Tag: kerberoasting

3 Attack Reports | 0 Vulnerabilities

Attack reports

Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

An intrusion was observed in April 2026 where threat actors deployed EtherRAT malware through a malicious MSI installer disguised as a Sysinternals tool. The malware utilized Ethereum blockchain via EtherHiding for dynamic C2 configuration updates. Following reconnaissance activities, actors deploy…
rclone
dll sideloading
mimikatz
ethereum
kerberoasting
the gentlemen ransomware
the gentlemen
CVE-2025-55182
etherrat
saas abuse
netexec
blockchain c2
2026-05-11
tuktuk
Published: May 11, 2026
Linked vulnerabilities : CVE-2025-55182 (CVSS 10.0)
Downloadable IOCs: 17

Like PuTTY in Admin's Hands

The LevelBlue Managed Detection and Response team handled incidents related to a malvertising campaign distributing trojanized versions of the PuTTY terminal emulator. The malicious software, masquerading as legitimate PuTTY, was downloaded by privileged users and exhibited behaviors such as Kerber…
malvertising
putty
kerberoasting
2025-08-27
oyster
broomstick
trojanized
Published: August 27, 2025
Downloadable IOCs: 0

A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor

This analysis details a campaign involving two threat groups, UNC5518 and UNC5774, deploying the CORNFLAKE.V3 backdoor. UNC5518 compromises legitimate websites to serve fake CAPTCHA pages, luring visitors to execute a downloader script. UNC5774 then uses this access to deploy CORNFLAKE.V3, a sophis…
backdoor
node.js
clickfix
php
2025-08-21
cornflake.v3
windytwist.sea
kerberoasting
Published: August 21, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports