SecuriTricks - amadey

Frequent freeloader: Russian actor using tools of other groups to attack Ukraine

Russian nation-state actor Secret Blizzard has been observed using tools and infrastructure from other threat actors to compromise targets in Ukraine. Between March and April 2024, Secret Blizzard utilized the Amadey bot malware associated with cybercriminal activity to deploy its custom Tavdig and…

ukraine

amadey

secret blizzard

2024-12-13

kazuarv2

Published: December 13, 2024

Downloadable IOCs: 0

Socks5Systemz Botnet Powers Illegal Proxy Service with 85,000+ Hacked Devices

A malicious botnet called Socks5Systemz is operating a proxy service named PROXY.AM, utilizing over 85,000 compromised devices. The botnet, active since 2013, aims to turn infected systems into proxy exit nodes for cybercriminals seeking to obscure their attack sources. Initially boasting around 25…

Published: December 9, 2024

Downloadable IOCs: 2

Malicious CAPTCHA delivers Lumma and Amadey Trojans

An adware campaign targets online users by presenting them with fake CAPTCHA or update prompts, tricking them into running malicious PowerShell commands that deploy credential-stealing malware like Lumma and Amadey. The attackers leverage ad networks to redirect victims to compromised sites hosting…

Published: October 29, 2024

Downloadable IOCs: 1

Zharkbot Strings

Zharkbot is a C++ downloader with extensive anti-analysis and anti-sandbox features. It uses in-line string encryption and API calls, making static and emulation analysis challenging. The malware performs sandbox detection by checking for specific usernames and hypervisors. It installs itself in th…

Published: September 3, 2024

Downloadable IOCs: 2

Unfurling Hemlock: Threat group uses cluster bomb campaigns

A threat actor dubbed Unfurling Hemlock has been observed distributing hundreds of thousands of malware samples in a campaign lasting several months. The malware is distributed using a 'cluster bomb' technique where each sample contains multiple stages of nested executable files, each containing ad…

Published: July 1, 2024

Downloadable IOCs: 55

HijackLoader Updates

HijackLoader, also known as IDAT Loader, is a modular malware loader capable of executing multiple payloads. It utilizes a variety of modules for code injection, execution, and evasion techniques. This report analyzes the updated version of HijackLoader, which includes new modules for bypassing Win…

Published: May 7, 2024

Downloadable IOCs: 11

Tag: amadey

Attack reports

I StealC You: Tracking the Rapid Changes To Steal

Where to Find Aspiring Hackers

Amateur Hacker Leverages Bulletproof Hosting Server to Spread Malware

How Cracks and Installers Bring Malware to Your Device

Frequent freeloader: Russian actor using tools of other groups to attack Ukraine

Socks5Systemz Botnet Powers Illegal Proxy Service with 85,000+ Hacked Devices

Malicious CAPTCHA delivers Lumma and Amadey Trojans

Zharkbot Strings

Unfurling Hemlock: Threat group uses cluster bomb campaigns

HijackLoader Updates