For many years, cybercriminals have used social engineering and phishing attacks to trick unsuspected victims into providing their...

leachGap ransomware was first reported in Feb 2021 by a researcher named Petrovic on Twitter. This ransomware variant that K7 Security...

QBOT, also known as QAKBOT, is a modular Trojan active since 2007 used to download and run binaries on a target machine. QBOT is a...

Recently, a simple and short email with a suspicious RTF attachment that had been sent to a telecommunications agency in South Asia...

Kimsuky (also known as Thallium, Black Banshee and Velvet Chollima) is a prolific and active threat actor primarily targeting...

Cybereason GSOC team analysts have analyzed a case that involved a Bumblebee Loader infection. Following this introduction, we describe...

SANS has analyzed an IcedID (Bokbot) infection based on Monster Libra (also known as TA551 or Shathak). REFERENCE:...

n March 2022 one of the oldest state-sponsored hacker groups, APT41, breached government networks in six US states, including by...

In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and...

DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It...

Threat actors behind the XCSSET malware have been relatively quiet since last year. However, new activity beginning around April 2022 and...

Recently Zscaler ThreatLabz observed a Grandoreiro campaign targeting organizations in the Spanish-speaking nations of Mexico and Spain...

LockBit 3.0 aka “LockBit Black”, noted in June of this year has coincided with a large increase of victims being published to the LockBit...

Today's diary is a quick post of an Astaroth (Guildma) malware infection SANS generated on Friday 2022-08-19 from a malicious...

Security researchers observed a malspam campaign in late June attributed to the FIN7 APT group. One of the samples was also reported on...

Since 2018, security researchers tracked a financially-motivated cybercrime actor, TA558, targeting hospitality, travel, and related...

Security researchers have been tracking UNC3890, a cluster of activity targeting Israeli shipping, government, energy and healthcare...

The ASEC analysis team recently discovered malware strains installing proxyware without the user’s permission. Users whose systems are...

Malicious and unwanted add-ons are often distributed through official marketplaces. In 2020, Google removed 106 browser extensions from...

Over the past 3 years, Recorded Future have observed RedAlpha registering and weaponizing hundreds of domains spoofing organizations such...