/
ttps_attack:T1547.001 × latest_source_host:securelist.com × limpar

Resultados

2 casos · pág. 1/1

securelist.com · high

Mirage Kitten deploys Node.js NodeRabbit RAT and JavaScript PollCat RAT via fake job coding challenges

Kaspersky researchers report that the APT group Mirage Kitten has moved from native C/C++/Go malware to Node.js and JavaScript implants, NodeRabbit and PollCat. Both are cross-platform RATs delivered through spear-phishing by fake recruiters on LinkedIn and other job platforms, using trojanized coding-challenge archives hosted on Amazon S…

securelist.com · high

ValleyRAT backdoor distributed via trojanized QN Wallpaper adware installer using libcef.dll sideloading, likely Silver Fox

Kaspersky analysis of an installer first classified as adware (MD5 c24e99f9437feacaa63766a3cde3fe3d) found that it delivers the ValleyRAT backdoor. The installer drops a modified, signed Chinese wallpaper tool, QN Wallpaper, and uses it for DLL sideloading of a malicious libcef.dll. The adware's advertising function does not work. Attacke…