top of page
The Cyber Security Blog
Cyber Attack's, Malware, CVE's and more.
NullMixer drops Redline Stealer, SmokeLoader and other malware
NullMixer is a dropper leading to an infection chain of a wide variety of malware families. NullMixer spreads via malicious websites that...
Oct 3, 20221 min read
Erbium Stealer, a new Infostealer enters the scene
Cluster25 has obtained a sample of Erbium InfoStealer, a new type of malware that can change its features to evade detection and has been...
Oct 3, 20221 min read
PowerPoint mouse-over event abused to deliver Graphite implants
Researchers from the Cluster25 Threat Intel Team collected and analyzed a lure document used to implant a variant of Graphite malware,...
Oct 3, 20221 min read
The Mystery of Metador | An Unattributed Threat Hiding in
Metador primarily targets telecommunications, internet service providers, and universities in several countries in the Middle East and...
Sep 25, 20221 min read
Void Balaur | The Sprawling Infrastructure of a Careless Mercenary
A detailed analysis of activity linked to the Void Balaur cyber mercenary group has been shared at this year’s LABScon, a conference on...
Sep 25, 20221 min read
NFT Malware Gets New Evasion Abilities
A new wave of malware that uses non-fungible tokens (NFT) to steal data has been uncovered by Morphisec Labs, a security firm that has...
Sep 25, 20221 min read
Spam email campaign targeting businesses delivers the Agent Tesla stealer
Spammers are increasingly using techniques similar to targeted attacks, in which they send emails in the name of real companies and send...
Sep 25, 20221 min read
Noberus Ransomware: Darkside and BlackMatter Successor Continues to Evolve its Tactics
Attackers deploying the Noberus (aka BlackCat, ALPHV) ransomware have been using new tactics, tools, and procedures (TTPs) in recent...
Sep 25, 20221 min read
Iranian State Actors Conduct Cyber Operations Against the Government of Albania | CISA
In July 2022, Iranian state cyber actors—identifying as “HomeLand Justice”—launched a destructive cyber attack against the Government of...
Sep 25, 20221 min read
Domain Shadowing: A Stealthy Use of DNS Compromise for Cybercrime
Cybercriminals compromise domain names to attack the owners or users of the domains directly, or use them for various nefarious...
Sep 25, 20221 min read
Gamaredon APT targets Ukrainian government agencies in new campaign
Cisco Talos discovered Gamaredon APT activity targeting users in Ukraine with malicious LNK files distributed in RAR archives. The...
Sep 20, 20221 min read
Slam! Anatomy of a Publicly-Available Ransomware Builder
The Slam Ransomware Builder first appeared in late 2021, with Slam ransomware payloads appearing in the wild shortly after (e.g.,...
Sep 20, 20221 min read
Malvertising on Microsoft Edge's News Feed pushes tech support scams
MalwareBytes has tracked and observed a malvertising campaign on the Microsoft Edge News Feed used to redirect victims to tech support...
Sep 20, 20221 min read
Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities
Iranian government-sponsored APT actors are exploiting known Fortinet and Microsoft Exchange vulnerabilities to gain initial access to a...
Sep 15, 20221 min read
Webworm: Espionage Attackers Testing and Using Older Modified RATs
Symantec, has gained insight into the current activities of a group they call Webworm. The group has developed customized versions of...
Sep 15, 20221 min read
A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities
We have recently observed malicious actors exploiting both recently disclosed and older Oracle WebLogic Server vulnerabilities to deliver...
Sep 14, 20221 min read
OriginLogger: A Look at Agent Tesla’s Successor
On March 4, 2019, one of the most well-known keyloggers used by criminals, called Agent Tesla, closed up shop due to legal troubles. In...
Sep 14, 20221 min read
Bumblebee Returns with New Infection Technique
Bumblebee is a replacement for the BazarLoader malware, which acts as a downloader and delivers known attack frameworks and open-source...
Sep 14, 20221 min read
Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free
The Arctic Wolf Labs team recently investigated a Lorenz ransomware intrusion, which leveraged a Mitel MiVoice VoIP appliance...
Sep 13, 20221 min read
New Wave of Espionage Activity Targets Asian Governments
A distinct group of espionage attackers who were formerly associated with the ShadowPad remote access Trojan (RAT) has adopted a new,...
Sep 13, 20221 min read
bottom of page