Tag Cobalt Strike

Chinese Hackers Leverage Trimble Cityworks Vulnerability to Access U.S. Government Networks

May 22, 2025
Vulnerability / Threat Intelligence

A Chinese-speaking threat actor, identified as UAT-6382, has exploited a recently patched remote-code-execution vulnerability in Trimble Cityworks to deploy Cobalt Strike and VShell. According to an analysis by Cisco Talos researchers Asheer Malhotra and Brandon White, “UAT-6382 effectively targeted CVE-2025-0944, conducted reconnaissance, and quickly implemented various web shells and custom malware for sustained access.” Following their infiltration, UAT-6382 showed significant interest in systems related to utility management. Cisco Talos observed these attacks beginning in January 2025, specifically aimed at the enterprise networks of local government entities in the U.S. CVE-2025-0944, with a CVSS score of 8.6, pertains to a vulnerability in the GIS-focused asset management software that could allow for remote code execution. The flaw has been patched.

Chinese Hackers Exploit Trimble Cityworks Vulnerability to Gain Access to U.S. Government Networks May 22, 2025 In a concerning cybersecurity development, a group of Chinese-speaking hackers identified as UAT-6382 has been implicated in exploiting a recently patched vulnerability in Trimble Cityworks. This flaw enabled the group to execute remote code…

Read More

Chinese Hackers Leverage Trimble Cityworks Vulnerability to Access U.S. Government Networks

May 22, 2025
Vulnerability / Threat Intelligence

A Chinese-speaking threat actor, identified as UAT-6382, has exploited a recently patched remote-code-execution vulnerability in Trimble Cityworks to deploy Cobalt Strike and VShell. According to an analysis by Cisco Talos researchers Asheer Malhotra and Brandon White, “UAT-6382 effectively targeted CVE-2025-0944, conducted reconnaissance, and quickly implemented various web shells and custom malware for sustained access.” Following their infiltration, UAT-6382 showed significant interest in systems related to utility management. Cisco Talos observed these attacks beginning in January 2025, specifically aimed at the enterprise networks of local government entities in the U.S. CVE-2025-0944, with a CVSS score of 8.6, pertains to a vulnerability in the GIS-focused asset management software that could allow for remote code execution. The flaw has been patched.

New QBot Banking Trojan Campaign Exploits Business Emails to Distribute Malware

April 17, 2023
Financial Security / Malware

Recent findings by Kaspersky reveal a fresh QBot malware campaign that uses compromised business correspondence to deceive victims into installing the malicious software. This ongoing operation, which began on April 4, 2023, is primarily targeting users in Germany, Argentina, Italy, Algeria, Spain, the U.S., Russia, France, the U.K., and Morocco.

QBot, also known as Qakbot or Pinkslipbot, has been active since at least 2007. It not only steals passwords and cookies from web browsers but also acts as a backdoor for delivering next-stage payloads like Cobalt Strike or ransomware. Distributed through phishing campaigns, QBot has undergone continuous updates to incorporate techniques that evade detection, such as anti-VM, anti-debugging, and anti-sandbox measures. Notably, it emerged as the most prevalent malware in March 2023, according to Check Point. In its early distribution, it relied on infected websites and other methods.

New QBot Banking Trojan Campaign Exploits Business Emails to Distribute Malware April 17, 2023 Financial Security / Malware Recent research from Kaspersky has unveiled a new initiative utilizing the QBot banking Trojan to compromise business email communications as a method to disseminate malware. This latest campaign began on April 4,…

Read More

New QBot Banking Trojan Campaign Exploits Business Emails to Distribute Malware

April 17, 2023
Financial Security / Malware

Recent findings by Kaspersky reveal a fresh QBot malware campaign that uses compromised business correspondence to deceive victims into installing the malicious software. This ongoing operation, which began on April 4, 2023, is primarily targeting users in Germany, Argentina, Italy, Algeria, Spain, the U.S., Russia, France, the U.K., and Morocco.

QBot, also known as Qakbot or Pinkslipbot, has been active since at least 2007. It not only steals passwords and cookies from web browsers but also acts as a backdoor for delivering next-stage payloads like Cobalt Strike or ransomware. Distributed through phishing campaigns, QBot has undergone continuous updates to incorporate techniques that evade detection, such as anti-VM, anti-debugging, and anti-sandbox measures. Notably, it emerged as the most prevalent malware in March 2023, according to Check Point. In its early distribution, it relied on infected websites and other methods.

