#RemoteAccessTrojan

Iranian Hackers Deploy WezRat Malware in Attacks Targeting Israeli Organizations

by

November 15, 2024 at 01:00PM Cybersecurity company Check Point has identified a remote access trojan named WezRat, attributed to Iranian state-sponsored hackers. It enables malicious activities like keylogging and file uploads. Distributed via phishing emails mimicking Israeli authorities, WezRat shows ongoing development, indicating significant investment in cyber espionage targeting various global entities. ### Meeting Takeaways: … Read more

Cybercriminals Use Excel Exploit to Spread Fileless Remcos RAT Malware

by

November 11, 2024 at 01:36AM Cybersecurity researchers revealed a new phishing campaign exploiting Remcos RAT, utilizing a malicious Excel attachment to execute a fileless variant. This allows attackers to remotely control compromised computers and gather sensitive data. Additionally, phishing tactics have evolved to include using legitimate DocuSign accounts and ZIP file concatenation to bypass security … Read more

CERT-UA Identifies Malicious RDP Files in Latest Attack on Ukrainian Entities

by

October 26, 2024 at 12:25AM The Computer Emergency Response Team of Ukraine (CERT-UA) warns of a malicious email campaign targeting government and military bodies, linked to the Russian hacking group APT29. These emails use fake AWS domains to deploy Remote Desktop Protocol files for unauthorized access. CERT-UA also reports multiple ongoing cyber threats against Ukraine. … Read more

New Malware Campaign Uses PureCrypter Loader to Deliver DarkVision RAT

by

October 15, 2024 at 11:54AM A new malware campaign, utilizing the PureCrypter loader, delivers the DarkVision RAT, enabling capabilities like keylogging and remote access. Disclosed by Zscaler ThreatLabz, the multi-stage process involves a .NET executable and persistence features. DarkVision RAT is affordable, making it appealing to cybercriminals seeking versatile malicious tools. ### Meeting Takeaways – … Read more

Hackers Hide Remcos RAT in GitHub Repository Comments

by

October 9, 2024 at 05:06PM GitHub and GitLab are increasingly targeted for malicious activities, including a malware campaign using legitimate GitHub repositories and an exploit allowing unauthorized access to users in GitLab. Attackers leverage the platforms’ trusted reputations to deploy malware, highlighting significant security risks for organizations using these collaborative tools. ### Meeting Takeaways: 1. … Read more

Sophisticated RAT Hides Behind P.Diddy Scandal Lures

by

September 25, 2024 at 12:50PM Threat actors are exploiting public interest in a scandal involving rapper Sean “Diddy” Combs to spread spyware through files claiming to reveal deleted social media posts. Researchers have found PySilon RAT disguised as “PdiddySploit,” posing serious security threats. Attackers are leveraging the scandal to spread malware, urging caution when interacting … Read more

New Brazilian-Linked SambaSpy Malware Targets Italian Users via Phishing Emails

by

September 19, 2024 at 10:30AM A new malware called SambaSpy targets Italian users through phishing. It uses HTML attachments or links to deploy a multi-functional RAT payload. The attack chains involve redirecting to a legitimate invoice or a malicious web server. SambaSpy can perform various functions, such as managing files, remote desktop, keylogging, and stealing … Read more

Packed With Features, ‘SambaSpy’ RAT Delivers Hefty Punch

by

September 18, 2024 at 05:00PM SambaSpy, a remote access Trojan (RAT), is a sophisticated tool with various spying and data-stealing functions, initially targeting Italian victims and potentially expanding to other countries. The malware’s capabilities include file management, remote control, password stealing, and more, making it a versatile and powerful tool for threat actors. It is … Read more

Malicious npm Packages Mimicking ‘noblox.js’ Compromise Roblox Developers’ Systems

by

September 2, 2024 at 12:24AM Developers of Roblox are being targeted by a persistent campaign that uses fake npm packages to compromise systems, mimicking the popular ‘noblox.js’ library. Attackers employ brandjacking and starjacking to give a facade of legitimacy. Malicious packages steal data and deploy malware, with the end goal being to deploy Quasar RAT … Read more

Hunters International Disguises SharpRhino RAT as Legitimate Network Admin Tool

by

August 6, 2024 at 12:41PM Hunters International, an emerging ransomware group, has been rapidly advancing with a new remote access Trojan called SharpRhino, deploying Hive ransomware to attack IT professionals. The group leverages typosquatting domains and valid code-signing certificates to install the malware. SharpRhino’s purpose is to ensure persistence and control over targeted systems for … Read more