Malware

Botnet Exploits Old GeoVision IoT Devices via CVE-2024-6047 & CVE-2024-11120

• Malware
• Vulnerability

Botnet Exploits Old GeoVision IoT Devices via CVE-2024-6047 & CVE-2024-11120

Do Son May 7, 2025 0

Akamai uncovers active exploitation of retired GeoVision IoT devices via CVE-2024-6047 and CVE-2024-11120 using Mirai-based botnet LZRD.

Gunra Ransomware: New Threat Analysis Reveals Evasion Tactics

• Malware

Gunra Ransomware: New Threat Analysis Reveals Evasion Tactics

Do Son May 7, 2025 0

CYFIRMA's analysis details Gunra Ransomware's sophisticated techniques, including evasion and data exfiltration, impacting global industries.

Massive E-commerce Supply Chain Attack Uncovered: Hundreds of Stores at Risk

• Malware

Massive E-commerce Supply Chain Attack Uncovered: Hundreds of Stores at Risk

Do Son May 6, 2025 0

A large-scale supply chain attack has injected backdoors into e-commerce software, potentially affecting 500-1,000 stores. Sansec urges immediate checks.

Venom Spider Evolves: Arctic Wolf Exposes More_eggs Campaign Targeting HR

• Cybercriminals
• Malware

Venom Spider Evolves: Arctic Wolf Exposes More_eggs Campaign Targeting HR

Do Son May 5, 2025 0

Arctic Wolf exposes Venom Spider’s More_eggs campaign, where fake resumes and polymorphic JavaScript target HR to deploy a stealthy backdoor.

StealC V2: ThreatLabz Unveils the Evolution of a Stealthy Info-Stealer and Malware Loader

• Malware

StealC V2: ThreatLabz Unveils the Evolution of a Stealthy Info-Stealer and Malware Loader

Do Son May 5, 2025 0

ThreatLabz reveals StealC V2—an evolving info-stealer with encrypted C2, MSI and PowerShell payloads, and a rule-driven control panel for targeted attacks.

Golden Chickens Unveils TerraStealerV2 and TerraLogger Malware

• Malware

Golden Chickens Unveils TerraStealerV2 and TerraLogger Malware

Do Son May 5, 2025 0

Recorded Future uncovers TerraStealerV2 and TerraLogger—two new malware families from Golden Chickens, aimed at stealing credentials and logging keystrokes.

SocGholish Reloaded: Darktrace Uncovers Ransomware-Primed Loader Campaign

• Malware

SocGholish Reloaded: Darktrace Uncovers Ransomware-Primed Loader Campaign

Do Son May 5, 2025 0

Darktrace uncovers a SocGholish campaign using obfuscated loaders and legacy Windows exploits to harvest NTLM hashes and deliver ransomware payloads.

MintsLoader Malware: Advanced Evasion Techniques Target Industrial Sector

• Malware

MintsLoader Malware: Advanced Evasion Techniques Target Industrial Sector

Do Son May 4, 2025 0

Recorded Future analysis exposes MintsLoader, a stealthy malware loader using advanced evasion to target industrial, legal, and energy sectors.

Nebulous Mantis Cyber Espionage Group: RomCom RAT and Hybrid Tactics

• Cybercriminals
• Malware

Nebulous Mantis Cyber Espionage Group: RomCom RAT and Hybrid Tactics

Do Son May 3, 2025 0

PRODAFT report details Nebulous Mantis (Cuba/STORM-0978), a Russian-speaking group using RomCom RAT for espionage and ransomware.

Malicious Python Packages Exploited Gmail as Covert Command-and-Control Channels

• Malware

Malicious Python Packages Exploited Gmail as Covert Command-and-Control Channels

Do Son May 2, 2025 0

Socket discovers Python packages abusing Gmail SMTP for covert C2 tunnels, evading firewalls and exfiltrating data through trusted email infrastructure.

CAPTCHA to Command: Trustwave Uncovers Stealthy NodeJS Backdoor Campaign

• Malware

CAPTCHA to Command: Trustwave Uncovers Stealthy NodeJS Backdoor Campaign

Do Son May 1, 2025 0

Trustwave uncovers a fake CAPTCHA campaign delivering NodeJS backdoors via PowerShell and TryCloudflare, with SOCKS5 tunneling and RAT capabilities.

