Tag: TROJAN

Qbot is Back Connect
QBot, a modular information stealer, has resurfaced following law enforcement actions aimed at its operators. Recent research indicates the use of DNS tunneling in conjunction with Zloader, revealing connections to new backConnect malware that may be utilized in ransomware attacks. Affected: QBot operators, financial institutions, cybersecurity sector

Keypoints :

QBot, also known as Qakbot or Pinkslipbot, has been active since 2007.…
Read More
DigitalPulse Proxyware Being Distributed Through Ad Pages
AhnLab Security Intelligence Center (ASEC) has identified a new proxyjacking attack that installs proxyware through advertisement pages of freeware software sites. The proxyware, signed with a Netlink Connect certificate, is similar to the DigitalPulse proxyware used in previous attacks. Users may unknowingly install a program called AutoClicker, which hijacks their network bandwidth for the benefit of threat actors.…
Read More
Securonix Threat Labs 2024 Annual Autonomous Threat Sweeper Intelligence Insights
The 2024 Annual Cyber Threat Report reveals a significant increase in cyber threats, including advanced persistent threats (APTs) and evolving tactics used by attackers. Key incidents include the resurgence of LockBit ransomware, exploitation of vulnerabilities in widely-used technologies, and notable data breaches affecting major organizations. Affected: Ivanti Connect Secure, GlobalProtect, CrowdStrike, Snowflake, Palo Alto Networks

Keypoints :

Emerging threats exploit vulnerabilities in Ivanti Connect Secure and GlobalProtect VPN.…
Read More

In recent months, Indonesia has found itself at the center of two significant global cyber threats, highlighting the growing sophistication and reach of state-sponsored and financially motivated hacking groups. These incidents underscore the importance of cybersecurity vigilance in the face of increasingly complex attacks.

FBI Disrupts PlugX Malware Campaign Affecting Indonesia

The U.S.…

Read More
FBI Uses Malware’s Own ‘Self-Delete’ Trick to Erase Chinese PlugX From US Computers
Summary: The FBI, in collaboration with French law enforcement and cybersecurity firm Sekoia.io, successfully utilized the self-delete feature of the PlugX malware to remove it from over 4,200 infected computers in the U.S. This operation targeted the Mustang Panda group, a hacking organization linked to the Chinese government, which has been using PlugX as a Remote Access Trojan since 2008.…
Read More
North Korea’s Lazarus APT Evolves Developer-Recruitment Attacks
Summary: North Korea’s Lazarus group has initiated a new campaign, dubbed Operation 99, targeting software developers through deceptive job postings on LinkedIn. The attackers lure victims into downloading malicious Git repositories that steal sensitive data, including source code and cryptocurrency. This sophisticated operation showcases the group’s evolving tactics, including the use of AI-generated profiles to enhance credibility and deception.…
Read More
Kimsuky Hacking Group’s Malware Attack on the Korean Defense Industry Association – Defense Industry Digital Innovation Seminar (Planned) (2025.1.12)
This article discusses the malicious activities of the North Korean hacking group Kimsuky, which targets the Korea Association of Defense Industry Studies. The group is known for its various espionage missions, including the distribution of malware disguised as a seminar invitation. The malware is delivered via email and executes harmful scripts upon opening an attached document.…
Read More
The Feed 2025, 01, 14
A summary of recent cybersecurity threats including ransomware targeting AWS S3 buckets, a macOS vulnerability allowing SIP bypass, a cyber espionage campaign linked to Russia, and exploitation of a critical RCE vulnerability in Aviatrix Controller. Affected: AWS, macOS, Aviatrix, Microsoft Office

Keypoints :

Codefinger ransomware targets Amazon S3 buckets using SSE-C.…
Read More