Tag: malware-as-a-service

10 Attack Reports | 0 Vulnerabilities

Attack reports

TerraStealerV2 and TerraLogger: Golden Chickens' New Malware Families Discovered

Insikt Group has discovered two new malware families, TerraStealerV2 and TerraLogger, linked to the financially motivated threat actor Golden Chickens. TerraStealerV2 is designed to steal browser credentials, cryptocurrency wallet data, and browser extension information, while TerraLogger functions…

credential theft

malware-as-a-service

Published: May 1, 2025

Downloadable IOCs: 39

DNS Early Detection - Fast Propagating Fake Captcha distributes LummaStealer

Between October 2024 and February 2025, LummaStealer malware was distributed via fake CAPTCHA pages, targeting users who store sensitive information in browsers and cryptocurrency wallets. The malware, available as a Malware-as-a-Service, collects data for fraud and unauthorized access. Threat acto…

malware-as-a-service

information stealer

early detection

malicious domains

dns traffic analysis

Published: February 28, 2025

Downloadable IOCs: 11

GhostSocks - Partner In Proxy

GhostSocks is a Golang-based SOCKS5 backconnect proxy malware first identified in October 2023. It is primarily deployed alongside the LummaC2 information stealer and offered as Malware-as-a-Service. GhostSocks uses a relay-based C2 implementation with HTTP API, allowing attackers to route traffic …

malware-as-a-service

c2 infrastructure

credential abuse

anti-fraud bypass

backconnect proxy

Published: February 25, 2025

Downloadable IOCs: 17

Life on a crooked RedLine: Analyzing the infamous infostealer's backend

This article provides an in-depth analysis of RedLine Stealer, a notorious information-stealing malware. The research focuses on previously undocumented backend modules and the control panel used by affiliates. Key findings include the identification of over 1,000 unique IP addresses hosting RedLin…

malware-as-a-service

redline stealer

windows communication framework

backend analysis

Published: November 17, 2024

Downloadable IOCs: 0

Over 10 Million Personal And Corporate Devices Infected By Information Stealers

A significant increase in data-stealing malware infections has been observed, with nearly 10 million devices compromised in 2023, marking a 643% rise over three years. Cybercriminals are using sophisticated distribution methods, including malvertising and YouTube comment spam. On average, 50.9 logi…

credential theft

malware-as-a-service

information stealers

Published: October 22, 2024

Downloadable IOCs: 0

MDR in Action: Preventing The More_eggs Backdoor From Hatching

A sophisticated spear-phishing attack led to a more_eggs backdoor infection at a company. The attack began with an email to a senior executive, followed by a recruitment officer downloading a fake resume. The malicious file, disguised as a resume, contained obfuscated commands that executed when op…

malware-as-a-service

golden chickens

Published: October 1, 2024

Downloadable IOCs: 10

Gomorrah Stealer: An In-Depth Analysis of a .NET-Based Malware

This comprehensive report analyzes Gomorrah Stealer, a sophisticated malware designed to exfiltrate sensitive information from compromised systems. It operates within a malware-as-a-service framework and targets data from web browsers, cryptocurrency wallets, VPNs, and configuration files. The stea…

malware-as-a-service

gomorrah stealer

Published: September 16, 2024

Downloadable IOCs: 6

The Abuse of ITarian RMM by Dolphin Loader

This report explores how the Dolphin Loader, a malware-as-a-service loader, abuses the legitimate ITarian Remote Monitoring and Management (RMM) software to distribute various malware payloads. The loader leverages the built-in functionality of RMM tools, such as remote command execution and system…

malware-as-a-service

Published: August 19, 2024

Downloadable IOCs: 24

Mint Stealer: A Comprehensive Study of a Python-Based Information Stealer

At Cyfirma, this report offers a comprehensive analysis of Mint Stealer, an information-stealing malware operating within a malware-as-a-service (MaaS) framework. Mint Stealer targets sensitive data and uses sophisticated techniques to evade detection. This in-depth study explores Mint Stealer's ev…

malware-as-a-service

data exfiltration

information stealer

evasion tactics

Published: July 31, 2024

Downloadable IOCs: 10

Banking trojan unleashed: Observing emerging global campaigns

IBM's X-Force has been tracking large-scale phishing campaigns distributing the Grandoreiro banking trojan, likely operated as a Malware-as-a-Service. The malware targets over 1500 global banks, enabling banking fraud in over 60 countries. The latest variant features major updates, including string…

malware-as-a-service

Published: May 20, 2024

Downloadable IOCs: 18

Click here to see more Attack Reports