In recent developments, the notorious ShadowPad malware has continued to be utilized by various Chinese cyber threat groups since its emergence in 2017. This Windows backdoor allows attackers to deploy additional malicious modules or exfiltrate sensitive information, raising serious concerns among cybersecurity professionals. SentinelOne researchers Yi-Jhen Hsieh and Joey Chen…
On Monday, cybersecurity researchers unveiled the existence of a newly identified re-implementation of the notorious Cobalt Strike Beacon for both Linux and Windows operating systems. This variant, dubbed “Vermilion Strike,” has been actively targeting a range of sectors, including government, telecommunications, IT, and financial institutions. This advanced yet undetected penetration…
A recent report highlights the cyber espionage group APT41, tied to a series of malware campaigns that leverage COVID-themed phishing strategies to target individuals in India. This revelation comes from an analysis by the BlackBerry Research and Intelligence team, which has connected various aspects of the group’s operational infrastructure. According…
Recent intelligence reveals a troubling collaboration between the TrickBot Trojan operators and the Shathak threat group. This partnership aims to deliver various forms of malware, culminating in the deployment of Conti ransomware on compromised systems. This evolution highlights the sophistication of recent cybercrime tactics, signaling an increasing urgency for businesses…
Recent cybersecurity developments have revealed that cybercriminals are actively exploiting the newly discovered “Log4Shell” vulnerability in the widely used Log4j library. This vulnerability has enabled attackers to exploit unpatched servers, allowing them to deploy cryptocurrency miners, utilize Cobalt Strike for additional malicious objectives, and integrate compromised devices into expanding botnets.…
Recent investigations into the Qakbot malware, often described as a multi-faceted threat, have revealed its infection strategies, segmented into distinct components. Microsoft has characterized these “building blocks” as vital for the proactive detection and neutralization of this threat, aiming to enhance cybersecurity measures significantly. The Microsoft 365 Defender Threat Intelligence…
Recent cybersecurity analysis has uncovered the deployment of a newly identified binary called “Owowa,” specifically targeting Microsoft Exchange’s Outlook Web Access servers. This malicious Internet Information Services (IIS) web server module seeks to extract user credentials and facilitate remote command execution on compromised systems. The Owowa module, reportedly written in…
Recent research has unveiled an advanced malware campaign characterized by its use of legitimate code signing certificates to elude cybersecurity measures. This stealthy approach aims to deploy notorious payloads such as Cobalt Strike and BitRAT across compromised systems. The loader, identified as “Blister” by Elastic Security experts, exhibits an alarming…
A recently identified strain of ransomware, dubbed “White Rabbit,” has emerged, likely linked to the financially motivated threat actor known as FIN8. This malware was reportedly employed in an attack against a U.S.-based local bank in December 2021. According to research by Trend Micro, the technical characteristics of White Rabbit…