Experts Reveal Year-Long Cyber Assault on IT Firm Using Custom Malware RDStealer

A sophisticated cyber attack targeting an East Asian IT company involved the use of a custom malware, RDStealer, developed in Golang. “The operation spanned over a year, aimed at stealing credentials and data,” stated Bitdefender security researcher Victor Vrabie in a report shared with The Hacker News. Evidence from the Romanian cybersecurity firm indicates that the operation, dubbed RedClouds, began in early 2022 and reflects the interests of China-based threat actors. Initially, the campaign utilized common remote access and post-exploitation tools such as AsyncRAT and Cobalt Strike, but it later shifted to custom malware in late 2021 or early 2022 to evade detection. A key evasion strategy involved using Microsoft Windows folders typically excluded from security scans, like System32 and Program Files, to conceal the malware.

Experts Uncover Extended Cyber Attack Targeting East Asian IT Firm with Custom Malware RDStealer June 20, 2023 In a significant security breach, cybersecurity experts have revealed a prolonged and sophisticated cyber attack on an information technology firm located in East Asia, spearheaded by a custom malware strain known as RDStealer.…

Read More

Experts Reveal Year-Long Cyber Assault on IT Firm Using Custom Malware RDStealer

A sophisticated cyber attack targeting an East Asian IT company involved the use of a custom malware, RDStealer, developed in Golang. “The operation spanned over a year, aimed at stealing credentials and data,” stated Bitdefender security researcher Victor Vrabie in a report shared with The Hacker News. Evidence from the Romanian cybersecurity firm indicates that the operation, dubbed RedClouds, began in early 2022 and reflects the interests of China-based threat actors. Initially, the campaign utilized common remote access and post-exploitation tools such as AsyncRAT and Cobalt Strike, but it later shifted to custom malware in late 2021 or early 2022 to evade detection. A key evasion strategy involved using Microsoft Windows folders typically excluded from security scans, like System32 and Program Files, to conceal the malware.

Kimsuky Hackers from North Korea Face Data Breach After Insider Leaks Information Online

A notable breach has emerged from North Korea’s Kimsuky espionage group, with insiders leaking hundreds of gigabytes of sensitive internal files and tools to the public. This incident, which surfaced in early June 2025, reveals critical backdoors, phishing mechanisms, and reconnaissance strategies employed by the state-sponsored threat actor—marking an unusual…

Read MoreKimsuky Hackers from North Korea Face Data Breach After Insider Leaks Information Online

Hackers Exploit Microsoft Teams to Distribute Enhanced Matanbuchus 3.0 Malware to Targeted Companies

July 16, 2025
Threat Intelligence / Vulnerability

Cybersecurity researchers have identified a new variant of the established malware loader Matanbuchus, which boasts enhanced stealth features to evade detection. Matanbuchus, a malware-as-a-service (MaaS) offering, serves as a launchpad for various next-stage payloads, including Cobalt Strike beacons and ransomware. Initially advertised in February 2021 on Russian-speaking cybercrime forums for a rental fee of $2,500, the malware has been utilized in ClickFix-like schemes to deceive users into visiting compromised yet legitimate sites. Over time, Matanbuchus’ delivery methods have evolved, incorporating phishing emails with malicious Google Drive links, drive-by downloads from compromised websites, harmful MSI installers, and malvertising. It has been instrumental in deploying numerous secondary payloads such as DanaBot, QakBot, and Cobalt Strike, all of which are precursors to ransomware attacks.

Hackers Exploit Microsoft Teams to Distribute Matanbuchus 3.0 Malware Targeting Businesses August 16, 2025 In a concerning development within the realm of cybersecurity, researchers have identified a new variant of the Matanbuchus malware loader, which has been refined to enhance its stealth and evade detection by security systems. Matanbuchus represents…

Read More

Hackers Exploit Microsoft Teams to Distribute Enhanced Matanbuchus 3.0 Malware to Targeted Companies

July 16, 2025
Threat Intelligence / Vulnerability

Cybersecurity researchers have identified a new variant of the established malware loader Matanbuchus, which boasts enhanced stealth features to evade detection. Matanbuchus, a malware-as-a-service (MaaS) offering, serves as a launchpad for various next-stage payloads, including Cobalt Strike beacons and ransomware. Initially advertised in February 2021 on Russian-speaking cybercrime forums for a rental fee of $2,500, the malware has been utilized in ClickFix-like schemes to deceive users into visiting compromised yet legitimate sites. Over time, Matanbuchus’ delivery methods have evolved, incorporating phishing emails with malicious Google Drive links, drive-by downloads from compromised websites, harmful MSI installers, and malvertising. It has been instrumental in deploying numerous secondary payloads such as DanaBot, QakBot, and Cobalt Strike, all of which are precursors to ransomware attacks.

