Today > vulnerabilities   -   You can now download lists of IOCs here!

Tag: phantomcore

2 attack reports | 0 vulnerabilities

Attack reports

Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads

Multiple Microsoft Office documents generated by the MacroPack framework have been discovered, likely used by malicious actors to deploy various payloads. These documents, uploaded to VirusTotal between May and July 2024, originated from different countries including China, Pakistan, Russia, and th…

havoc
phantomcore
2024-09-03
brute ratel
vba macros
macropack
Published: September 3, 2024

Downloadable IOCs 16

Head Mare: adventures of a unicorn in Russia and Belarus

Head Mare is a hacktivist group targeting companies in Russia and Belarus since 2023. They use phishing campaigns exploiting the CVE-2023-38831 vulnerability in WinRAR for initial access. Their toolkit includes custom malware like PhantomDL and PhantomCore, as well as publicly available tools like …

phishing
ransomware
russia
belarus
lockbit
CVE-2023-38831
2024-09-02
babuk
vasa locker
phantomdl
phantomcore
babyk
hacktivists
Published: September 2, 2024

Downloadable IOCs 52

» Click here to see all Attack Reports «