SecuriTricks - exfiltration

Targets Ukraine's Defense Forces using SPECTR malware alongside legitimate SyncThing

The report describes a cyber attack campaign by the UAC-0020 (Vermin) threat group targeting Ukraine's Defense Forces. The attackers utilized the SPECTR malware in tandem with the legitimate SyncThing software to exfiltrate sensitive data. The malicious payload was delivered via a password-protecte…

ukraine

exfiltration

Published: June 7, 2024

Downloadable IOCs: 33

New ransomware group abusing BitLocker

The report examines an incident where threat actors leveraged Microsoft's BitLocker encryption utility to deploy unauthorized file encryption on targeted systems. The adversaries employed a sophisticated VBScript that resized disk partitions, modified registry entries, enabled BitLocker with random…

trojan-ransom.vbs.bitlock.gen

trojan.vbs.sagent.gen

trojan.win32.generic

partitions

Published: May 23, 2024

Linked vulnerabilities : CVE-2024-30051 (CVSS 7.8)

Downloadable IOCs: 6

StopRansomware: Black Basta

This advisory details tactics, techniques, procedures and indicators of compromise related to Black Basta ransomware, a variant first identified in April 2022. Its affiliates have impacted over 500 organizations globally across multiple critical infrastructure sectors, including Healthcare and Publ…

Published: May 13, 2024

Linked vulnerabilities : CVE-2021-42287, CVE-2021-42278, CVE-2024-1709, CVE-2021-34527, CVE-2020-1472

Downloadable IOCs: 174

Fletchen Stealer: An Information Stealer with Sophisticated Anti-Analysis Measures

This in-depth analysis examines Fletchen stealer, an advanced information-stealing malware featuring potent anti-analysis capabilities. It explores the malware's tactics for data harvesting from compromised systems, exfiltration methods, and measures to evade detection. The report emphasizes the dy…

Published: April 29, 2024

Downloadable IOCs: 13

Tag: exfiltration

Attack reports

Fake Zoom Ends in BlackSuit Ransomware

Confluence Exploit Leads to LockBit Ransomware

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

U.S. Organization in China Targeted by Attackers

HawkEye Malware: Technical Analysis

FortiManager fgfmd vulnerability indicators

VILSA STEALER

North Korea Still Attacking Developers via npm

Gomorrah Stealer: An In-Depth Analysis of a .NET-Based Malware

Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomware

There's Something About CryptBot: Yet Another Silly Stealer

Ailurophile Stealer

Chinese APT Abuses VSCode to Target Government in Asia

A Comprehensive Analysis of Angry Stealer: Rage Stealer in a New Disguise

Report on Ukraine government attack campaign

Ailurophile: G DATA has sighted a new info stealer in the wild

Hackers Leveraging OneDrive Or Google Drive To Hide Malicious Traffic

BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor

Analysis of Golang Payload and Information Theft Campaign

Threat Actor Uses Fake Recovery Manual to Deliver Unidentified Stealer

Akira Ransomware Targets the LATAM Airline Industry

Braodo Info Stealer Targeting Vietnam and Abroad

Persistent npm Campaign Shipping Trojanized jQuery

Arid Viper poisons Android apps with AridSpy

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

Targets Ukraine's Defense Forces using SPECTR malware alongside legitimate SyncThing

New ransomware group abusing BitLocker

StopRansomware: Black Basta

Fletchen Stealer: An Information Stealer with Sophisticated Anti-Analysis Measures