No confirmation on rumored ALPHV/BlackCat site takedown by law enforcement

As the week started there was still no official confirmation from law enforcement that the notorious ALPV/BlackCat site had been taken down. Late last week, various research groups and news organizations reported, and RedSense on Dec. 8 confirmed, that law Read More …

Analyzing AsyncRAT’s code injection into aspnet_compiler.exe across multiple incident response cases

During their recent investigations, the Trend Micro Managed XDR (MxDR) team handled various cases involving AsyncRAT, a Remote Access Tool (RAT) with multiple capabilities,  such as keylogging and remote desktop control, that make it a substantial threat to victims. This Read More …

Europol warning on the criminal use of Bluetooth trackers for geolocalisation

For the past several years, Europol has been observing a growing crime phenomenon: the use of Bluetooth trackers in organised crime. Bluetooth trackers are small devices designed to help people find personal objects, such as keys and bags, as well Read More …

Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns

The Russia-based actor Star Blizzard (formerly known as SEABORGIUM, also known as Callisto Group/TA446/COLDRIVER/TAG-53/BlueCharlie) continues to successfully use spear-phishing attacks against targeted organisations and individuals in the UK, and other geographical areas of interest, for information-gathering activity. The UK National Read More …

INTERPOL operation reveals further insights into ‘globalization’ of cyber scam centres

LYON, France – The first INTERPOL operation specifically targeting the phenomenon of human trafficking-fuelled fraud has revealed further evidence that the crime trend is expanding beyond Southeast Asia. Following five months of investigative coordination, law enforcement from participating countries carried Read More …

MrAnon Stealer Spreads via Email with Fake Hotel Booking PDF

FortiGuard Labs recently identified an email phishing campaign using deceptive booking information to entice victims into clicking on a malicious PDF file. The PDF downloads a .NET executable file created with PowerGUI and then runs a PowerShell script to fetch Read More …

Nissan probing possible cyberattack and data breach

Japanese car manufacturing giant Nissan is investigating a possible data breach, and is warning customers to be wary of potential scam emails and messages delivering malware. In a brief notification published on the Nissan Oceania websites, it was said that Read More …

Star Blizzard increases sophistication and evasion in ongoing attacks

Microsoft Threat Intelligence continues to track and disrupt malicious activity attributed to a Russian state-sponsored actor we track as Star Blizzard (formerly SEABORGIUM, also known as COLDRIVER and Callisto Group). Star Blizzard has improved their detection evasion capabilities since 2022 Read More …

New macOS Trojan-Proxy piggybacking on cracked software

Illegally distributed software historically has served as a way to sneak malware onto victims’ devices. Kaspersky researchers have recently discovered several cracked applications distributed by unauthorized websites and loaded with a Trojan-Proxy. Attackers can use this type of malware to Read More …

TA422’s Dedicated Exploitation Loop – the Same Week After Week

Starting in March 2023, Proofpoint researchers have observed the Russian advanced persistent threat (APT) TA422 readily use patched vulnerabilities to target a variety of organizations in Europe and North America. TA422 overlaps with the aliases APT28, Forest Blizzard, Pawn Storm, Read More …