Tag: EXFILTRATION

How an Exposed Jenkins Instance Led to a Full-Scale Infrastructure Compromise
This article discusses the risks associated with misconfigured Jenkins instances in CI/CD pipelines, highlighting a specific case where an exposed Jenkins service led to unauthorized access and severe security vulnerabilities. The findings from CloudSEK’s BeVigil underscore the potential consequences of such misconfigurations, including remote code execution, credential theft, and regulatory risks.…
Read More
PJobRAT Malware Campaign Targeted Taiwanese Users via Fake Chat Apps
Summary: A new campaign utilizing the PJobRAT Android malware has been detected, targeting users in Taiwan under the guise of chat applications. This malware, previously aimed at Indian military personnel, has evolved to harvest sensitive information while masquerading as messaging apps. Security researchers indicate its operation spanned nearly two years before pausing in October 2024.…
Read More
I Am Not A Robot
Recent social engineering tactics have evolved to include a variant of the SectopRAT malware, which is disguised as a Cloudflare verification challenge. This Remote Access Trojan employs extensive techniques for data exfiltration and uses various evasion methods to avoid detection. Affected: Users, Browsers, Cryptocurrency Holders

Keypoints :

ClickFix-style social engineering techniques are becoming more prevalent among threat groups.…
Read More
How SVigil Prevented a Massive Supply Chain Breach in Banking Infrastructure?
This article highlights the cybersecurity vulnerabilities that arise when financial institutions rely on third-party vendors. It details how CloudSEK’s SVigil platform discovered exposed credentials of a key communication service provider, which led to a significant data breach affecting a major banking entity. The timely detection helped prevent potential misuse of sensitive data and loss of customer trust.…
Read More
Shifting the sands of RansomHub’s EDRKillShifter
ESET researchers examine the ransomware landscape in 2024, highlighting the emergence of RansomHub, a prominent ransomware-as-a-service (RaaS) group linked to established gangs like Play, Medusa, and BianLian. The article discusses the rise of EDR killers, particularly EDRKillShifter, developed by RansomHub, and reflects on the shifting dynamics of ransomware payments and victim statistics.…
Read More
Defense contractor to pay .6 million over third-party provider’s security weakness
Summary: MORSE Corp, a defense contractor based in Cambridge, Massachusetts, has settled with the U.S. government for .6 million due to violations of federal cybersecurity requirements. The settlement stems from allegations that the company misrepresented its cybersecurity posture and failed to comply with standards set by the National Institute of Standards and Technology.…
Read More
Consequences of INPS-themed Smishing: Stolen Documents for Sale Online
The article discusses the ongoing smishing campaigns targeting the Italian public, particularly focusing on scams related to the INPS (National Social Security Institute). The scams involve the theft of identity documents, mostly selfies where the document is displayed next to the victim’s face. Despite continuous monitoring and takedown efforts by CERT-AGID, these fraudulent activities continue to proliferate, leading to an increase in victims and the illegal sale of personal documents on the dark web.…
Read More
RedCurl cyberspies create ransomware to encrypt Hyper-V servers
Summary: The threat actor group RedCurl has evolved from corporate espionage to deploying a ransomware encryptor, QWCrypt, targeting Hyper-V virtual machines. Their tactics now include sophisticated phishing schemes and stealthy methods for lateral movement within networks. This strategic shift raises questions about their motives and operational goals, as they blend espionage with ransomware attacks.…
Read More
SnakeKeylogger: A Multistage Info Stealer Malware Campaign
The SnakeKeylogger campaign illustrates a sophisticated credential-stealing threat targeting both individuals and businesses. Utilizing multi-stage infection techniques, it cleverly evades detection while harvesting sensitive data from various platforms. Attackers employ malicious spam emails containing disguised executable files to initiate the infection. Affected: Individuals, Businesses, Email Clients, Web Browsers, FTP Clients.…
Read More
YouTube Creators Under Siege Again: Clickflix Technique Fuels Malware Attacks
This report reveals a sophisticated malware campaign targeting YouTube creators through spearphishing, utilizing the Clickflix technique to deceive victims into executing malicious scripts. Attackers leverage brand impersonation and exploit interest in professional collaborations to spread malware via meticulously crafted phishing emails. Once activated, the malware steals sensitive data or allows remote access.…
Read More
Summary: K7 Labs recently analyzed cyber tactics utilized by the North Korean APT group Kimsuky, shedding light on their use of malicious scripts and payloads in recent campaigns. The analysis reveals a sophisticated infection chain designed to exfiltrate sensitive information while evading detection. Key tactics include phishing, malware infections, and the use of dynamic obfuscation techniques to bypass security measures.…
Read More
Rilide Stealer Disguises as a Browser Extension to Steal Crypto
Summary: A new threat named “Rilide” has emerged as a malicious browser extension that steals sensitive user information, primarily targeting Chromium-based browsers. Disguised as legitimate extensions like Google Drive, Rilide employs deceptive tactics including phishing campaigns and PowerShell loaders to install itself and capture data such as passwords and cryptocurrency credentials.…
Read More