24 casos · pág. 1/2
FortiGuard Labs analyzed a TrickBot variant that carries command-and-control (C2) traffic over DNS tunneling, embedding encoded data in DNS queries and responses, instead of the HTTP used by earlier variants. The malware persists through Windows Task Scheduler, stores its configuration in NTFS Alternate Data Streams, and hinders analysis …
ESET Research reports that the China-aligned APT group FamousSparrow has been using a new modular C++ backdoor, SparroWocky, since at least August 2025. The backdoor has replaced SparrowDoor as the group's main implant. From mid-2025 into 2026, about 90% of the group's targets in ESET telemetry were in Latin America, mostly governmental e…
An actor using the handle WolfBlxck posted an updated recruitment announcement for Beelzebub ransomware. The actor claims the malware was rewritten from scratch with a stronger focus on disabling endpoint defenses, suppressing telemetry and hindering incident response. The post seeks three more members: a developer, a penetration tester a…
Forescout Research - Vedere Labs disclosed ROMULUS, a ClickFix delivery platform that uses bogus landing pages with ClickFix-style lures to trick users into running malicious commands that infect their own machines. It is used to distribute malware such as Legion Loader (also tracked as Satacom downloader, CurlyGate and RobotDropper). For…
SmartLoader is a commodity loader in active deployment, attributed to Malware-as-a-Service infrastructure linked to LummaStealer delivery in recent campaigns. Reverse engineering shows it is built almost entirely from off-the-shelf parts: a stock signed LuaJIT 2.1.0-beta3 interpreter, a commercial Lua VM obfuscator from the game-cheat sce…
Kaspersky analysis of an installer first classified as adware (MD5 c24e99f9437feacaa63766a3cde3fe3d) found that it delivers the ValleyRAT backdoor. The installer drops a modified, signed Chinese wallpaper tool, QN Wallpaper, and uses it for DLL sideloading of a malicious libcef.dll. The adware's advertising function does not work. Attacke…
Toy Ghouls (aka Bearlyfy, Laboo.boo, Feral Wolf), a financially motivated group targeting Russian organizations since 2025, was observed in early July 2026 using a custom backdoor for the first time. Kaspersky GERT identified two versions, mqtt-bird-agent 0.1.0 (C2 over the public HiveMQ MQTT broker) and matrix-bird-agent 0.1.0 (C2 over a…
Huntress published a vendor blog post on the role and limits of Microsoft Volume Shadow Copy Service (VSS) in modern data protection. It explains that VSS remains a core framework for application-consistent snapshots on Windows workloads but should not be treated as a complete recovery or ransomware defense. The article warns that modern …
TrustedSec analyzed a multi-stage malware loader that starts as obfuscated Python bytecode (.pyc, CPython 3.13) and ends in an encrypted .NET payload. The chain layers Kramer Python obfuscation, two Donut shellcode layers and a laZzzy shellcode-loader PE, so a signature for any single format misses the others. The author unpacked it with …
SentinelOne argues that "EDR killer" covers four different techniques, and a single driver-load rule leaves blind spots. The four are bring-your-own-vulnerable-driver (BYOVD), bring-your-own-installer, admin-to-kernel, and driverless suspension. The article gives hunt logic for each and recommends rolling them out in order of signal quali…
Kaspersky identified MovieReaper, a previously unknown modular, multi-stage crimeware framework distributed since mid-August 2026 through movie-themed torrents, including fake "The Odyssey (2026)" releases. Rather than compromising individual trackers, the actor modified the public torrent file repository itorrents.org, so trackers relyin…
Unit 42 attributes with high confidence to an Iranian state-aligned actor, tracked as CL-STA-1178, a campaign called Blinder Tunnel. In March 2026 it targeted an individual in Iraq's critical infrastructure sector, after infrastructure staging that began as early as November 2025. The actor impersonated the Dubai Airports IT department an…
Darktrace researchers documented a new campaign distributing CikaBika Bot, a Rust-based remote access trojan controlled entirely through Discord. The infection chain starts with a disk image named PropositionProjet.img, which contains a French-language decoy PDF and a Windows shortcut disguised as a Word document. A Nim loader extracts th…
Citizen Lab reported that Israeli mercenary spyware vendor Candiru infected devices at Al Jazeera through targeted online ads that needed no user interaction. It calls this the first public technical confirmation of mercenary spyware reaching real devices via ad delivery. At least 45 Al Jazeera devices were targeted in 2024 and 2025, and …
Citizen Lab reports that Candiru spyware was delivered to devices at Al Jazeera Media Network through targeted online advertisements, in a zero-click attack that only required the malicious ad to render on the victim's device. Citizen Lab calls the technique AdFection and says its report is the first public technical confirmation of merce…
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…
Microsoft released updates for at least 974 vulnerabilities in Windows and other software, its largest Patch Tuesday ever. The previous record was 570 fixes in July. The 2026 total now exceeds 2,600, more than double the 2020 record year (1,245), with three months still to go. Microsoft and other large vendors, including Adobe, Cisco, Goo…
SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …
Kaspersky researchers report that the APT group Mirage Kitten has moved from native C/C++/Go malware to Node.js and JavaScript implants, NodeRabbit and PollCat. Both are cross-platform RATs delivered through spear-phishing by fake recruiters on LinkedIn and other job platforms, using trojanized coding-challenge archives hosted on Amazon S…
