SecuriTricks - 2025-09-08

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

This intelligence report details a sophisticated cyber intrusion with links to three major ransomware groups: Play, RansomHub, and DragonForce. The attack began with a malicious file impersonating DeskSoft's EarthTime application, which deployed SectopRAT malware. The threat actors used various too…

ransomware

lateral movement

multi-group affiliation

betruger

multi-group operation

Published: September 8, 2025

Downloadable IOCs: 0

Significant Risk and Proactive Defense

A comprehensive analysis reveals a substantial threat posed by domains linked to Salt Typhoon and UNC4841, likely China-associated cyberespionage actors. The investigation uncovered a larger network of domain names beyond those publicly known, indicating a pattern of long-term access and sophistica…

cyberespionage

telecommunications

persistent threat

domain infrastructure

2025-09-08

long-term access

Published: September 8, 2025

Downloadable IOCs: 47

Windows Targeted with Rust Backdoor and Python Loader

APT37, a North Korean threat actor, has been observed using new tactics and tools in recent campaigns. They have deployed a Rust-based backdoor named Rustonotto, alongside the existing PowerShell-based Chinotto malware and FadeStealer. The group utilizes Windows shortcut files and help files as ini…

Published: September 8, 2025

Downloadable IOCs: 1

Widespread Data Theft Targets Salesforce Instances via Salesloft Drift - Hunting pulse

A widespread data theft campaign, conducted by UNC6395, targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift application. The actor systematically exported large volumes of data from numerous corporate Salesforce instances, focusing on harvesti…

supply chain

data theft

credential harvesting

Published: September 8, 2025

Linked vulnerabilities : CVE-2025-53690

Downloadable IOCs: 8

Indicators of Malicious Activity and Recommendations for Impacted Organizations - Hunting pulse

A comprehensive investigation has uncovered numerous indicators of malicious activity related to a specific incident. Organizations are urged to scrutinize their logs for signs of compromise using the provided Indicators of Compromise (IOCs). The analysis reveals that legitimate Drift integration t…

Published: September 8, 2025

Downloadable IOCs: 18

Inside the Kimsuky Leak: How the 'Kim' Dump Exposed North Korea's Credential Theft Playbook

A data breach attributed to a North Korean-affiliated actor known as "Kim" has provided new insights into Kimsuky (APT43) tactics and infrastructure. The actor's operations focus on credential-based intrusions targeting South Korean and Taiwanese networks, utilizing Chinese-language tools and infra…

Published: September 8, 2025

Downloadable IOCs: 11

GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe

A sophisticated malware campaign dubbed 'GPUGate' has been uncovered, targeting Western European IT professionals through malicious Google Ads mimicking GitHub Desktop. The attack leverages GitHub's repository structure and a GPU-gated decryption mechanism to evade analysis. The malware, a 128 MB M…

Published: September 8, 2025

Linked vulnerabilities : CVE-2025-20265 (CVSS 10.0), CVE-2025-7775 (CVSS 9.2)

Downloadable IOCs: 42

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

ESET researchers have identified a new threat actor named GhostRedirector that has compromised at least 65 Windows servers, primarily in Brazil, Thailand, and Vietnam. The actor utilizes two previously undocumented tools: a passive C++ backdoor called Rungan and a malicious Internet Information Ser…

Published: September 8, 2025

Downloadable IOCs: 24

Tag: 2025-09-08

Attack reports

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

Significant Risk and Proactive Defense

Windows Targeted with Rust Backdoor and Python Loader

Widespread Data Theft Targets Salesforce Instances via Salesloft Drift - Hunting pulse

Indicators of Malicious Activity and Recommendations for Impacted Organizations - Hunting pulse

Inside the Kimsuky Leak: How the 'Kim' Dump Exposed North Korea's Credential Theft Playbook

GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes