SecuriTricks - 2024-05-10

Ebury is alive but unseen: 400k Linux servers compromised for cryptotheft and financial gain

The Ebury malware gang is continuing to expand, with hundreds of thousands of servers compromised and used to steal cryptocurrency and credit card data, according to a paper published by ESET Research on 14 May 2024.

linux

bitcoin

Published: May 15, 2024

Downloadable IOCs: 141

The Overlapping Cyber Strategies Of Transparent Tribe And SideCopy Against India

CRIL's analysis revealed SideCopy APT group's sophisticated malware campaign, employing malicious LNK files and a complex infection chain involving HTAs and loader DLLs to deploy malware like ReverseRAT and Action RAT. SideCopy targets Indian universities and government entities, suggesting potenti…

Published: May 15, 2024

Downloadable IOCs: 21

Ongoing Malvertising Campaign leads to Ransomware

Rapid7 detected an ongoing malware distribution campaign involving trojanized installers of WinSCP and PuTTY, delivered via malicious search engine ads. The infection chain employs DLL side-loading, credential access, and deploys Sliver beacons followed by Cobalt Strike. In one case, the threat act…

Published: May 15, 2024

Downloadable IOCs: 78

Mallox ranomware affiliate leverages PureCrypter in MS-SQL exploitation campaigns

A team from security firm Sekoia has observed a series of attacks targeting vulnerable assets, including MS-SQL, and Mallox ransomware, using techniques similar to that of the PureCrypter ransomware.

Published: May 14, 2024

Downloadable IOCs: 10

Protecting Networks from Opportunistic Ivanti Pulse Secure Vulnerability Exploitation

Juniper Threat Labs has observed attempts to exploit Ivanti Pulse Secure authentication bypass and remote code execution vulnerabilities (CVE-2023-46805 and CVE-2024-21887), leading to the delivery of Mirai botnet payloads. This analysis explores the vulnerabilities, exploitation methods, observed …

Published: May 10, 2024

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805

Downloadable IOCs: 23

Profiling Trafficers: Cerberus

This analysis delves into the activities of a group of malware operators known as Cerberus (formerly Amnesia) Team, who specialize in spreading infostealers, particularly in the Commonwealth of Independent States (CIS) region. It provides insights into their operations, tactics, and the evolution o…

dracula stealer (samurai)

2024-05-09

2024-05-10

Published: May 10, 2024

Downloadable IOCs: 24

New Campaigns from Scattered Spider

Scattered Spider, a financially motivated threat actor group, has been conducting aggressive phishing campaigns targeting various industries, particularly the finance and insurance sectors. Their tactics involve creating convincing lookalike domains and login pages to lure victims into revealing cr…

Published: May 10, 2024

Linked vulnerabilities : CVE-2024-22024

Downloadable IOCs: 118

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge

This analysis discusses the emergence of a new macOS malware family called 'Cuckoo Stealer', which acts as an infostealer and spyware. It describes Cuckoo Stealer's main features, logic, and provides indicators of compromise to assist threat hunters and defenders. The malware employs techniques lik…

Published: May 10, 2024

Downloadable IOCs: 4

Tag: 2024-05-10

Attack reports

Ebury is alive but unseen: 400k Linux servers compromised for cryptotheft and financial gain

The Overlapping Cyber Strategies Of Transparent Tribe And SideCopy Against India

Ongoing Malvertising Campaign leads to Ransomware

Mallox ranomware affiliate leverages PureCrypter in MS-SQL exploitation campaigns

PDF “Flawed Design” Exploitation

Exploring the Depths of Multi-tiered Infrastructure

Distribution of DanaBot Malware via Word Files Detected

Leveraging DNS Tunneling for Tracking and Scanning

Security Brief: Millions of Messages Distribute LockBit Black Ransomware

GoTo Meeting loads RAT via Shellcode Loader

Romance Scams Urging Investment

StopRansomware: Black Basta

Threat Actors Hack YouTube Channels to Distribute Infostealers

Malware (XMRig, OrcusRAT, etc.) disguised as MS Office crack

Protecting Networks from Opportunistic Ivanti Pulse Secure Vulnerability Exploitation

Profiling Trafficers: Cerberus

New Campaigns from Scattered Spider

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge