Tag: DEFENSE EVASION

Sandworm APT Targets Ukrainian Users with Trojanized Microsoft KMS Activation Tools in Cyber Espionage Campaigns
Sandworm, a threat actor linked to Russia’s GRU, has been conducting cyber espionage against Ukrainian Windows users by exploiting pirated software to distribute malware, notably the BACKORDER loader and Dark Crystal RAT. This activity has been ongoing since late 2023, coinciding with the Russian invasion of Ukraine, and highlights the vulnerabilities created by the country’s high rates of software piracy.…
Read More
Medusa Ransomware Activity Continues to Increase
The article discusses the tools and tactics utilized by the Medusa ransomware group, Spearwing. It highlights various software and methods employed for data exfiltration, credential dumping, and maintaining persistence within victim networks. The consistency of their tactics suggests an organized operation, potentially indicating that Spearwing operates more as an individual group rather than a traditional Ransomware-as-a-Service (RaaS).…
Read More
Kimsuky Group’s Watering Hole Attack: Beware of Malicious Files Disguised as Educational Support Documents in the Field of Unification
A recent watering hole attack was identified, targeting applicants for an educational program in the field of unification at a prominent university. Attackers embedded malicious HWP file links in a notice post, which when executed, creates further malicious files and executes them to maintain persistence in the infected systems.…
Read More
Dark Web Profile: Ghost (Cring) Ransomware – SOCRadar® Cyber Intelligence Inc.
The Ghost (Cring) ransomware is a critical cybersecurity threat primarily targeting organizations with vulnerable systems, including healthcare, finance, government, and education sectors. This ransomware employs sophisticated techniques such as exploiting vulnerabilities, lateral movement, and advanced evasion methods to encrypt sensitive data and demand ransom payments. Affected: healthcare, financial services, government, critical infrastructure, manufacturing, education, professional services, retail, e-commerce

Keypoints :

Ghost (Cring) ransomware has been active since at least 2021, targeting vulnerable internet-facing systems.…
Read More
Unveiling EncryptHub: Analysis of a Multi-Stage Malware Campaign
EncryptHub, a notable cybercriminal organization, has gained increasing attention from threat intelligence teams due to its operational security missteps. These lapses have allowed analysts to gain insights into their tactics and infrastructure. The report details EncryptHub’s multi-stage attack chains, trojanized application distribution strategies, and their evolving killchain, making them a significant threat in the cyber landscape.…
Read More
GO Language Based Ebyte Ransomware – A Brief Analysis – CYFIRMA
EByte Ransomware is a new variant developed by EvilByteCode that targets Windows systems using advanced encryption methods. It encrypts user data, displays a ransom note, and has significant potential risks due to its public availability on GitHub. Affected: Windows systems, organizations, individuals

Keypoints :

Developed in Go language and utilizes ChaCha20 encryption and ECIES for key transmission.…
Read More
Phantom-Goblin: Covert Credential Theft and VSCode Tunnel Exploitation
A newly identified malware operation, named “Phantom Goblin,” utilizes social engineering to deceive users into executing a malicious LNK file that triggers a PowerShell script to download and execute additional payloads. These payloads enable the malware to extract sensitive data, maintain unauthorized remote access via Visual Studio Code tunnels, and exfiltrate the stolen data to a Telegram bot.…
Read More
Booking a Threat: Inside LummaStealer’s Fake reCAPTCHA
Cybercriminals are exploiting the travel industry’s rising demand by creating fake booking websites and utilizing phishing scams to deceive travelers. They have employed an advanced attack strategy through malicious booking sites, using techniques like fake CAPTCHAs to deploy LummaStealer, a malware designed to steal information. Affected: users in the travel sector, individuals in the Philippines, individuals in Germany

Keypoints :

New campaign using fake booking websites to deliver LummaStealer.…
Read More
SLOW#TEMPEST: Explaining the TTPs of the Cyber Espionage Campaign
SLOW#TEMPEST is a covert cyber espionage group that emerged in 2024, renowned for its stealthy infiltration tactics using sophisticated phishing and malware techniques. Their operations primarily target organizations in Chinese-speaking regions, employing methods like DLL hijacking and credential harvesting. This article analyzes their tactics, providing insights into their operational methods and defense strategies.…
Read More
Boramae Ransomware
Boramae Ransomware is a newly discovered strain aimed at Windows systems, known for its effective encryption and evasion tactics. The ransomware not only encrypts files but also leaves threat-laden ransom notes demanding payment under duress. These findings emphasize the need for robust cybersecurity measures and incident response strategies.…
Read More
Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail
Summary: Threat actors, identified as TGR-UNK-0011 and related to the JavaGhost group, are exploiting misconfigurations in Amazon Web Services (AWS) environments to conduct phishing campaigns. They have evolved their tactics since 2019, focusing on gaining unauthorized access through exposed AWS access keys and leveraging services like Amazon SES and WorkMail.…
Read More
Turkey’s Attacking APT Groups and Attack Analyses
This study offers a comprehensive examination of Advanced Persistent Threats (APTs), focusing on their dynamics, techniques employed, and preventive measures. The article discusses the identification of APTs, the reasons behind attacks on Turkey, and their geopolitical and economic impacts. Furthermore, it explains the concept of Tactics, Techniques, and Procedures (TTP), their subdivision into sub-techniques, and details effective strategies to mitigate APT attacks.…
Read More
Healthcare Malware Hunt, Part 1: Philips DICOM Viewers
The article discusses a campaign by the China-based Advanced Persistent Threat (APT) group Silver Fox, which exploited vulnerabilities in Philips DICOM viewers to deploy malware such as a Remote Access Tool (RAT), keyloggers, and crypto miners targeting healthcare organizations. The healthcare sector remains a significant target for cyberattacks, necessitating robust security measures.…
Read More
Cellebrite zero-day exploit used to target phone of Serbian student activist – Amnesty International Security Lab
Amnesty International’s Security Lab revealed a case of Cellebrite’s forensic tools being misused to surveil a youth activist in Serbia. Subsequent investigations indicated that the Serbian authorities continue to exploit such tools for illegitimate surveillance of civil society despite international criticism. Further research highlighted zero-day vulnerabilities in Android USB drivers potentially affecting over a billion devices.…
Read More
Securonix Threat Labs Monthly Intelligence Insights – January 2025
The Monthly Intelligence Insights report for November 2024 by Securonix Threat Labs highlights critical cybersecurity threats, incidents, and responses, including notable breaches involving Cyberhaven and the exploitation of Ivanti vulnerabilities. Organizations are urged to enhance their security measures, such as updating software and implementing more vigilant monitoring systems.…
Read More
Resecurity | DragonForce Ransomware Group is Targeting Saudi Arabia
The DragonForce ransomware group has recently targeted organizations in the Kingdom of Saudi Arabia, resulting in the significant exfiltration of over 6 TB of confidential data from a major real estate and construction firm. The incident highlights a worrying trend of cyber threats against critical infrastructure in the region, indicating a potential expansion beyond the MENA area.…
Read More
Play Ransomware: Exposing One of 2024’s Greediest Cyber Extortionists
Play ransomware, also known as PlayCrypt, is a cybercrime organization that has surfaced since 2022, targeting organizations globally through sophisticated double-extortion tactics. They encrypt systems after exfiltrating sensitive data, demanding communication via email without revealing ransom amounts. The group has stricken over 300 entities across multiple sectors such as telecommunications, healthcare, and government.…
Read More