28 casos · pág. 1/2
FortiGuard Labs analyzed a TrickBot variant that carries command-and-control (C2) traffic over DNS tunneling, embedding encoded data in DNS queries and responses, instead of the HTTP used by earlier variants. The malware persists through Windows Task Scheduler, stores its configuration in NTFS Alternate Data Streams, and hinders analysis …
FortiGuard Labs analyzed a SectopRAT variant that is embedded in legitimate software to evade detection. The malware uses a multi-stage loader to extract its payload from files, then applies API hashing, indirect function calls and in-memory loading to run the final .NET payload. Once running, it sets up encrypted communication with its C…
Troy Hunt's Weekly Update 522, recorded live in Oslo with Scott Helme, discusses how Report URI uses Content Security Policy (CSP) reporting to identify malware-infected machines within organizations. Helme also describes a high rate of malicious browser extensions being detected with help from "Rory", his local OpenClaw instance. The art…
Records were exported from the management information system (MIS) of Southville Primary School in Bristol during a targeted cyberattack, according to Bristol City Council. The council has not disclosed what data was taken or how many students, parents or staff are affected. The school has notified affected parents and guardians and repor…
FortiGuard Labs reports an ongoing Ousaban campaign targeting the Iberian Peninsula. The actor keeps refining its delivery chain and uses geofencing and environmental checks to restrict access to the malware to the intended victims. Ousaban resolves its C2 IP through daily-changing domains and runs a traditional C2 setup as a decoy. Its l…
FortiGuard Labs analyzed a Casbaneiro banking trojan campaign targeting users in Latin America. The campaign applies access restrictions at several stages to keep the malware away from analysis tools: the download page, the HTA downloader and Casbaneiro itself. Casbaneiro sends different types of stolen data to separate servers and uses a…
ESET researchers observed the Russia-aligned group UAC-0099 embedding a decoy request for guidance on building a nuclear weapon in a comment inside a VBScript used in the early stages of an attack on a target in Ukraine. The comment was meant to trigger the safety guardrails of an LLM-powered code scanner so that it stops inspecting the f…
In a PWNED column, SolarWinds CISO Justin Henkel, a former US Air Force IT security specialist, recounts that in the early 2000s pilots and mission planners moved mission data between unclassified and classified systems using CDs and later USB thumb drives. Personnel often bought the drives from local vendors, for example in Kabul, rather…
Darktrace researchers documented a new campaign distributing CikaBika Bot, a Rust-based remote access trojan controlled entirely through Discord. The infection chain starts with a disk image named PropositionProjet.img, which contains a French-language decoy PDF and a Windows shortcut disguised as a Word document. A Nim loader extracts th…
Siemens disclosed on Monday that threat actors exploited CVE-2026-110936, a DLL search-path vulnerability in Siemens Software Center, in a malware campaign. The attackers bundled a legitimately signed copy of the Siemens program with their own malicious DLLs, which the program loaded from its own folder at startup. Siemens links the activ…
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affe…
A 40-year-old Nigerian national, Chukwuemeka Victor Amachukwu, was sentenced to eight years in prison by a US federal court for a 2019-2023 scheme that combined hacking of US tax preparation businesses, filing of fraudulent tax returns and fake investment fraud. He used identities stolen from victim organizations to file false returns wit…
Bitdefender documented Midnight Mimosa, an Android malware campaign that embeds a platform-signed malicious system app in the firmware of low-cost, MediaTek-based handsets and counterfeit flagship models before they reach buyers. Thousands of infected devices were observed in more than 150 countries over roughly two years. The implant dri…
SmartLoader is a commodity loader in active deployment, attributed to Malware-as-a-Service infrastructure linked to LummaStealer delivery in recent campaigns. Reverse engineering shows it is built almost entirely from off-the-shelf parts: a stock signed LuaJIT 2.1.0-beta3 interpreter, a commercial Lua VM obfuscator from the game-cheat sce…
SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…
Trend Micro published its annual threat report, Calibrating Expansion, covering 2023. It reports 161 billion threats blocked, a 10% annual increase. Attackers appear to be targeting fewer, higher-value victims with more sophisticated methods. Email and web reputation blocks fell 47% and 2%, while File Reputation Service detections rose 35…
F5 Labs, using Efflux sensor telemetry, reports a campaign that began on 2025-06-08. One actor is exploiting TP-Link AX21 routers (CVE-2023-1389, command injection in the country query parameter) and Raisecom web interfaces (CVE-2024-7120) to deliver a new malware family named NoBooze1. Four source IPs and three stage-one hosts were rotat…
This ESET blog post argues that AI is speeding up the threat landscape for SMBs, both by empowering threat actors and by widening the attack surface as businesses adopt AI faster than they govern it. The ESET SMB Cyber Readiness Index 2026 reports that 73% of SMBs are integrating AI, 40% lack a proper AI policy, and 45% suffered a cyberse…
Kaspersky ICS CERT reports that in Q2 2026 malicious objects were blocked on 19.15% of ICS computers, the lowest level since 2022. Regional rates ranged from 8.1% in Northern Europe to 27.9% in Africa. East Asia saw the largest increase (+2.0 pp). The biometrics sector (26.44%) again led all industries. Kaspersky products blocked malware …
Kaspersky analysis of an installer first classified as adware (MD5 c24e99f9437feacaa63766a3cde3fe3d) found that it delivers the ValleyRAT backdoor. The installer drops a modified, signed Chinese wallpaper tool, QN Wallpaper, and uses it for DLL sideloading of a malicious libcef.dll. The adware's advertising function does not work. Attacke…
