SecuriTricks - cybercrime

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

A Chinese-speaking cybercrime group, UAT-8099, is targeting high-value Internet Information Services (IIS) servers for search engine optimization fraud and data theft. The group focuses on reputable servers in India, Thailand, Vietnam, Canada, and Brazil, affecting universities, tech firms, and tel…

data theft

cobalt strike

Published: October 2, 2025

Downloadable IOCs: 80

SystemBC – Bringing the Noise

The SystemBC botnet, composed of over 80 C2s and 1,500 daily victims, primarily targets VPS systems from commercial providers. It creates proxies enabling high volumes of malicious traffic for various criminal threat groups. The network is used by multiple proxy services, including REM Proxy, which…

Published: September 25, 2025

Downloadable IOCs: 158

The Most Powerful Ever? Inside the 11.5Tbps-Scale Mega Botnet AISURU

The AISURU botnet has emerged as a formidable threat, capable of launching massive DDoS attacks reaching 11.5 Tbps. First disclosed in 2024, it expanded significantly in 2025 by compromising a router firmware update server. The botnet, with approximately 300,000 nodes, is operated by a group of thr…

Published: September 25, 2025

Linked vulnerabilities : CVE-2023-50381 (CVSS 7.2), CVE-2023-28771, CVE-2024-3721, CVE-2022-35733, CVE-2013-1599, CVE-2022-44149, CVE-2013-5948, CVE-2013-3307, CVE-2017-5259

Downloadable IOCs: 11

Under the Pure Curtain: From RAT to Builder to Coder

Check Point Research conducted a forensic analysis of a ClickFix campaign that deployed multiple tools, including a Rust Loader, PureHVNC RAT, and the Sliver command-and-control framework. The analysis provided comprehensive insights into PureHVNC RAT, including its commands and plugins. The invest…

Published: September 16, 2025

Downloadable IOCs: 0

Not Safe for Work: Tracking and Investigating Stealerium and Phantom Infostealers

Proofpoint researchers have observed an increase in cybercriminals using Stealerium-based malware, an open-source infostealer available on GitHub. Multiple stealers share code with Stealerium, including Phantom Stealer. Campaigns delivering Stealerium have used various lures and file types, targeti…

Published: September 4, 2025

Downloadable IOCs: 8

Behind the Curtain: How Lumma Affiliates Operate

This analysis reveals the complex operations of Lumma affiliates within a vast information-stealing ecosystem. Affiliates utilize various tools and services, including proxy networks, VPNs, anti-detect browsers, and crypting services. The investigation uncovered previously undocumented tools and sh…

Published: August 20, 2025

Downloadable IOCs: 0

"Click to Allow" Robot Exposes Online Fraud Empire

VexTrio, a cybercriminal organization, has been exposed for running a vast online fraud empire involving scams, spam, and malicious apps. Their operations include fake dating sites, cryptocurrency scams, and deceptive apps that have been downloaded millions of times. VexTrio uses sophisticated traf…

Published: August 12, 2025

Downloadable IOCs: 28

DanaBot C2 Server Memory Leak Bug

A critical vulnerability named DanaBleed was discovered in DanaBot's C2 server, causing memory leaks from June 2022 to early 2025. This bug, introduced in version 2380, exposed sensitive information including threat actor details, server data, and victim credentials. The leak resulted from uninitia…

Published: June 10, 2025

Downloadable IOCs: 2

Danabot: Analyzing a fallen empire

ESET Research shares insights into Danabot, an infostealer recently disrupted by law enforcement. The malware, tracked since 2018, evolved from a banking trojan to a versatile tool for data theft and malware distribution. Operated as a malware-as-a-service, Danabot offered features like data steali…

Published: May 25, 2025

Downloadable IOCs: 1

Where to Find Aspiring Hackers

This analysis focuses on Proton66, a bulletproof hosting network enabling cybercrime operations and serving as a hub for aspiring cybercriminals. It examines the activities of a threat actor known as 'Coquettte,' who is linked to the Horrid hacking group. The investigation reveals a fake cybersecur…

