Tag: living-off-the-land

6 Attack Reports | 0 Vulnerabilities

Attack reports

Operation GriefLure: Dissecting an APT Campaign Targeting Vietnam's Military Telecom & Philippine Healthcare

A sophisticated spear phishing campaign dubbed Operation GriefLure targeted senior executives of Viettel Group, Vietnam's largest military-owned telecommunications provider, and St. Luke's Medical Center in the Philippines. The operation weaponized authentic legal documents from a genuine data brea…

living-off-the-land

Published: May 7, 2026

Downloadable IOCs: 12

Untangling a Linux Incident With an OpenAI Twist

A technology sector organization experienced a multi-actor compromise on a Linux endpoint where cryptominers were deployed and credential harvesting occurred. The incident became complex when the legitimate user attempted to troubleshoot suspected malicious activity using OpenAI's Codex AI agent wh…

credential theft

living-off-the-land

linux compromise

Published: April 17, 2026

Linked vulnerabilities : CVE-2025-47812

Downloadable IOCs: 1

ClickFix Campaigns Targeting Windows and macOS

Insikt Group identified five distinct clusters using the ClickFix social engineering technique for initial access. These clusters impersonate various services like Intuit QuickBooks and Booking.com, demonstrating operational variance but similar core techniques. ClickFix manipulates victims into ex…

social engineering

redline stealer

living-off-the-land

odyssey stealer

Published: March 25, 2026

Downloadable IOCs: 18

From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations

Tangerine Turkey is a cryptomining campaign that uses VBScript worms to spread via USB drives, leveraging living-off-the-land binaries for execution and persistence. The group employs defense evasion techniques by modifying registry keys and masquerading malicious binaries as legitimate system file…

living-off-the-land

defense-evasion

Published: October 29, 2025

Downloadable IOCs: 3

Hide Your RDP: Password Spray Leads to RansomHub Deployment

This report details a cyberattack where threat actors gained initial access through a password spray attack on an exposed RDP server. They used Mimikatz and Nirsoft for credential harvesting, and employed living-off-the-land techniques along with tools like Advanced IP Scanner for network discovery…

credential theft

lateral movement

data exfiltration

living-off-the-land

Published: June 30, 2025

Downloadable IOCs: 9

Malvertising campaign leads to info stealers hosted on GitHub

A large-scale malvertising campaign impacting nearly one million devices globally was detected in December 2024. The attack originated from illegal streaming websites with embedded malvertising redirectors, leading users through multiple redirections to malware hosted on GitHub and other platforms.…

information stealer

multi-stage attack

living-off-the-land

Published: March 6, 2025

Downloadable IOCs: 3

Click here to see more Attack Reports