Cybersecurity researchers have uncovered a novel malware campaign that leverages Google Sheets as a command-and-control (C2) mechanism. The activity, detected by Proofpoint starting August 5, 2024, impersonates tax authorities from governments in Europe, Asia, and the U.S., with the goal of targeting over 70 organizations worldwide by means of a
ESET researchers uncovered a crimeware campaign that targeted clients of three Czech banks. The malware used, which we have named NGate, has the unique ability to relay data from victims’ payment cards, via a malicious app installed on their Android devices, to the attacker’s rooted Android phone. Key points of
Aug 19, 2024Ravie LakshmananThreat Intelligence / Cryptocurrency A new type of malware called UULoader is being used by threat actors to deliver next-stage payloads like Gh0st RAT and Mimikatz. The Cyberint Research Team, which discovered the malware, said it’s distributed in the form of malicious installers for legitimate applications targeting
Aug 14, 2024Ravie LakshmananMalware / Network Security An ongoing social engineering campaign with alleged links to the Black Basta ransomware group has been linked to “multiple intrusion attempts” with the goal of conducting credential theft and deploying a malware dropper called SystemBC. “The initial lure being utilized by the threat
Jul 23, 2024NewsroomCyber Espionage / Chinese Hackers Organizations in Taiwan and a U.S. non-governmental organization (NGO) based in China have been targeted by a Beijing-affiliated state-sponsored hacking group called Daggerfly using an upgraded set of malware tools. The campaign is a sign that the group “also engages in internal espionage,”
Threat actors are exploiting the recent CrowdStrike update issue to target companies with malware and data wipers. Following a glitchy update that caused massive business disruptions on Friday, researchers and government agencies have noticed a surge in phishing emails attempting to take advantage of the situation. In an update, CrowdStrike
Multiple threat actors are exploiting a newly disclosed security flaw in PHP to distribute remote access trojans, cryptocurrency miners, and DDoS botnets. The vulnerability, identified as CVE-2024-4577 (CVSS score: 9.8), allows attackers to execute malicious commands on Windows systems using Chinese and Japanese language locales. This flaw, publicly disclosed in
The loader-as-a-service (LaaS) known as FakeBat has emerged as one of the most prevalent loader malware families distributed through drive-by download techniques this year, according to findings from Sekoia. “FakeBat primarily aims to download and execute the next-stage payload, such as IcedID, Lumma, RedLine, SmokeLoader, SectopRAT, and Ursnif,” the company
In a startling revelation, Bitdefender has uncovered a dramatic rise in cybercriminal activity on Discord in a report. Over six months, an analysis of 35 million URLs revealed a staggering 50,000 dangerous links. Despite Discord’s efforts to bolster user safety, Australia and Indonesia are among the top ten nations hit
Multiple threat actors are weaponizing a design flaw in Foxit PDF Reader to deliver a variety of malware such as Agent Tesla, AsyncRAT, DCRat, NanoCore RAT, NjRAT, Pony, Remcos RAT, and XWorm. “This exploit triggers security warnings that could deceive unsuspecting users into executing harmful commands,” Check Point said in