Tag: multi-stage infection

5 Attack Reports | 0 Vulnerabilities

Attack reports

Lumma Stealer Chronicles: PDF-themed Campaign Using Compromised Educational Institutions' Infrastructure

An ongoing malware campaign is distributing Lumma Stealer, an information-stealing malware, through malicious LNK files disguised as PDF documents. The campaign exploits compromised educational institutions' infrastructure to host these files. When executed, the LNK files initiate a multi-stage inf…

information stealing

multi-stage infection

educational institutions

Published: February 17, 2025

Downloadable IOCs: 24

XWorm: Analyzing New Infection Tactics With Old Payload

A recent malware campaign utilizes a multi-stage infection chain starting with a LNK file that lures victims into opening an invoice in a web browser. The attack involves PowerShell commands, batch files, and Python scripts to download and execute the XWorm payload. The infection process includes d…

shellcode injection

multi-stage infection

Published: December 4, 2024

Downloadable IOCs: 0

Analysis of AsyncRAT's Infection Tactics via Open Directories

This analysis explores two distinct methods used to infect systems with AsyncRAT through open directories. The first technique involves a multi-stage process using various obfuscated scripts (VBS, BAT, PowerShell) and disguised files to download and execute the AsyncRAT payload. The second method e…

remote access trojan

multi-stage infection

scheduled tasks

open directories

Published: November 7, 2024

Downloadable IOCs: 15

New Winos 4.0 Malware Infects Gamers Through Malicious Game Optimization Apps

A command-and-control framework called Winos 4.0 is being distributed through gaming-related applications, targeting Chinese-speaking users. The malware, rebuilt from Gh0st RAT, uses a multi-stage infection process involving fake BMP files, DLLs, and shellcode. It can harvest system information, ca…

cryptocurrency wallets

multi-stage infection

command-and-control

optimization apps

Published: November 6, 2024

Downloadable IOCs: 2

Notorious WrnRAT Delivered Mimic As Gambling Games

Cybersecurity analysts have uncovered a sophisticated malware operation targeting online gambling platforms. Threat actors are distributing the WrnRAT malware by disguising it as popular Korean gambling games. The multi-stage infection process involves a batch script, followed by a .NET-based dropp…

multi-stage infection

financial exploitation

Published: October 29, 2024

Downloadable IOCs: 5

Click here to see more Attack Reports