Gremlin Stealer Malware Targets Browsers, Crypto Wallets, and VPNs in Telegram-Based Campaign

• Malware

Gremlin Stealer Malware Targets Browsers, Crypto Wallets, and VPNs in Telegram-Based Campaign

Do Son May 1, 2025 0

Gremlin Stealer malware, written in C#, exfiltrates browser data, crypto wallets, and VPN credentials, distributing stolen data via a Telegram-based backend.

Outlaw Botnet Exploits Weak SSH to Hijack Linux Systems for Crypto Mining

• Malware

Outlaw Botnet Exploits Weak SSH to Hijack Linux Systems for Crypto Mining

Do Son May 1, 2025 0

Outlaw botnet targets Linux servers via weak SSH, using Perl scripts and XMRig miners for crypto mining and backdoor access, Kaspersky warns.

Sophisticated Attacks Employ Cobalt Strike, DLL Sideloading, and Evolving Tactics

• Malware

Sophisticated Attacks Employ Cobalt Strike, DLL Sideloading, and Evolving Tactics

Do Son May 1, 2025 0

Sophos researchers detail a complex campaign using Cobalt Strike, DLL sideloading, and clever techniques like expired certificates

Earth Kasha Refines Spear-Phishing Tactics in Espionage Campaign Targeting Taiwan and Japan

• Cyber Security
• Malware

Earth Kasha Refines Spear-Phishing Tactics in Espionage Campaign Targeting Taiwan and Japan

Do Son May 1, 2025 0

Earth Kasha targets Taiwan and Japan in a March 2025 spear-phishing campaign using ANEL and NOOPDOOR backdoors for stealthy cyber espionage.

WordPress Malware Alert: Fake Anti-Malware Plugin Grants Admin Access and Executes Remote Code

• Malware

WordPress Malware Alert: Fake Anti-Malware Plugin Grants Admin Access and Executes Remote Code

Do Son April 30, 2025 0

Wordfence warns of malware posing as a WordPress plugin that enables admin access, hides itself, and executes remote code via REST API and cron jobs.

Hannibal Stealer Malware Targets Crypto Wallets, VPNs, and Browser Data

• Malware

Hannibal Stealer Malware Targets Crypto Wallets, VPNs, and Browser Data

Do Son April 30, 2025 0

Hannibal Stealer malware resurfaces with new tactics to steal crypto wallets, VPN data, and browser credentials. Learn how it targets users worldwide.

Weaponized Uyghur Language Software: Citizen Lab Uncovers Targeted Malware Campaign

• Cyber Security
• Malware

Weaponized Uyghur Language Software: Citizen Lab Uncovers Targeted Malware Campaign

Do Son April 29, 2025 0

Citizen Lab reveals a malware campaign targeting Uyghur exiles by hijacking trusted language software, exposing new digital transnational repression tactics.

Fog Ransomware Group Exposed: Inside the Tools, Tactics, and Victims of a Stealthy Threat

• Malware

Fog Ransomware Group Exposed: Inside the Tools, Tactics, and Victims of a Stealthy Threat

Do Son April 29, 2025 0

DFIR Report exposes the Fog ransomware group's sophisticated use of SonicWall exploits, Sliver C2, and credential theft across tech, retail, and education sectors.

Fake GIF and Reverse Proxy Used in Sophisticated Card Skimming Attack on Magento

• Malware

Fake GIF and Reverse Proxy Used in Sophisticated Card Skimming Attack on Magento

Do Son April 29, 2025 0

A fake GIF and malicious reverse proxy server enabled a multi-stage card skimming attack on a Magento site, exposing customer credit card data and credentials.

Triada Trojan Evolves: Pre-Installed Android Malware Now Embedded in Device Firmware

• Malware

Triada Trojan Evolves: Pre-Installed Android Malware Now Embedded in Device Firmware

Do Son April 29, 2025 0

Kaspersky warns that Triada Trojan now comes pre-installed in counterfeit Android device firmware, making it nearly impossible to remove without reinstallation.

Earth Kurma APT Targets Southeast Asia with Stealthy Cyberespionage

• Cyber Security
• Malware

Earth Kurma APT Targets Southeast Asia with Stealthy Cyberespionage

Do Son April 29, 2025 0

Earth Kurma APT campaign targets Southeast Asian governments and telecoms using rootkits, loaders, and cloud services to steal sensitive data.