October 13, 2023 at 11:24AM A new cyber attack campaign called PEAPOD has targeted EU military personnel and political leaders working on gender equality. Cybersecurity firm Trend Micro has attributed the attacks to a threat actor known as Void Rabisu, which is associated with Cuba ransomware. The group conducts both financial motivated and espionage attacks, … Read more
October 13, 2023 at 08:30AM The APT actor ToddyCat has been linked to new malicious tools used for data exfiltration, providing insight into their tactics. Kaspersky discovered the group last year, connecting it to attacks on high-profile entities in Europe and Asia. The tools include loaders, a Trojan, a file collection tool, a Dropbox uploader, … Read more
October 13, 2023 at 07:06AM DarkGate, a piece of malware, is being spread through instant messaging platforms like Skype and Microsoft Teams. The malware is delivered disguised as a PDF document and triggers the download and execution of an AutoIt script that launches the malware. The malware can harvest sensitive data, conduct cryptocurrency mining, and … Read more
October 13, 2023 at 03:59AM Void Rabisu, a threat actor associated with financially motivated ransomware attacks, has shifted its focus to targeted campaigns on Ukraine and countries supporting Ukraine. They have developed a new variant called ROMCOM, which they used in campaigns targeting EU military personnel and political leaders working on gender equality initiatives. The … Read more
October 13, 2023 at 03:24AM The DarkGate malware is being distributed through messaging platforms like Skype and Teams. Once installed, additional malicious payloads are introduced. The campaign has been most active in the Americas, followed by Asia, the Middle East, and Africa. DarkGate is a commodity loader that executes various actions, including remote access, cryptocurrency … Read more
October 12, 2023 at 07:46PM The US government has updated the list of tools used by AvosLocker ransomware affiliates in attacks to include open-source utilities and custom PowerShell and batch scripts. The FBI and CISA have shared a YARA rule for detecting malware disguised as a legitimate network monitoring tool. AvosLocker affiliates use legitimate software … Read more
October 12, 2023 at 04:44PM Microsoft announced that it is deprecating and eventually removing VBScript from future Windows releases. Although the programming language is nearly 30 years old, cybercriminals still use it to gain access to targets. Microsoft will make VBScript a feature on demand and users can turn it on if desired, but there … Read more
October 12, 2023 at 10:55AM A WordPress backdoor that disguises itself as a legitimate plugin has been discovered by security firm Defiant. The backdoor can run as a plugin and perform various functions, including creating an admin account and serving malicious content based on specific filters. It can also be operated remotely by the threat … Read more
October 12, 2023 at 10:38AM Researchers have discovered a sophisticated malware hidden within an authentic-looking WordPress caching plugin. This malware can create admin accounts and remotely activate plugins, giving threat actors complete control over infected websites. The malware can be difficult to detect and has features like conditional content filtering and file modification capabilities. WordPress … Read more
October 12, 2023 at 10:34AM A campaign known as “Stayin’ Alive” has been targeting government organizations and telecom service providers in Asia with disposable malware since 2021, according to cybersecurity firm Check Point. The attacks originate from the Chinese group ToddyCat and use spear-phishing emails to distribute malware loaders and backdoors. Check Point believes there … Read more