Do Son LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than ever.
threat actor
A new APT28 campaign targets Ukraine's military with a blend of steganography, open-source tools, and legitimate cloud services for covert C2.
A new report reveals TAG-150, a sophisticated new threat actor with evolving malware and a resilient multi-tiered infrastructure, including a new RAT called CastleRAT.
A new report from HarfangLab details two recent UAC-0057 (Ghostwriter) campaigns targeting Ukraine and Poland with malicious archives and multi-stage implants.
Symantec's report reveals LockBit is using evolved tactics, including DLL sideloading and process masquerading with legitimate executables, to evade detection and deploy payloads.
Sophos uncovers a new infection chain for GOLD BLADE's RedLoader malware, combining LNK files, WebDAV, and DLL sideloading to bypass defenses and deploy payloads stealthily.
BlackSuit, a rebranded Royal/Conti ransomware, unleashes destructive multi-stage attacks. It uses Cobalt Strike, rclone for data exfil, and deletes shadow copies for stealth and speed.
Trend Micro uncovers BERT ransomware (Water Pombero) deploying multi-threaded variants against Windows, Linux, and ESXi systems, showing code similarities to REvil's Linux variant.
ASEC uncovers attacks on Linux servers installing legitimate proxy software (TinyProxy, Sing-box) to hijack resources for covert operations, bypassing traditional malware detection.
Varonis uncovers a widespread phishing campaign abusing Microsoft 365's Direct Send, spoofing internal users to bypass email security and harvest credentials.
Palo Alto Networks exposes CL-CRI-1014, an IAB targeting African financial institutions. They use open-source tools like PoshC2 and Classroom Spy, disguised with forged signatures for covert network access.
Trend Micro uncovers a new attack method using misconfigured Docker Remote APIs and the Tor network to stealthily deploy cryptominers and establish persistent access.
Water Curse is using GitHub to distribute malicious open-source projects, weaponizing 76 accounts with multi-stage malware targeting developers, red teamers, and gamers.
Sophos X-Ops found a backdoored Sakura RAT targeting hackers and cheaters, spreading info-stealers via hidden scripts in open-source projects.
A sophisticated malware campaign targets Korean Internet cafés with Gh0st RAT and CoinMiner, hijacking systems for crypto mining. ASEC urges immediate action.
A joint advisory warns that Russia's APT28 (Fancy Bear) is actively targeting logistics and tech companies supporting Ukraine with espionage and data exfiltration.
Hazy Hawk is exploiting DNS misconfigurations and CNAME hijacking to take over subdomains of high-profile organizations for scams and malware.
North Korean threat actor TA406 intensifies cyber espionage against Ukraine, using phishing and malware to gather political intelligence.
Swan Vector cyber-espionage campaign uses sophisticated malware to target institutions in Japan and Taiwan. Learn how they evade detection and steal data
Agenda ransomware (Qilin) is back, now using the advanced NETXLOADER and SmokeLoader to enhance infiltration and evade detection. Targets global sectors.
ANSSI reveals sustained cyber espionage by APT28 (Fancy Bear) targeting French institutions since 2021. Learn about their tactics and targets.
APT29, a Russia-linked group, targets European diplomats with phishing emails disguised as wine tasting invitations, deploying GRAPELOADER malware