#malwareanalysis

New Linux Rootkit PUMAKIT Uses Advanced Stealth Techniques to Evade Detection

by

December 13, 2024 at 04:45AM Researchers have identified a sophisticated Linux rootkit named PUMAKIT, capable of privilege escalation and evasion from detection. It uses multi-stage architecture, advanced stealth techniques, and hooks into system calls to conceal its presence while communicating with command-and-control servers. This highlights increasing malware complexity on Linux systems. **Meeting Takeaways from December … Read more

New stealthy Pumakit Linux rootkit malware spotted in the wild

by

December 12, 2024 at 05:38PM A newly discovered Linux rootkit malware, Pumakit, incorporates stealth and privilege escalation techniques. It consists of multiple components, including a dropper and kernel/userland rootkits. Discovered by Elastic Security, it targets older Linux kernels for espionage and theft, employing sophisticated infection methods and hiding capabilities from system tools and logs. ### … Read more

Gamaredon Deploys Android Spyware “BoneSpy” and “PlainGnome” in Former Soviet States

by

December 12, 2024 at 09:51AM Gamaredon, a Russia-linked threat actor, has developed two Android spyware tools, BoneSpy and PlainGnome, targeting Russian-speaking victims in former Soviet states. These tools gather extensive data from infected devices. Their use marks the first instance of mobile-only malware in Gamaredon’s campaigns, which also includes attempts against NATO countries. ### Meeting … Read more

Cleo Patches Exploited Flaw as Security Firms Detail Malware Pushed in Attacks

by

December 12, 2024 at 06:08AM Cleo has updated its Harmony, VLTrader, and LexiCom file transfer tools to address a critical vulnerability (CVE-2024-50623) affecting several industries. The flaw allows unpatched systems to be exploited for file access and remote code execution. Security firms are analyzing related malware linked to ongoing attacks, suggesting widespread exploitation. ### Meeting … Read more

New EagleMsgSpy Android spyware used by Chinese police, researchers say

by

December 11, 2024 at 04:06PM A new Android spyware, EagleMsgSpy, developed by Wuhan Chinasoft Token, facilitates surveillance by Chinese law enforcement. Operational since 2017, it targets various data types, including messages and location. Evidence ties it to public security bureaus, suggesting systematic government use. An iOS version is suspected but unverified. ### Meeting Takeaways: EagleMsgSpy … Read more

Ongoing Phishing and Malware Campaigns in December 2024

by

December 10, 2024 at 05:12AM Cybersecurity threats are evolving, with ongoing zero-day attacks using corrupted files largely undetected, as seen in a recent analysis by ANY.RUN. Additionally, fileless malware and phishing tactics are on the rise. Utilizing advanced tools like ANY.RUN’s Interactive Sandbox helps organizations identify and analyze these threats effectively. ### Meeting Takeaways (Dec … Read more

MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks

by

December 5, 2024 at 02:38AM Trend Micro researchers uncovered the Earth Minotaur group utilizing the MOONSHINE exploit kit, targeting vulnerabilities in instant messaging apps, particularly against Tibetan and Uyghur communities. They discovered an Android backdoor, DarkNimbus, which also runs on Windows. MOONSHINE has evolved since 2019, with over 55 identified servers by 2024. ### Meeting … Read more

Russia-Linked Turla Exploits Pakistani Hackers’ Servers to Target Afghan and Indian Entities

by

December 4, 2024 at 12:54PM The Russia-linked APT group Turla has infiltrated the command-and-control servers of the Pakistan-based Storm-0156 hacking group since December 2022. Turla utilizes this access to deploy custom malware against Afghan government networks, demonstrating a tactic of leveraging others’ infrastructure for intelligence gathering, complicating attribution and enhancing their operational reach. ### Meeting … Read more

Venom Spider Spins Web of New Malware for MaaS Platform

by

December 3, 2024 at 11:24AM The “Venom Spider” malware-as-a-service platform has introduced new capabilities via the RevC2 backdoor and Venom Loader, detected in recent cyberattacks. Researchers report these tools can steal sensitive data and enable remote code execution. Future enhancements to this platform are expected, along with provided defenses against the malware. ### Meeting Takeaways: … Read more

Gafgyt Malware Targeting Docker Remote API Servers

by

December 3, 2024 at 04:49AM Trend Micro Research reports that Gafgyt malware is now targeting misconfigured Docker Remote API servers, a shift from its traditional focus on IoT devices. This allows attackers to deploy DDoS attacks. Recommendations include strengthening access controls, monitoring activities, and ensuring adherence to container security best practices. ### Meeting Takeaways on … Read more