SecuriTricks - dropbox

UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting Israel

An analysis of threat clusters, dubbed UNG0801 or Operation IconCat, targeting Israeli organizations. The actors use socially engineered phishing lures in Hebrew, exploiting antivirus icon spoofing from well-known vendors like SentinelOne and Check Point. Two distinct infection chains were identifi…

phishing

dropbox

Published: December 22, 2025

Downloadable IOCs: 7

Analysis of APT-C-53 (Gamaredon) Attack on Ukrainian Government Agencies

APT-C-53, also known as Gamaredon, is a Russian state-sponsored threat group active since 2013, targeting Ukrainian government and military entities. The group has upgraded its attack techniques, focusing on dynamic cloud-based C2 infrastructure and targeted delivery of cloud storage tools. In 2025…

Published: September 1, 2025

Downloadable IOCs: 11

RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies

A new variant of RoKRAT malware used by APT37 has been identified, employing a two-stage encrypted shellcode injection method and steganography to conceal malicious code in image files. The malware uses shortcut files with embedded commands to execute its attack, distributed via compressed archives…

Published: August 7, 2025

Downloadable IOCs: 0

Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication

A cluster of suspicious activity, tracked as CL-STA-1020, has been targeting governmental entities in Southeast Asia since late 2024. The threat actors have developed a new Windows backdoor called HazyBeacon, which uses AWS Lambda URLs for command and control communication. This technique leverages…

governmental entities

hazybeacon

Published: July 14, 2025

Downloadable IOCs: 7

Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure

A sophisticated spearphishing campaign targeting South Korea has been uncovered, utilizing GitHub as attack infrastructure. The threat actor, linked to the North Korean group Kimsuky, created multiple private repositories to store malware, decoy files, and exfiltrated victim data. The attack levera…

Published: June 26, 2025

Downloadable IOCs: 16

Tag: dropbox

Attack reports

UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting Israel

Analysis of APT-C-53 (Gamaredon) Attack on Ukrainian Government Agencies

RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies

Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication

Dissecting Kimsuky's Attacks on South Korea: In-Depth Analysis of GitHub-Based Malicious Infrastructure

Warning Against Distribution of Malware Disguised as Research Papers

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again

APT Attacks Using Cloud Storage