Tag: SPAM

Summary: A sophisticated cyber campaign has been identified utilizing the fasthttp library to conduct brute-force login attempts and spam multi-factor authentication (MFA) requests targeting Azure Active Directory environments. The campaign, which began showing signs on January 6, 2025, is primarily driven by malicious traffic from Brazil and aims to overwhelm security mechanisms to gain unauthorized access to user accounts.…
Read More
Summary: A malicious campaign exploiting Blogspot redirectors has been uncovered, facilitating the distribution of phishing pages and malware. This operation, part of the larger “ApateWeb” initiative, utilizes Blogspot’s reputation to mislead users through seemingly legitimate links. Researchers have identified advanced techniques used by attackers to evade detection and enhance the effectiveness of their scams.…
Read More
Email Bombing, ‘Vishing’ Tactics Abound in Microsoft 365 Attacks
Summary: Sophos X-Ops’ Managed Detection and Response (MDR) warns of ransomware attacks that utilize email bombing and vishing tactics through Microsoft Office 365. These attacks are attributed to two threat groups, STAC5143 and STAC5777, which have been active in recent months. The researchers emphasize the need for organizations to enhance their security measures and employee awareness to combat these evolving threats.…
Read More
Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing”
Sophos X-Ops’ Managed Detection and Response (MDR) has reported on two active threat clusters, STAC5143 and STAC5777, utilizing Microsoft Office 365 to infiltrate organizations for data theft and ransomware deployment. The tactics include email-bombing, fake tech support, and exploiting remote control tools. Both clusters exhibit overlapping techniques with known threat groups like FIN7 and Storm-1811.…
Read More
Facilitating Phishing and Pig Butchering Activities using Zendesk Infrastructure [Bait & Switch Mode]
This report serves as an advisory to organizations regarding the misuse of Zendesk’s platform for creating subdomains that impersonate legitimate companies, potentially facilitating investment scams. The analysis highlights how these domains can be exploited for phishing attacks, particularly through a technique known as Pig Butchering. Organizations are urged to block or take down suspicious domains to prevent disruptions.…
Read More
Summary: NVISO Labs has identified a sophisticated phishing campaign linked to the Black Basta ransomware group, utilizing Microsoft Teams for social engineering attacks. The campaign employs an email bombing strategy to distract victims before attackers impersonate IT personnel to gain remote access. Once inside, they disable security measures, exfiltrate data, and deploy malware, highlighting the need for proactive detection measures.…
Read More
WhoisXML API has launched the First Watch Malicious Domains Data Feed, which uses advanced deep learning technology to provide daily predictive threat intelligence, detecting malicious domains with high precision. This tool enhances the proactive capabilities of security operations centers and managed security service providers. Affected: WhoisXML API, Security Operations Centers (SOCs), Managed Security Service Providers (MSSPs)

Keypoints :

Launch of First Watch Malicious Domains Data Feed by WhoisXML API.…
Read More
MintsLoader: StealC and BOINC Delivery
eSentire’s Threat Response Unit (TRU) has identified a campaign involving MintsLoader malware, which delivers payloads like Stealc through spam emails. This campaign primarily affects organizations in the Electricity, Oil & Gas, and Legal Services sectors in the US and Europe. The malware employs various evasion techniques and utilizes a Domain Generation Algorithm (DGA) to communicate with its command and control servers.…
Read More
Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service
In December 2024, a new Adversary-in-the-Middle (AiTM) phishing kit known as Sneaky 2FA was identified, targeting Microsoft 365 accounts. This phishing kit, sold as Phishing-as-a-Service (PhaaS) by the cybercrime service “Sneaky Log”, utilizes sophisticated techniques including autograb functionality and anti-bot measures. The analysis reveals its operational methods, including the use of Telegram for distribution and support.…
Read More
Statistical Report on Malware Threat in Q4 2024
This report from AhnLab Security Intelligence Center (ASEC) analyzes malware collected in Q4 2024, categorizing it by type and providing detailed statistics on their distribution methods and features. Notably, CoinMiner and Banking malware are excluded due to low incidence. Affected: Infostealer, Downloader, Backdoor, Ransomware

Keypoints :

AhnLab’s RAPIT system is used to analyze and categorize malware.…
Read More
Casio warns employees, customers about data leak from October ransomware attack
Summary: In October, Japanese electronics manufacturer Casio suffered a ransomware attack that compromised data of thousands of employees, business partners, and customers. The incident was linked to phishing emails and claimed by the Underground ransomware gang, leading to significant data theft and operational disruptions.

Threat Actor: Underground ransomware gang | Underground ransomware gang Victim: Casio | Casio

Key Point :

6,456 employees, 1,931 business partners, and 91 customers had their data compromised.…
Read More
Neglected Domains Used in Malspam to Evade SPF and DMARC Security Protections
Summary: Cybersecurity researchers have identified ongoing malspam campaigns where threat actors spoof sender email addresses, often using neglected domains to bypass security measures. These campaigns include phishing attempts and extortion schemes targeting various sectors, utilizing tactics like QR codes and impersonation of trusted brands.

Threat Actor: Muddling Meerkat | Muddling Meerkat Victim: Various sectors including legal, government, and construction | Various sectors

Key Point :

Threat actors are using old, neglected domains to spoof sender addresses and evade security checks.…
Read More