Tag: 2025-06-19

5 Attack Reports | 1 Vulnerabilities

Attack reports

Threat actor Banana Squad exploits GitHub repos in new campaign

ReversingLabs researchers have uncovered a new campaign by the threat actor Banana Squad, involving over 60 GitHub repositories containing hundreds of trojanized Python files. The attackers create fake user accounts to host malicious repositories that mimic legitimate ones, using a technique that h…
backdoor
python
open-source
github
stealth techniques
supply chain attack
software supply chain
open-source security
code obfuscation
2025-06-19
2025-06-20
trojanized repositories
Published: June 20, 2025
Downloadable IOCs: 275

Part 2: Tracking LummaC2 Infrastructure

An investigation into domains associated with the LummaC2 infostealing-malware campaign revealed a broader network of nearly 500 domains with highly malicious risk scores. These domains share similar registration patterns, including the use of Eastern European names and the inbox[.]eu email domain.…
lummac2
infostealer
malicious domains
2025-06-19
acreed
domain infrastructure
technical education lure
eastern european names
Published: June 19, 2025
Downloadable IOCs: 504

Stealthy GitHub Malware Campaign Targets Devs

A new campaign exploiting GitHub to distribute malicious Python code disguised as legitimate hacking tools has been uncovered. The operation, attributed to the group known as Banana Squad, used 67 repositories hosting trojanized files that mimicked benign open-source projects. The attackers exploit…
backdoor
python
supply chain
repositories
open-source
github
2025-06-19
trojanized files
encoding
Published: June 19, 2025
Downloadable IOCs: 2

Inside the BlueNoroff Web3 macOS Intrusion Analysis

A detailed analysis of a sophisticated intrusion targeting a cryptocurrency foundation employee is presented. The attack, attributed to the North Korean APT group BlueNoroff, began with a social engineering lure via Telegram, leading to the installation of malicious software disguised as a Zoom ext…
apt
social engineering
cryptocurrency
stealer
macos
dprk
process injection
web3
2025-06-19
root troy v4
injectwithdyld
xscreen
cryptobot
telegram 2
Published: June 19, 2025
Downloadable IOCs: 18

Analysis of a Malicious WordPress Plugin: The Covert Redirector

A malicious WordPress plugin named 'wordpress-player.php' has been discovered, affecting at least 26 websites. The plugin injects a hidden HTML5 video player and establishes a WebSocket connection to a command and control server. It redirects visitors to suspicious websites after 4-5 seconds, avoid…
wordpress
plugin
c2
seo
websocket
2025-06-19
redirect
wordpress-player.php
website-integrity
Published: June 19, 2025
Downloadable IOCs: 1
Click here to see more Attack Reports

Vulnerabilities

CVE-2024-45208

9.8
    Versa Networks
  • Versa Director
    Cisco
Published: June 19, 2025
Click here to see more Vulnerabilities