Published: April 4, 2025

Downloadable IOCs: 0

Money Laundering 101, and why there is concern

This newsletter discusses the process of money laundering in the context of cybercrime, particularly ransomware attacks. It explains the three basic steps of money laundering: placement, layering, and integration. The author expresses concern about regulatory changes that might facilitate easier mo…

coinminer:mbt.26mw.in14.talos

2025-03-28

trojan.generickd.33515991

money laundering

simple_custom_detection

regulatory changes

Published: March 28, 2025

Downloadable IOCs: 0

VanHelsing: New RaaS in Town

VanHelsing RaaS, a new ransomware-as-a-service program launched on March 7, 2025, has quickly gained traction in the cybercrime world. With a low $5,000 deposit for affiliates, it offers an 80% cut of ransom payments. The service provides a user-friendly control panel and targets multiple platforms…

encryption

cybercrime

ransomware-as-a-service

Published: March 23, 2025

Downloadable IOCs: 0

Dragon RaaS | Pro-Russian Hacktivist Group Aims to Build on "The Five Families" Cybercrime Reputation

Dragon RaaS is a ransomware group that emerged in July 2024 as an offshoot of Stormous, part of a larger cybercrime syndicate known as 'The Five Families'. The group markets itself as a sophisticated Ransomware-as-a-Service operation but often conducts defacements and opportunistic attacks rather t…

vulnerability exploitation

Published: March 19, 2025

Downloadable IOCs: 0

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

Threat actors are increasingly using legitimate remote monitoring and management (RMM) tools as initial payloads in email campaigns. This trend aligns with a decrease in the use of traditional loaders and botnets by initial access brokers. RMMs can be exploited for data collection, financial theft,…

Published: March 12, 2025

Downloadable IOCs: 15

2024 Malicious Infrastructure Insights: Key Trends and Threats

The report highlights significant trends in malicious infrastructure for 2024, including the rise of malware-as-a-service infostealers, continued dominance of Cobalt Strike among offensive security tools, and increased use of legitimate services by threat actors. Key findings include LummaC2's domi…

malicious infrastructure

remote access trojans

2025-02-28

traffic distribution systems

mozi botnet

state-sponsored groups

command-and-control servers

solarmarker rat

offensive security tools

Published: February 28, 2025

Downloadable IOCs: 0

Finance Report: Who Targets Financial Institutions?

This report provides an overview of key cybercrime and state-sponsored threat actors targeting the financial sector in 2024. It highlights the critical role of Initial Access Brokers in enabling large-scale attacks, the persistent threat of ransomware and extortion groups, and the increasing sophis…

initial access brokers

jsoutprox

tradertraitor

golddigger

state-sponsored threats

Published: February 20, 2025

Downloadable IOCs: 0

Socks5Systemz Botnet Powers Illegal Proxy Service with 85,000+ Hacked Devices

A malicious botnet called Socks5Systemz is operating a proxy service named PROXY.AM, utilizing over 85,000 compromised devices. The botnet, active since 2013, aims to turn infected systems into proxy exit nodes for cybercriminals seeking to obscure their attack sources. Initially boasting around 25…

Published: December 9, 2024

Downloadable IOCs: 2

One Sock Fits All: The use and abuse of the NSOCKS botnet

The ngioweb botnet serves as the foundation for the NSOCKS criminal proxy service, maintaining over 35,000 bots daily across 180 countries. The botnet primarily targets SOHO routers and IoT devices, with two-thirds of proxies based in the U.S. NSOCKS utilizes over 180 'backconnect' C2 nodes to obsc…

Published: November 19, 2024

Downloadable IOCs: 59

Telekopye transitions to targeting tourists via hotel booking scam

ESET researchers have discovered that Telekopye, a Telegram-based toolkit used by cybercriminals to scam people on online marketplaces, has expanded its operations to target users of popular accommodation booking platforms like Booking.com and Airbnb. The scammers, referred to as Neanderthals, now …

