT payload communicating with a hardcoded C2 server.
Bitdefender researchers describe Facebook ads promoting a fake Bitwarden update that leads users to sideload a malicious Chrome extension. It harvests Facebook cookies and account data, including business and billing information, and sends it to an attacker-controlled C
Hunt IO linked two Sliver C2 servers and Ligolo-ng tunneling infrastructure through shared TLS certificates and port configurations, and found a spoofed Y Combinator-like domain and a Sliver implant. The intended target remains uncertain.
Wiz outlines ways to pivot across phishing pages, network fingerprints and registration data to find 0ktapus-linked domains, identifying multiple DOM templates and new domains while cautioning that shared kits complicate attribution.
Talos describes Interlock ransomware attacks involving a fake Chrome updater, credential theft, lateral movement and data exfiltration. The group encrypts Windows and Linux systems; Talos sees low-confidence overlaps with Rhysida.
Hunt researchers found more than 60,000 phishing links, many targeting Microsoft SharePoint and Office 365 credentials. The pages used a shared Font Awesome kit and Cloudflare Workers or IPFS gateways to host credential-harvesting content.
Researchers analyzed RunningRAT samples and infrastructure, finding XMRig deployment scripts and tools on an associated C2 server. The RAT communicates with the server, while a separate executable showed possible credential-stealing functionality.
Cisco Talos describes a campaign targeting Facebook business and advertising account users in Taiwan with copyright-themed phishing emails that deliver LummaC2 or Rhadamanthys information stealers through evasive loaders.
Researchers found an open directory containing Cobalt Strike 4.2, exploit payloads, Goblin phishing-tool configuration, and browser password-stealing utilities. The intended targets and malicious use of the tools remain unconfirmed.
ThreatFabric analyzed LightSpy for iOS, finding public exploits, 17–28 plugins and destructive features that can impair or prevent booting. Researchers identified five C2 servers and logs indicating eight infected iOS devices.
