Tag: EMAIL

New Malware Loaders Use Call Stack Spoofing, GitHub C2, and .NET Reactor for Stealth
Summary: Cybersecurity researchers have identified enhanced malware loaders, including Hijack Loader and SHELBY, that use advanced evasion tactics and innovative command-and-control methods. Hijack Loader introduces call stack spoofing and anti-VM checks, while SHELBY operates through GitHub for remote control and data exfiltration. Meanwhile, Emmenhtal loader has been distributing SmokeLoader via phishing emails using .NET…
Read More
We Smell a (DC)Rat: Revealing a Sophisticated Malware Delivery Chain
Summary: The Acronis Threat Research Unit (TRU) analyzed a complex malware delivery chain demonstrating the use of multiple scripting languages and obfuscation techniques, leading to the deployment of high-profile malware such as DCRat. The infection starts with a deceptive email attachment, escalating through a multi-stage process involving Visual Basic Script, batch files, and PowerShell.…
Read More
Summary: TRUeSentire’s Threat Response Unit has identified an advanced KoiLoader malware intrusion attempting to compromise systems through a phishing email. The attack leverages misleading file formats, manipulates PowerShell commands, and employs multiple anti-detection techniques to deploy the Koi Stealer for extensive data theft. KoiLoader exemplifies sophisticated malware engineering, utilizing custom cryptographic channels for Command and Control (C&C) operations.…
Read More
Digital disruptions continue for Russian transportation, this time at state railway
Summary: Russia’s state-owned railway, RZD, experienced a cyberattack that temporarily disrupted its website and mobile application, following a similar incident with Moscow’s subway system. The attack was identified as a distributed denial-of-service (DDoS) event, though ticket sales continued at physical locations. The perpetrator remains unknown, and RZD is working to restore its online services promptly.…
Read More
CrushFTP Blames Security Firms for Fast Exploitation of Vulnerability
Summary: The Shadowserver Foundation reported a surge in exploitation attempts targeting a recently patched vulnerability in CrushFTP, a file transfer solution. Despite ongoing updates and mitigations from CrushFTP, vulnerability intelligence firms have created CVE identifiers, leading to confusion in the cybersecurity community. As unpatched instances remain, CrushFTP has urged users to promptly apply available patches.…
Read More
Mysterious Disappearance of Cybersecurity Expert Xiaofeng Wang and Wife Triggers FBI Raids
Summary: Xiaofeng Wang, a prominent computer scientist from Indiana University, and his wife Nianli Ma have mysteriously disappeared, raising concerns following the removal of their online profiles and an FBI raid on their homes. Their sudden absence has sparked widespread speculation among colleagues, with law enforcement providing minimal information.…
Read More
Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs
The article discusses Operation HollowQuill, a targeted cyber campaign against the Baltic State Technical University, designed to infiltrate academic and defense networks through weaponized decoy documents. The attack utilizes a multi-stage infection chain, including a malicious RAR file, a .NET malware dropper, Golang shellcode, and a Cobalt Strike payload.…
Read More
Hacker Leaks Samsung Customer Data
Summary: A hacker known as ‘GHNA’ has leaked around 270,000 customer records from Samsung Germany’s ticketing system, sourced via compromised credentials from Spectos GmbH. The data breach stems from an incident in 2021 and includes sensitive personal and transaction information. Experts warn that the leaked data could facilitate various cyber threats, including phishing and account takeovers.…
Read More
Russia-Linked Gamaredon Uses Troop-Related Lures to Deploy Remcos RAT in Ukraine
Summary: A recent phishing campaign targeting Ukrainian entities has been identified, utilizing social engineering techniques to distribute the Remcos RAT trojan. This campaign, attributed to the Russian hacking group Gamaredon, uses deceptive files related to military movements to trick victims. The campaign highlights ongoing cyber espionage efforts associated with Russian Intelligence Services against Ukraine.…
Read More