Published: November 17, 2024

Downloadable IOCs: 0

Life on a crooked RedLine: Analyzing the infamous infostealer's backend

This article provides an in-depth analysis of RedLine Stealer, a notorious information-stealing malware. The research focuses on previously undocumented backend modules and the control panel used by affiliates. Key findings include the identification of over 1,000 unique IP addresses hosting RedLin…

windows communication framework

backend analysis

Published: November 17, 2024

Downloadable IOCs: 0

DDoS-for-Hire Platform dstat[.]cc Disrupted; Suspects Arrested

German law enforcement authorities have successfully disrupted dstat[.]cc, a criminal service facilitating distributed denial-of-service (DDoS) attacks. The platform provided recommendations and evaluations of stresser services, making DDoS attacks accessible to users without advanced technical ski…

Published: November 4, 2024

Downloadable IOCs: 1

Booking.com Phishers May Leave You With Reservations

A recent spear-phishing campaign targeted a California hotel after its Booking.com credentials were stolen. The scam involved sending targeted messages within the Booking mobile app, claiming additional information was required for anti-fraud purposes. Booking.com confirmed a security incident affe…

Published: November 2, 2024

Downloadable IOCs: 0

Over 10 Million Personal And Corporate Devices Infected By Information Stealers

A significant increase in data-stealing malware infections has been observed, with nearly 10 million devices compromised in 2023, marking a 643% rise over three years. Cybercriminals are using sophisticated distribution methods, including malvertising and YouTube comment spam. On average, 50.9 logi…

Published: October 22, 2024

Downloadable IOCs: 0

The Mongolian Skimmer: different clothes, equally dangerous

This report details the analysis of a skimming campaign, dubbed the 'Mongolian Skimmer,' which utilizes an obfuscation technique involving unusual Unicode characters for variable and function names. While initially appearing as a novel obfuscation approach, it ultimately employs well-known JavaScri…

Published: October 14, 2024

Downloadable IOCs: 13

Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomware

Repellent Scorpius is a new ransomware-as-a-service group distributing Cicada3301 ransomware. It emerged in May 2024 and employs double extortion tactics involving data theft. The report covers a technical analysis of the Cicada3301 ransomware, the group's tactics, connections to historical inciden…

Published: September 11, 2024

Linked vulnerabilities : CVE-2024-1709, CVE-2024-1708

Downloadable IOCs: 8

Threat Assessment: North Korean Threat Groups

This assessment evaluates several North Korean threat groups operating under the Reconnaissance General Bureau. It describes their organizational structure, objectives, and the diverse malware families employed in their recent campaigns targeting various industries worldwide. The analysis covers 10…

Published: September 10, 2024

Downloadable IOCs: 58

2024 Paris Olympic Games Infrastructure Attack Report

This report examines the malicious activities surrounding the 2024 Paris Olympic Games, where adversaries set up fraudulent social media profiles, online stores, ticketing systems, and cryptocurrencies to exploit the event's popularity. Researchers analyzed newly registered domains (NRDs) before th…

Published: August 16, 2024

Downloadable IOCs: 148

FIN7: The Truth Doesn't Need to be so STARK

In this collaborative effort, cybersecurity researchers from Silent Push, Stark Industries Solutions, and Team Cymru have identified and disrupted infrastructure associated with the financially motivated threat group FIN7. The analysis uncovered two clusters of potential FIN7 activity communicating…

cybercrime

2024-08-16

cybersecurity collaboration

financially motivated

threat group

malicious infrastructure

Published: August 16, 2024

Downloadable IOCs: 103

A Dive into Latest Campaign

Earth Baku, an advanced persistent threat actor, has broadened its operations from the Indo-Pacific region to Europe, the Middle East, and Africa, targeting countries like Italy, Germany, UAE, and Qatar. The group leverages public-facing applications like IIS servers as entry points, deploying soph…

