SecuriTricks - github

Albabat Ransomware Group Potentially Expands Targets to Multiple OS Uses GitHub to Streamline Operations

The Albabat ransomware group has evolved its malware to target Windows, Linux, and macOS devices, as evidenced by new versions 2.0.0 and 2.5. The group is using GitHub to streamline operations, storing configuration files and essential components. The ransomware ignores specific folders, encrypts c…

ransomware

cryptocurrency

Published: March 21, 2025

Downloadable IOCs: 2

AI-Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution

A campaign using fake GitHub repositories to distribute SmartLoader and Lumma Stealer malware has been uncovered. The attackers create convincing repositories using AI-generated content to deceive users into downloading malicious files disguised as gaming cheats, cracked software, and system tools.…

Published: March 11, 2025

Downloadable IOCs: 14

Malvertising campaign leads to info stealers hosted on GitHub

A large-scale malvertising campaign impacting nearly one million devices globally was detected in December 2024. The attack originated from illegal streaming websites with embedded malvertising redirectors, leading users through multiple redirections to malware hosted on GitHub and other platforms.…

Published: March 6, 2025

Downloadable IOCs: 3

Fake GitHub projects distribute stealers in GitVenom campaign

The GitVenom campaign involves threat actors creating hundreds of fake repositories on GitHub containing malicious code disguised as legitimate projects. These repositories include well-designed README files and artificially inflated commit numbers to appear genuine. The malicious code, implemented…

Published: February 24, 2025

Downloadable IOCs: 2

macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed

This intelligence analysis describes newly discovered variants of the DPRK-attributed macOS Ferret malware family, labeled as 'FlexibleFerret'. The malware is part of the ongoing 'Contagious Interview' campaign targeting developers and job seekers. The new variants include a dropper package contain…

multi_frostyferret_cmdcodes

Published: February 4, 2025

Downloadable IOCs: 2

Information Stealer Masquerades as LDAPNightmare (CVE-2024-49113) PoC Exploit

A fake proof-of-concept exploit for the LDAPNightmare vulnerability (CVE-2024-49113) is being used to distribute information-stealing malware. The malicious repository, disguised as a fork from the original creator, contains an executable file that, when run, drops and executes a PowerShell script.…

Published: January 10, 2025

Downloadable IOCs: 0

Banshee: The Stealer That "Stole Code" From MacOS XProtect

A new version of the Banshee macOS stealer, linked to Russian-speaking cybercriminals, has been monitored since September. This version went undetected for over two months, using a string encryption algorithm identical to Apple's XProtect antivirus engine. The malware targets browser credentials, c…

Published: January 9, 2025

Downloadable IOCs: 25

Cryptocurrency Enthusiasts Targeted in Multi-Vector Supply Chain Attack

A sophisticated malware campaign targeting cryptocurrency enthusiasts has been uncovered, utilizing multiple attack vectors including a malicious Python package on PyPI and deceptive GitHub repositories. The multi-stage malware, disguised as cryptocurrency trading tools, aims to steal sensitive dat…

Published: November 4, 2024

Downloadable IOCs: 2

Security Brief: Royal Mail Lures Deliver Open Source Prince Ransomware

A campaign impersonating Royal Mail was identified delivering Prince ransomware, an open-source variant available on GitHub. The low-volume attack targeted UK and US organizations in mid-September, often originating from contact forms on target websites. The ransomware lacks decryption mechanisms a…

Published: October 2, 2024

Downloadable IOCs: 3

Key Group: another ransomware group using leaked builders

Key Group is a financially motivated ransomware group primarily targeting Russian users. They use various leaked ransomware builders including Chaos, Xorist, Annabelle, Slam, RuRansom, UX-Cryptor, Hakuna Matata, and Judge/NoCry. The group's activity has been tracked since April 2022, with their tac…

financially motivated

Published: October 1, 2024

Downloadable IOCs: 0

Unraveling the Sophisticated Attack Leveraging VS Code for Unauthorized Access

A sophisticated attack has been uncovered that exploits Visual Studio Code's remote tunnel capabilities for unauthorized access. The attack begins with a .LNK file, disguised as a legitimate setup, which downloads a Python package and executes a malicious script. This script establishes persistence…

Published: October 1, 2024

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-44228, CVE-2017-11882, CVE-2024-21893

Downloadable IOCs: 7

BORN Group Supply Chain Breach: In-Depth Analysis of Jenkins Exploitation

This analysis examines a substantial supply chain assault on the IT service provider BORN Group. The cybercriminal Intelbroker leveraged a vulnerability (CVE-2024-23897) to breach BORN Group's infrastructure, leading to the exfiltration of sensitive information from various clients. Furthermore, In…

supply chain

github

2024-08-23

Published: August 23, 2024

Linked vulnerabilities : CVE-2024-23897

Downloadable IOCs: 5

Kematian-Stealer: A Deep Dive into a New Information Stealer

This report provides an in-depth analysis of a newly discovered information stealer named Kematian-Stealer, actively developed on GitHub and distributed as open-source software. The malware employs various techniques to collect sensitive data from compromised systems, evade detection, and maintain …

Published: July 10, 2024

Downloadable IOCs: 4

Persistent npm Campaign Shipping Trojanized jQuery

The report describes a persistent supply chain attack involving the distribution of a trojanized version of jQuery through various platforms like npm and GitHub. The malicious jQuery variant, containing a modified 'end' function, exfiltrates website form data by sending it to remote URLs controlled…

Published: July 10, 2024

Downloadable IOCs: 67

CloudSorcerer – A new APT targeting Russian government entities

In May 2024, Kaspersky discovered a sophisticated cyberespionage tool called CloudSorcerer, targeting Russian government entities. This malware leverages cloud resources like Microsoft Graph, Yandex Cloud, and Dropbox as command-and-control (C2) servers, accessing them through APIs using authentica…

2024-07-08

github

c programming language

cloudsorcerer

ror14 algorithm

microsoft com object

Published: July 8, 2024

Downloadable IOCs: 1

Tag: github

Attack reports

Clone, Compile, Compromise: Open-Source Malware Trap on GitHub

The strange tale of ischhfd83: When cybercriminals eat their own

The Shelby Strategy

PJobRAT makes a comeback, takes another crack at chat apps

CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin

Albabat Ransomware Group Potentially Expands Targets to Multiple OS Uses GitHub to Streamline Operations

AI-Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution

Malvertising campaign leads to info stealers hosted on GitHub

Fake GitHub projects distribute stealers in GitVenom campaign

macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed

Information Stealer Masquerades as LDAPNightmare (CVE-2024-49113) PoC Exploit

Banshee: The Stealer That "Stole Code" From MacOS XProtect

Cryptocurrency Enthusiasts Targeted in Multi-Vector Supply Chain Attack

Security Brief: Royal Mail Lures Deliver Open Source Prince Ransomware

Key Group: another ransomware group using leaked builders

Unraveling the Sophisticated Attack Leveraging VS Code for Unauthorized Access

BORN Group Supply Chain Breach: In-Depth Analysis of Jenkins Exploitation

Kematian-Stealer: A Deep Dive into a New Information Stealer

Persistent npm Campaign Shipping Trojanized jQuery

CloudSorcerer – A new APT targeting Russian government entities