Tag: living-off-the-land

3 Attack Reports | 0 Vulnerabilities

Attack reports

From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations

Tangerine Turkey is a cryptomining campaign that uses VBScript worms to spread via USB drives, leveraging living-off-the-land binaries for execution and persistence. The group employs defense evasion techniques by modifying registry keys and masquerading malicious binaries as legitimate system file…

living-off-the-land

defense-evasion

Published: October 29, 2025

Downloadable IOCs: 3

Hide Your RDP: Password Spray Leads to RansomHub Deployment

This report details a cyberattack where threat actors gained initial access through a password spray attack on an exposed RDP server. They used Mimikatz and Nirsoft for credential harvesting, and employed living-off-the-land techniques along with tools like Advanced IP Scanner for network discovery…

credential theft

lateral movement

data exfiltration

living-off-the-land

Published: June 30, 2025

Downloadable IOCs: 9

Malvertising campaign leads to info stealers hosted on GitHub

A large-scale malvertising campaign impacting nearly one million devices globally was detected in December 2024. The attack originated from illegal streaming websites with embedded malvertising redirectors, leading users through multiple redirections to malware hosted on GitHub and other platforms.…

information stealer

multi-stage attack

living-off-the-land

Published: March 6, 2025

Downloadable IOCs: 3

Click here to see more Attack Reports