Published: August 9, 2024

Downloadable IOCs: 30

Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks

TrendMicro highlights the dangers of internet-facing routers and elaborates on Pawn Storm's exploitation of EdgeRouters, complementing the FBI's advisory from February 27, 2024. Cybercriminals and nation-state actors share an interest in compromised routers used as an anonymization layer, with cybe…

Published: August 7, 2024

Downloadable IOCs: 64

Solving the 7777 Botnet enigma: A cybersecurity quest

Sekoia.io investigated the mysterious 7777 botnet (aka Quad7 botnet), which compromised TP-Link routers to relay password spraying attacks against Microsoft 365 accounts. The investigation involved intercepting network communications and malware deployed on a compromised router in France. The findi…

Published: July 23, 2024

Downloadable IOCs: 4

BianLian Ransomware Group: 2024 Activity Analysis

The intelligence report delves into the evolving tactics and operations of the BianLian ransomware group, which has emerged as one of the top three most active ransomware groups. It details the group's shift from encryption tactics to a steal-and-extort model after a decryptor was released. The ana…

Published: July 12, 2024

Downloadable IOCs: 8

Analysis of Suspected APT Attack Activities by “Silver Fox”

This document examines the recent activities of the Silver Fox cybercrime group, which has traditionally targeted financial and tax entities but has now shifted its focus towards impersonating national institutions and security companies. The analysis involves a phishing website, Winos remote contr…

Published: July 10, 2024

Downloadable IOCs: 7

How do cryptocurrency drainer phishing scams work?

Cryptodrainer phishing scams have emerged as a significant threat, targeting unsuspecting individuals through deceptive tactics to steal their digital assets. These scams lure victims with promises of profits while covertly siphoning their cryptocurrency. Attackers employ social engineering techniq…

Published: July 10, 2024

Downloadable IOCs: 14

ONNX Store: Phishing-as-a-Service Platform Targeting Financial Institution

This intelligence report analyzes the ONNX Store, a phishing-as-a-service platform targeting financial institutions through embedded QR codes in PDF attachments redirecting victims to phishing sites. The report details the platform's features, including two-factor authentication bypass, realistic M…

Published: July 2, 2024

Downloadable IOCs: 25

The Digital Legacy of Botnet 911 S5

The report provides an in-depth analysis of the notorious Botnet 911 S5, revealing its origins, operations, and digital remnants. It traces the botnet's evolution, from its inception in 2014 to its eventual demise in 2024, after a joint law enforcement operation. The botnet leveraged free VPN softw…

Published: June 14, 2024

Downloadable IOCs: 35

Cybercriminals attack banking customers in EU with V3B phishing kit

An analysis reveals that a cybercriminal group is distributing sophisticated phishing kits to target banking customers in the European Union. These kits, designed to steal sensitive information like credentials and OTP codes, utilize social engineering tactics to deceive victims into revealing pers…

Published: June 10, 2024

Downloadable IOCs: 44

Crimeware report: Acrid, ScarletStealer and Sys01 stealers

This analysis delves into three distinct stealers: Acrid, ScarletStealer, and Sys01. Acrid is a new stealer found in December, employing the 'Heaven's Gate' technique to bypass security controls. ScarletStealer downloads additional executables and Chrome extensions to facilitate data theft. Sys01, …

Published: May 22, 2024

Downloadable IOCs: 5

Deserialization of VIEWSTATE: how an “unpatched” vulnerability plays into the hands of pro-government groups

At the end of 2023, the Solar 4RAYS team was investigating an attack on a Russian telecom company by an Asian advanced persistent threat (APT) group named Obstinate Mogwai (translated as "Stubborn Demon" in English). This group was persistent, repeatedly infiltrating the network until all entry poi…

Published: May 20, 2024

Downloadable IOCs: 9

From Document to Script: Insides of Campaign

This report examines a recent malicious campaign initiated via phishing emails, seemingly from 'QuickBooks,' prompting users to install Java. Clicking the embedded link leads to downloading a malicious JAR file. The JAR contains commands to fetch additional payloads, including an obfuscated AutoIt …

