Tag: HUNT

Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity
This article explores the infrastructure patterns of two state-linked cyber threat groups based in Russia and China, focusing on Gamaredon and RedFoxtrot. It highlights their use of fast flux DNS techniques for operational stealth and the reuse of TLS certificates among others. Furthermore, it discusses the implications of these patterns for cybersecurity defenses.…
Read More
PoisonSeed Exploits CRM Accounts to Launch Cryptocurrency Seed Phrase Poisoning Attacks
Summary: A malicious campaign named PoisonSeed is exploiting compromised credentials from CRM tools and bulk email providers to send spam messages containing cryptocurrency seed phrases, ultimately aiming to drain victims’ digital wallets. The attack involves phishing tactics aimed at high-value targets, including both individuals and enterprises linked to the cryptocurrency sector.…
Read More
Summary: Silent Push Threat Analysts have identified a sophisticated cyber campaign named “PoisonSeed” targeting enterprise organizations and cryptocurrency holders through phishing and compromised email services. The campaign employs a unique tactic of “crypto seed phrase” phishing attacks to deceive victims into compromising their cryptocurrency wallets. PoisonSeed showcases the complexity of modern cyber threats, with connections to other known groups while maintaining distinct operational characteristics.…
Read More
Offensive Development Practitioner Course Preview
This article provides a first-hand account of the White Knight Labs’ Offensive Development Practitioner Certification course focused on malware development. The author shares personal experiences with burnout in the cybersecurity field before deciding to enroll in this course. The review highlights the quality of content, lab deployment, and the importance of OPSEC in training.…
Read More
PoisonSeed phishing campaign behind emails with wallet seed phrases
Summary: The ‘PoisonSeed’ phishing campaign compromises corporate email marketing accounts to distribute fraudulent emails containing crypto seed phrases, aimed at draining users’ cryptocurrency wallets. Targeting platforms like Coinbase and Ledger through compromised accounts at Mailchimp, SendGrid, HubSpot, Mailgun, and Zoho, the campaign uses professional phishing tactics to bait recipients into providing their credentials.…
Read More
Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective — Elastic Security Labs
OUTLAW is a persistent, auto-propagating coinminer that utilizes simple techniques such as SSH brute-forcing and modification of commodity miners for infection and persistence. By deploying a honeypot, researchers gained insights into how OUTLAW operates, revealing the malware’s ability to maintain control and expand its botnet with basic tactics.…
Read More
Threat actors leverage tax season to deploy tax-themed phishing campaigns
As the tax season approaches in the U.S., Microsoft has noted an increase in phishing campaigns using tax-related themes to steal sensitive information and deploy malware. These campaigns exploit various techniques, including URL shorteners, QR codes, and legitimate file-hosting services to evade detection. The reported threats include credential theft linked to platforms like RaccoonO365 and various malware types such as Remcos and Latrodectus.…
Read More
Hackers Exploit Cloudflare for Advanced Phishing Attacks
Summary: A sophisticated phishing campaign, attributed to a Russian-speaking threat actor, exploits Cloudflare services and Telegram for malicious activities. The attacks use branded Cloudflare phishing pages and employ advanced techniques to evade detection, including obfuscation and leveraging the “search-ms” protocol to initiate malware downloads. This campaign marks a notable shift in tactics, utilizing Telegram for victim tracking while continuing to demonstrate operational security lapses.…
Read More
Understanding Russian Cognitive Warfare
This article explores Russia’s cognitive warfare tactics, rooted in Soviet KGB doctrines, and their modern adaptations involving disinformation and cyber operations. It presents strategies to counter these tactics, including targeted cyber retaliation and strategic communication, utilizing frameworks such as SWOT and DIMEFIL. A comprehensive analysis is provided on the strategic environment and implications of Russian hacktivist groups, along with methods for dismantling them from within.…
Read More
RedCurl’s Ransomware Debut: A Technical Deep Dive
This research by Bitdefender Labs introduces the QWCrypt ransomware campaign, linked to the RedCurl group, marking a significant shift in their tactics from data exfiltration to ransomware. RedCurl has been operating since 2018 but has historically utilized Living-off-the-Land techniques for corporate espionage. Their targeting of specific infrastructures and the use of hypervisor encryption underscores a sophisticated evolution in their operational strategy, raising questions regarding their motivations and business model.…
Read More

Summary: The video discusses the recent developments in security related to various topics, including a ransomware attack on Kuala Lumpur’s International Airport, the hacking of Troy Hunt’s Have I Been Pwned website, and the European Union’s potential shift towards a Linux-based operating system for public sector use.…
Read More
Operation HollowQuill: Malware delivered into Russian R&D Networks via Research Decoy PDFs
The article discusses Operation HollowQuill, a targeted cyber campaign against the Baltic State Technical University, designed to infiltrate academic and defense networks through weaponized decoy documents. The attack utilizes a multi-stage infection chain, including a malicious RAR file, a .NET malware dropper, Golang shellcode, and a Cobalt Strike payload.…
Read More
GreenSpot APT Phishing Campaigns with Fake 163.com Login Analysis
GreenSpot APT phishing campaigns target 163.com users, attempting to steal credentials through fake login pages without embedding malicious attachments. While currently not direct threats, future modifications could introduce risks. Affected: 163.com, users of GreenSpot phishing campaigns

Keypoints :

GreenSpot APT is conducting phishing campaigns. Fake login pages prompt users to enter credentials twice.…
Read More

Summary: The video discusses a critical vulnerability that affects numerous apps and companies, highlighting a comprehensive process of discovering and exploiting this vulnerability across over 100,000 subdomains. The presenter shares insights on their scanning setup, exploitation strategies, and the different scenarios encountered during the hunt, revealing that even large companies with robust security teams can remain vulnerable.…
Read More