In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2502 articles
Cisco Talos details CoralRaider, a financially motivated group assessed to be based in Vietnam, using malicious Windows shortcuts, RotBot and XClient to steal credentials, financial information and social media data across several Asian countries.
Researchers describe how a backdoor in XZ Utils 5.6.0 and 5.6.1 can enable remote code execution through SSH under specific conditions, and share findings on its hooks, log concealment, affected distributions and remediation.
Huntress traced automated-looking commands from MSSQL processes on two endpoints to attempted ScreenConnect installations. Investigators found no evidence the installers succeeded.
An investigation found suspicious files in open directories, including Windows screen savers that dropped payloads, modified firewall rules, and ran XMRig to mine Monero. BitTorrent-related DNS requests suggested possible Mozi-like activity.
Researchers found an exposed directory containing red-team tools, Kerberoasted hashes, and Cobalt Strike files. Certificate details were linked to a Cobalt Strike instance, but no beacon was associated with the port at the time of writing.
Huntress reconstructed two days of attempts to use MSSQL access to deploy a PHP reverse shell on a Windows server. Windows Defender detected and quarantined the files, and no functioning shell was observed.
Researchers found a W3LL phishing campaign using a fake Adobe Shared File page to steal Outlook credentials. The kit uses adversary-in-the-middle techniques to capture session cookies and bypass MFA.
Talos observed phishing campaigns abusing legitimate document-publishing sites to host lures that redirect victims to credential- and session-token-harvesting pages, often impersonating Microsoft 365. The article details attack patterns, case studies, and defensive меры
Huntress traced an actor’s access to two Windows servers using compromised credentials and attempts to exfiltrate file shares with restic and cloud storage. The investigation found no clear evidence the second server’s data was successfully backed up.
Team Cymru's analysis describes Coper/Octo, an Exobot-derived Android malware-as-a-service, detailing its credential-theft injects, keylogging, SMS interception, VNC control, encrypted command-and-control, and geographic and device filters.
Cisco Talos details GhostSec and Stormous’s joint ransomware operations, GhostLocker 2.0’s behavior, and two tools linked to attacks on websites: a site-scanning utility and a WordPress hacking tool.
Hunt analyzed an open directory hosting Google and Naver phishing pages, a modified Xeno-RAT sample, and victim data. Infrastructure and tactics show overlaps with Kimsuky, though attribution remains uncertain.
Huntress traced a SocGholish download through a compromised WordPress blog by reviewing Chrome history and analyzing an obfuscated script, identifying more than 100 potentially compromised domains.
Huntress traced an automated MSSQL attack that extracted and ran staged files, created a local account, and installed AnyDesk. Analysts isolated the endpoint before ransomware deployment.
Huntress reconstructs a February 2024 ransomware deployment through a likely compromised ScreenConnect instance, detailing an attempted Defender bypass, recovery-disabling commands and PsExec propagation. Logs showed no similar compromise on other Huntress customer-host
A phishing campaign impersonates investment partners on Telegram and tricks blockchain entrepreneurs into running a malicious AppleScript. Infrastructure similarities suggest a possible Lazarus Group link, but attribution is unconfirmed.
Talos describes a campaign active since at least November 2023 that uses tax- and invoice-themed phishing to deliver TimbreStealer to users in Mexico, detailing its obfuscation, anti-analysis, persistence and information-stealing capabilities.
Huntress describes SOC-observed attacks exploiting ScreenConnect vulnerabilities, including ransomware and cryptominer deployments, Cobalt Strike activity, additional remote access tools, and persistence across victim networks.
Cisco Talos and CERT.NGO detail Turla’s TinyTurla-NG operations, including compromised WordPress C2 servers, file discovery and exfiltration, a modified Chisel implant, credential-harvesting scripts, and a tool for running commands with another process’s privileges.
Huntress recreated ScreenConnect exploits for CVE-2024-1709 and CVE-2024-1708, explaining how the authentication bypass can enable administrator access and how path traversal can write files. ConnectWise patched on-premises versions in 23.9.8.
Talos details high-volume campaigns using Google Cloud Run links and malicious MSIs to distribute Astaroth, Mekotio and Ousaban, primarily to victims in Latin America. The report describes their infection chains, malware behavior and indicators.
ThreatFabric reports five Anatsa campaign waves targeting European regions, with five Google Play droppers exceeding 100,000 installations. The droppers use staged downloads, abuse AccessibilityService and bypass Android 13 restrictions.
Cisco Talos details Turla’s TinyTurla-NG backdoor campaign targeting Polish NGOs, using compromised WordPress sites for C2 and PowerShell scripts to collect and exfiltrate files, including password-manager key material.
Huntress analysts correlated Defender, PowerShell, Exchange, and web-server logs to investigate commands sent to an unpatched Exchange endpoint. The activity appeared consistent with a scan; Defender remediated the commands, and the customer was urged to update.