Exploitation of Ivanti Vulnerabilities Leads to MDifyLoader Deployment and In-Memory Cobalt Strike Attacks

Cybersecurity researchers have revealed new insights into MDifyLoader, a malware recently linked to cyber attacks exploiting security weaknesses in Ivanti Connect Secure (ICS) appliances. A report from JPCERT/CC highlights that threat actors have exploited vulnerabilities CVE-2025-0282 and CVE-2025-22457 between December 2024 and July 2025 to deploy MDifyLoader, which is then utilized to initiate in-memory Cobalt Strike operations. CVE-2025-0282 is a critical vulnerability allowing unauthenticated remote code execution, addressed by Ivanti in January 2025. Meanwhile, CVE-2025-22457, patched in February 2025, involves a stack-based buffer overflow potentially enabling arbitrary code execution. Previous findings indicate that CVE-2025-0282 was actively weaponized in the wild as a zero-day beginning in mid-December 2024, facilitating the delivery of various malware families.

Ivanti Vulnerabilities Exploited to Deploy MDifyLoader and Initiate In-Memory Cobalt Strike Attacks In a recent cybersecurity report released by JPCERT/CC, researchers have uncovered a sophisticated new malware strain known as MDifyLoader, which is linked to a series of cyber incursions targeting Ivanti Connect Secure (ICS) appliances. The findings detail how…

Read More

Exploitation of Ivanti Vulnerabilities Leads to MDifyLoader Deployment and In-Memory Cobalt Strike Attacks

Cybersecurity researchers have revealed new insights into MDifyLoader, a malware recently linked to cyber attacks exploiting security weaknesses in Ivanti Connect Secure (ICS) appliances. A report from JPCERT/CC highlights that threat actors have exploited vulnerabilities CVE-2025-0282 and CVE-2025-22457 between December 2024 and July 2025 to deploy MDifyLoader, which is then utilized to initiate in-memory Cobalt Strike operations. CVE-2025-0282 is a critical vulnerability allowing unauthenticated remote code execution, addressed by Ivanti in January 2025. Meanwhile, CVE-2025-22457, patched in February 2025, involves a stack-based buffer overflow potentially enabling arbitrary code execution. Previous findings indicate that CVE-2025-0282 was actively weaponized in the wild as a zero-day beginning in mid-December 2024, facilitating the delivery of various malware families.

FBI and CISA Alert: Interlock Ransomware Threatens Critical Infrastructure

The Federal Bureau of Investigation (FBI), in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), and the Multi-State Information Sharing and Analysis Center (MS-ISAC), has issued a critical alert regarding the intensified activities of the Interlock ransomware group. This group is…

Read MoreFBI and CISA Alert: Interlock Ransomware Threatens Critical Infrastructure

China-Supported Hackers Ramp Up Attacks on Taiwan’s Chip Manufacturing Sector

Anti-Phishing, DMARC, Cyberwarfare / Nation-State Attacks, Fraud Management & Cybercrime State-Sponsored Groups Target Semiconductor Sector with Spear-Phishing Attacks Prajeet Nair (@prajeetspeaks) • July 17, 2025 Chinese state-aligned hackers have escalated their espionage tactics against Taiwan’s semiconductor ecosystem through concentrated spear-phishing efforts. (Image: Shutterstock) Chinese state-aligned hackers are intensifying their espionage…

Read MoreChina-Supported Hackers Ramp Up Attacks on Taiwan’s Chip Manufacturing Sector

Exposed Shellter Elite Tool is Driving Global Infostealer Attacks

A recent report outlines the security implications of the advanced hacking tool, Shellter Elite, which has been leaked and is now exploited by cybercriminals. The report delves into evasion techniques and the associated infostealer campaigns. Shellter Elite, originally designed for cybersecurity professionals, has entered the hands of malicious actors following…

Read MoreExposed Shellter Elite Tool is Driving Global Infostealer Attacks