Credit to Author: Ahmed Mohamed Ibrahim | Date: Fri, 28 Jun 2024 00:00:00 +0000
We analyze the multi-stage loading technique used by Water Sigbin to deliver the PureCrypter loader and XMRIG crypto miner.
Read moreCredit to Author: Cedric Pernet| Date: Thu, 27 Jun 2024 00:00:00 +0000
In this blog we uncover threat actors using the 2024 Olympics to lure victims into investing in an initial coin offering (ICO). Similar schemes have been found to use AI-generated images for their fake ICO websites.
Read moreCredit to Author: Peter Girnus| Date: Wed, 19 Jun 2024 00:00:00 +0000
We recently discovered a new threat actor group that we dubbed Void Arachne. This group targets Chinese-speaking users with malicious Windows Installer (MSI) files in a recent campaign. These MSI files contain legitimate software installer files for AI software and other popular software but are bundled with malicious Winos payloads.
Read moreCredit to Author: Hara Hiroaki| Date: Tue, 11 Jun 2024 00:00:00 +0000
This blog entry provides an analysis of the Noodle RAT backdoor, which is likely being used by multiple Chinese-speaking groups engaged in espionage and other types of cybercrime.
Read moreCredit to Author: Hara Hiroaki| Date: Tue, 11 Jun 2024 00:00:00 +0000
This blog entry provides an analysis of the Noodle RAT backdoor, which is likely being used by multiple Chinese-speaking groups engaged in espionage and other types of cybercrime.
Read moreCredit to Author: Sunil Bharti| Date: Thu, 06 Jun 2024 00:00:00 +0000
We analyze a cryptojacking attack campaign exploiting exposed Docker remote API servers to deploy cryptocurrency miners, using Docker images from the open-source Commando project.
Read moreCredit to Author: Sunil Bharti| Date: Thu, 30 May 2024 00:00:00 +0000
Water Sigbin (aka the 8220 Gang) exploited the Oracle WebLogic vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner using a PowerShell script. The threat actor also adopted new techniques to conceal its activities, making attacks harder to defend against.
Read moreCredit to Author: Pierre Lee| Date: Thu, 16 May 2024 00:00:00 +0000
This report describes how Waterbear and Deuterbear — two of the tools in Earth Hundun’s arsenal — operate, based on a campaign from 2024.
Read moreCredit to Author: Feike Hacquebord| Date: Wed, 01 May 2024 00:00:00 +0000
This blog entry aims to highlight the dangers of internet-facing routers and elaborate on Pawn Storm’s exploitation of EdgeRouters, complementing the FBI’s advisory from February 27, 2024.
Read moreCredit to Author: Trend Micro Research| Date: Thu, 18 Apr 2024 00:00:00 +0000
On April 18, 2024, the UK’s Metropolitan Police Service and others conducted an operation that succeeded in taking down the Phishing-as-a-Service provider LabHost.
Read more