Published: May 17, 2024

Downloadable IOCs: 11

Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

LATRODECTUS is a malware loader gaining popularity among cybercriminals, with strong connections to the ICEDID malware family. It offers standard capabilities for deploying payloads and conducting post-exploitation activities. Initially discovered by Walmart researchers in 2023, it continues evolvi…

financially-motivated

Published: May 17, 2024

Downloadable IOCs: 7

ViperSoftX Uses Deep Learning-based Tesseract to Exfiltrate Information

This analysis focuses on the recent activities of the ViperSoftX malware strain, which controls infected systems and steals user information. The malware is known to install additional malware payloads, including Quasar RAT and a new infostealer called TesseractStealer. TesseractStealer utilizes th…

Published: May 17, 2024

Downloadable IOCs: 8

Profiling Trafficers: Cerberus

This analysis delves into the activities of a group of malware operators known as Cerberus (formerly Amnesia) Team, who specialize in spreading infostealers, particularly in the Commonwealth of Independent States (CIS) region. It provides insights into their operations, tactics, and the evolution o…

dracula stealer (samurai)

2024-05-09

2024-05-10

Published: May 10, 2024

Downloadable IOCs: 24

Tag: cybercrime

Attack reports

Booking.com Phishing Campaign Targeting Hotels and Customers

Malicious Infrastructure Finds Stability with aurologic GmbH

Remote access, real cargo: cybercriminals targeting trucking and logistics

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

SystemBC – Bringing the Noise

The Most Powerful Ever? Inside the 11.5Tbps-Scale Mega Botnet AISURU

Under the Pure Curtain: From RAT to Builder to Coder

Not Safe for Work: Tracking and Investigating Stealerium and Phantom Infostealers

Behind the Curtain: How Lumma Affiliates Operate

"Click to Allow" Robot Exposes Online Fraud Empire

DanaBot C2 Server Memory Leak Bug

Danabot: Analyzing a fallen empire

Where to Find Aspiring Hackers

Money Laundering 101, and why there is concern

VanHelsing: New RaaS in Town

Dragon RaaS | Pro-Russian Hacktivist Group Aims to Build on "The Five Families" Cybercrime Reputation

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

2024 Malicious Infrastructure Insights: Key Trends and Threats

Finance Report: Who Targets Financial Institutions?

Socks5Systemz Botnet Powers Illegal Proxy Service with 85,000+ Hacked Devices

One Sock Fits All: The use and abuse of the NSOCKS botnet

Telekopye transitions to targeting tourists via hotel booking scam

Life on a crooked RedLine: Analyzing the infamous infostealer's backend

DDoS-for-Hire Platform dstat[.]cc Disrupted; Suspects Arrested

Booking.com Phishers May Leave You With Reservations

Over 10 Million Personal And Corporate Devices Infected By Information Stealers

The Mongolian Skimmer: different clothes, equally dangerous

Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomware

Threat Assessment: North Korean Threat Groups

2024 Paris Olympic Games Infrastructure Attack Report

FIN7: The Truth Doesn't Need to be so STARK

A Dive into Latest Campaign

Router Roulette: Cybercriminals and Nation-States Sharing Compromised Networks

Solving the 7777 Botnet enigma: A cybersecurity quest

BianLian Ransomware Group: 2024 Activity Analysis

Analysis of Suspected APT Attack Activities by “Silver Fox”

How do cryptocurrency drainer phishing scams work?

ONNX Store: Phishing-as-a-Service Platform Targeting Financial Institution

The Digital Legacy of Botnet 911 S5

Cybercriminals attack banking customers in EU with V3B phishing kit

Crimeware report: Acrid, ScarletStealer and Sys01 stealers

Deserialization of VIEWSTATE: how an “unpatched” vulnerability plays into the hands of pro-government groups

From Document to Script: Insides of Campaign

Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

ViperSoftX Uses Deep Learning-based Tesseract to Exfiltrate Information

Profiling Trafficers: Cerberus