SecuriTricks

Supply Chain Attack Using Ethereum Smart Contracts to Distribute Multi-Platform Malware

A sophisticated supply chain attack has been discovered targeting the NPM ecosystem. The malicious package 'jest-fet-mock' impersonates popular testing utilities and uses Ethereum smart contracts for command-and-control operations. This cross-platform malware affects Windows, Linux, and macOS, exec…

supply-chain

typosquatting

Published: November 5, 2024

Downloadable IOCs: 4

OSINT Investigation: Hunting Malicious Infrastructure Linked to Transparent Tribe

This investigation tracked infrastructure linked to the APT group Transparent Tribe, identifying 15 malicious hosts on DigitalOcean serving as command-and-control servers for the Mythic exploitation framework. The group employs Linux desktop entry files as an attack vector, targeting individuals in…

Published: September 30, 2024

Downloadable IOCs: 19

Multiple Malware Dropped Through MSI Package

An analysis reveals the distribution of malware through an MSI package, specifically SectopRat and Redline stealer. The malware employs techniques like executing malicious scripts, disabling security measures, and establishing persistence through scheduled tasks. It communicates with command-and-co…

Published: August 14, 2024

Downloadable IOCs: 11

Brief Overview of the DeerStealer Distribution Campaign

A recent cybersecurity investigation uncovered a malware distribution campaign called DeerStealer. The malware was disseminated through counterfeit Google Authenticator websites, tricking visitors into downloading the malicious payload hosted on GitHub. Upon execution, the stealer collects system i…

Published: August 2, 2024

Downloadable IOCs: 28

Self-Proclaimed Meeting Software Vortax Spreads Infostealers, Unveils Expansive Network of Malicious macOS Applications

While monitoring data in Recorded Future Malware Intelligence, Insikt Group identified purported virtual meeting software called Vortax that, upon download and installation, delivers three information stealers (“infostealers”) in cross-platform attacks — Rhadamanthys, Stealc, and, most notably, Ato…

macos

c2

2024-06-20

Published: June 20, 2024

Downloadable IOCs: 60

Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware

Vidar Stealer is a potent malware written in C++, capable of stealing a wide range of data from the compromised system. Vidar Stealer targets user’s personal data, web-browser data, cryptocurrency wallets, financial data, sensitive files within user directories, communication applications, process …

Published: June 4, 2024

Downloadable IOCs: 6

Tag: c2

Attack reports

Thunderstruck! Malicious ads for RVTools lead to ThunderShell payload

The Shelby Strategy

Auto-Color: An Emerging and Evasive Linux Backdoor

Tracking Pyramid C2: Identifying Post-Exploitation Servers in Hunt

Unveiling the Past and Present of APT-K-47 Weapon: Asyncshell

The Evolution of a Cyber Threat: From JinxLoader to Astolfo Loader

Supply Chain Attack Using Ethereum Smart Contracts to Distribute Multi-Platform Malware

OSINT Investigation: Hunting Malicious Infrastructure Linked to Transparent Tribe

Multiple Malware Dropped Through MSI Package

Brief Overview of the DeerStealer Distribution Campaign

Self-Proclaimed Meeting Software Vortax Spreads Infostealers, Unveils Expansive Network of Malicious macOS Applications

Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware