Threat Research

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process refers to a security vulnerability in WinRAR versions prior to 6.23, where attackers can exploit the software to execute arbitrary commands or binaries....

Identifies the execution of a ".CPL" file from the user's temporary directory using the "Control_RunDLL" export function of the Shell32 DLL. This activity has been observed in several Raspberry Robin variants....

Creation of .conf files associated with VenomRAT, AsyncRAT, and Lummac samples observed in the wild....

In October and November 2024, a surge in activity was observed by two botnets, the Mirai variant "FICORA" and the Kaiten variant "CAPSAICIN," both exploiting aging D-Link vulnerabilities. These vulnerabilities, primarily through the HNAP interface, allow remote attackers to execute malicious commands....

The NodeStealer malware has evolved from JavaScript to Python, enhancing its ability to steal sensitive data. Our team uncovered this updated variant in a campaign targeting a Malaysian educational institution, linked to a Vietnamese group. It harvests browser data, credit card details, and Facebook Ads Manager accounts for financial information....

The Lazarus Group, a threat actor linked to North Korea, targeted employees of a nuclear-related business using a sophisticated infection chain. The attacks, part of Operation Dream Job (also known as NukeSped), led to the installation of a new modular backdoor called CookiePlus....

Meduza Stealer is a rising malware threat designed to harvest sensitive information from compromised systems. Discovered in 2023, it targets various personal and financial data, such as login credentials, payment details, and cryptocurrency wallets....

In a recent incident, an attacker used social engineering through a Microsoft Teams call to impersonate a client and gain remote access to a victim's system. The attacker successfully tricked the victim into downloading AnyDesk, a remote access tool, and dropped suspicious files, including Trojan.AutoIt.DARKGATE.D....

Makop ransomware, an offshoot of the PHOBOS variant, actively targets organizations, including critical sectors, by encrypting files and demanding ransom payments in bitcoin. It exploits various attack vectors, such as unsecured RDP services, phishing emails, malicious attachments, and torrent websites....

With the holiday season in full swing, threat actors are exploiting people's interest in deals, job opportunities, and year-end bonuses. Our researchers have noted a rise in seasonal, themed campaigns delivering malware, fraud, and credential phishing attacks....

Earth Koshchei executed a sophisticated attack campaign using rogue Remote Desktop Protocol (RDP) tactics. The group employed red team tools for espionage and data exfiltration, utilizing spear-phishing emails to trick victims into connecting to malicious RDP servers via a compromised configuration file....

Recent advancements in the code understanding capabilities of LLMs have raised concerns about their misuse to generate novel malware. While LLMs struggle to create malware from scratch, criminals can leverage them to rewrite or obfuscate existing malware, complicating detection efforts....

Detects the execution of more.com and vbc.exe within the process tree, a behavior linked to samples associated with Lummac Stealer. The Lummac payload is injected into the vbc.exe process....

"QuickAssist Execution" refers to the detection of the execution of the Microsoft Quick Assist tool ("QuickAssist.exe"). This utility is designed for remote assistance, allowing users to receive or provide support. However, attackers can exploit it to gain unauthorized remote access to a victim's system....

With smartphones playing a central role in daily life, malicious apps have become more deceptive and sophisticated. Recently, we identified a seemingly innocent app called “BMI CalculationVsn” on the Amazon Appstore, which secretly stole package names of installed apps and intercepted incoming SMS messages while posing as a health tool....