SecuriTricks - 2024-05-09

Mallox ranomware affiliate leverages PureCrypter in MS-SQL exploitation campaigns

A team from security firm Sekoia has observed a series of attacks targeting vulnerable assets, including MS-SQL, and Mallox ransomware, using techniques similar to that of the PureCrypter ransomware.

powershell

plugx

Published: May 14, 2024

Downloadable IOCs: 10

Protecting Networks from Opportunistic Ivanti Pulse Secure Vulnerability Exploitation

Juniper Threat Labs has observed attempts to exploit Ivanti Pulse Secure authentication bypass and remote code execution vulnerabilities (CVE-2023-46805 and CVE-2024-21887), leading to the delivery of Mirai botnet payloads. This analysis explores the vulnerabilities, exploitation methods, observed …

Published: May 10, 2024

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805

Downloadable IOCs: 23

Profiling Trafficers: Cerberus

This analysis delves into the activities of a group of malware operators known as Cerberus (formerly Amnesia) Team, who specialize in spreading infostealers, particularly in the Commonwealth of Independent States (CIS) region. It provides insights into their operations, tactics, and the evolution o…

dracula stealer (samurai)

2024-05-09

2024-05-10

Published: May 10, 2024

Downloadable IOCs: 24

New Campaigns from Scattered Spider

Scattered Spider, a financially motivated threat actor group, has been conducting aggressive phishing campaigns targeting various industries, particularly the finance and insurance sectors. Their tactics involve creating convincing lookalike domains and login pages to lure victims into revealing cr…

Published: May 10, 2024

Linked vulnerabilities : CVE-2024-22024

Downloadable IOCs: 118

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge

This analysis discusses the emergence of a new macOS malware family called 'Cuckoo Stealer', which acts as an infostealer and spyware. It describes Cuckoo Stealer's main features, logic, and provides indicators of compromise to assist threat hunters and defenders. The malware employs techniques lik…

Published: May 10, 2024

Downloadable IOCs: 4

Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four

This comprehensive analysis provides a thorough examination of the REMCOS Remote Access Trojan (RAT), a prominent malware threat that gained significant prevalence in 2024. The analysis delves into the malware's configuration structure, command and control capabilities, persistence mechanisms, and …

Published: May 9, 2024

Downloadable IOCs: 34

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin

A recent surge of malicious JavaScript code has been observed targeting websites using vulnerable versions of the LiteSpeed Cache plugin for WordPress. The malware injects code into critical WordPress files or the database, creating unauthorized admin users like 'wpsupp-user.' It exploits the vulne…

Published: May 9, 2024

Downloadable IOCs: 6

Tracking the Surge in Non-PE Cyber Threats

This intelligence report details a sophisticated infection chain that culminates in the deployment of AsyncRAT, a potent malware designed to breach computer systems and steal confidential data. The meticulous analysis unravels the intricate sequence, commencing with a spam email containing a malici…

Published: May 9, 2024

Downloadable IOCs: 13

Tag: 2024-05-09

Attack reports

Mallox ranomware affiliate leverages PureCrypter in MS-SQL exploitation campaigns

PDF “Flawed Design” Exploitation

Exploring the Depths of Multi-tiered Infrastructure

Distribution of DanaBot Malware via Word Files Detected

Leveraging DNS Tunneling for Tracking and Scanning

Security Brief: Millions of Messages Distribute LockBit Black Ransomware

GoTo Meeting loads RAT via Shellcode Loader

Romance Scams Urging Investment

StopRansomware: Black Basta

Threat Actors Hack YouTube Channels to Distribute Infostealers

Malware (XMRig, OrcusRAT, etc.) disguised as MS Office crack

Protecting Networks from Opportunistic Ivanti Pulse Secure Vulnerability Exploitation

Profiling Trafficers: Cerberus

New Campaigns from Scattered Spider

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge

Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin

Tracking the Surge in Non-PE Cyber Threats