Tag: latin america

5 Attack Reports | 0 Vulnerabilities

Attack reports

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

A malware campaign called WEBJACK is compromising Microsoft IIS servers to deploy BadIIS malware modules for SEO poisoning and fraud. The attackers hijack high-profile targets, including government and educational institutions, to redirect users to gambling websites. The campaign uses various tools…

chinese threat actor

gambling redirection

Published: November 19, 2025

Downloadable IOCs: 34

Watch out for SVG files booby-trapped with malware

A recent malware campaign in Latin America demonstrates cybercriminals' evolving tactics. The attacks use social engineering, sending emails that appear to be from trusted institutions with urgent warnings about legal issues. The campaign's goal is to install AsyncRAT, a remote access trojan that a…

social engineering

dll sideloading

ai-generated templates

judicial system impersonation

Published: November 9, 2025

Downloadable IOCs: 0

A new RevengeHotels campaign targets Latin America

RevengeHotels, a threat group active since 2015, has launched a new campaign targeting the hospitality sector in Latin America. The group has evolved its tactics, now utilizing AI-generated code and the advanced VenomRAT malware. Their primary attack vector remains phishing emails with invoice them…

stealth techniques

ai-generated code

Published: September 16, 2025

Linked vulnerabilities : CVE-2017-0199

Downloadable IOCs: 0

The Espionage Toolkit: A Closer Look at its Advanced Techniques

Earth Alux, a China-linked APT group, is actively conducting cyberespionage attacks against key sectors in the APAC and Latin American regions. The group exploits vulnerable services in exposed servers to gain initial access and deploys web shells like GODZILLA. Their primary backdoor, VARGEIT, is …

dll side-loading

Published: March 31, 2025

Downloadable IOCs: 0

ToxicPanda: a new banking trojan from Asia hit Europe and LATAM

A new Android banking Trojan called ToxicPanda has emerged, targeting Europe and Latin America. Originating from Chinese-speaking threat actors, it has infected over 1500 devices across Italy, Portugal, Spain, and other countries. ToxicPanda exploits accessibility services for account takeovers and…

c2 infrastructure

chinese threat actors

on-device fraud

accessibility abuse

Published: November 6, 2024

Downloadable IOCs: 19

Click here to see more Attack Reports