August 7, 2024 at 06:57AM An unnamed media organization in South Asia was targeted using a previously undocumented Go-based backdoor called GoGra, which utilizes the Microsoft Graph API for C&C purposes. Other new malware families have employed similar techniques, suggesting that threat actors are increasingly utilizing legitimate cloud services for low-key operations. Based on the … Read more
June 6, 2024 at 06:18AM Threat actors are employing legitimate packer software like BoxedApp to distribute malware, targeting financial and government sectors. Malware families like Agent Tesla and Remcos are being propagated using NSIXloader. Another packer codenamed Kiteshield has been used by threat actors to target Linux systems. These techniques aim to evade endpoint security … Read more
March 18, 2024 at 04:58AM APT & Targeted Attacks Summary An APT campaign named Earth Krahang targets government entities worldwide, with a focus in Southeast Asia, but also in Europe, America, and Africa. Using public-facing servers and spear phishing emails, the threat actor aims to conduct cyberespionage by abusing compromised government infrastructure. The campaign involves … Read more
January 19, 2024 at 10:03PM TA866, a threat actor, has returned after a hiatus, launching a large phishing campaign to distribute malware such as WasabiSeed and Screenshotter. The campaign targeted North America with PDFs containing OneDrive URLs that initiate a multi-step infection chain. Other actors, such as TA571, are involved in spam email campaigns to … Read more
January 12, 2024 at 09:18AM Suspected nation-state actors exploited two zero-day vulnerabilities in Ivanti Connect Secure VPN, deploying multiple malware families to gain backdoor access to devices. The attacks, attributed to a Chinese espionage actor, targeted less than 10 customers and are expected to be highly-targeted. Patches are anticipated on January 22. Mandiant identified the … Read more
January 2, 2024 at 03:06PM Info-stealing malware can still access compromised Google accounts even after passwords are changed, due to a zero-day exploit first mentioned by the cybercriminal “PRISMA.” The exploit involves regenerating session tokens to access emails and cloud storage. CloudSEK identified the exploit in the undocumented Google OAuth endpoint “MultiLogin.” The discover reveals … Read more