Tag: fake updates

5 Attack Reports | 0 Vulnerabilities

Attack reports

Unmasking SocGholish: Untangling the Malware Web Behind the 'Pioneer of Fake Updates' and Its Operator

SocGholish, operated by TA569, functions as a Malware-as-a-Service vendor, employing deceptive 'fake browser update' lures to compromise systems. It leverages Traffic Distribution Systems like Parrot TDS and Keitaro TDS to filter and redirect victims. TA569 acts as an Initial Access Broker, enablin…

malware-as-a-service

initial access broker

raspberry robin

traffic distribution system

domain shadowing

Published: August 8, 2025

Downloadable IOCs: 33

Chinese Malware Delivery Domains: Part III

This report details an ongoing campaign by a threat actor operating during Chinese time zone hours, targeting Chinese-speaking individuals and entities globally. Since June 2023, the actor has created over 2,800 domains for malware delivery, primarily targeting Windows systems through fake applicat…

Published: July 18, 2025

Downloadable IOCs: 1159

Threat Actors abuse signed ConnectWise application as malware builder

Since March 2025, there has been an increase in infections using validly signed ConnectWise samples. Threat actors are exploiting ConnectWise's authenticode stuffing practices to create and distribute their own signed malware. The malicious samples use modified settings in the certificate table to …

certificate abuse

authenticode stuffing

unauthenticated attributes

Published: June 24, 2025

Linked vulnerabilities : CVE-2024-1709, CVE-2024-1708

Downloadable IOCs: 30

New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

Insikt Group uncovered new infrastructure linked to GrayAlpha, a threat actor associated with FIN7. They identified a custom PowerShell loader named PowerNet that deploys NetSupport RAT, and another loader called MaskBat. Three main infection vectors were discovered: fake browser updates, fake 7-Zi…

Published: June 13, 2025

Downloadable IOCs: 0

An Update on Fake Updates: Two New Actors, and New Mac Malware

Proofpoint has identified two new cybercriminal threat actors, TA2726 and TA2727, operating web inject campaigns. TA2726 acts as a traffic distribution service for TA569 and TA2727, while TA2727 delivers various malware payloads including a new MacOS information stealer called FrigidStealer. The la…

traffic distribution

Published: February 18, 2025

Downloadable IOCs: 10

Click here to see more Attack Reports