Do Son Unit 42 exposed two massive campaigns (Trio & Chorus) using 2,500 spoofed domains to target Chinese users. The multi-stage attack uses MSI/VBScript and DLL sideloading via Avast to deploy Gh0st RAT.
Gh0st RAT
Elastic exposed Dragon Breath APT's new RoningLoader malware. It uses PPL abuse and a signed kernel driver (ollama.sys) to disable Windows Defender and inject a modified gh0st RAT for espionage.
A new report reveals GodRAT, a sophisticated backdoor based on the Gh0st RAT family, is using steganography to launch attacks via Skype messenger.
Silver Fox APT is conducting a multi-stage espionage campaign, leveraging backdoored medical software like Philips DICOM viewers to infect healthcare organizations
A sophisticated malware campaign targets Korean Internet cafés with Gh0st RAT and CoinMiner, hijacking systems for crypto mining. ASEC urges immediate action.
A sophisticated campaign deployed malicious IIS modules on South Korean web servers, enabling traffic control and backdoor access. Suspected Chinese actor.
Uncover the threat of Legacy Driver Vulnerability in cyberattacks. Learn how attackers exploit outdated drivers to bypass security.
Cybersecurity researchers at Trend Micro have unveiled a previously undocumented backdoor malware dubbed "Noodle RAT,"
SugarGh0st is a customized variant of the infamous Gh0st RAT, which has been active for over a decade. Developed by a Chinese group