SecuriTricks

Analysis of Attack Cases Against Korean Solutions by the Andariel Group (SmallTiger)

The Andariel group has been targeting various South Korean software solutions, particularly asset management and document management systems. Recent attacks involve the installation of SmallTiger malware, often through exploiting vulnerabilities in outdated software versions. In asset management so…

south korea

rdp

Published: December 31, 2024

Downloadable IOCs: 5

Unwrapping the emerging Interlock ransomware attack

A new ransomware group called Interlock has emerged, targeting various sectors with big-game hunting and double extortion attacks. The group uses a sophisticated delivery chain including a RAT disguised as a browser updater, PowerShell scripts, credential stealers, and keyloggers. They primarily mo…

Published: November 7, 2024

Downloadable IOCs: 2

Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files

On October 22, 2024, Microsoft identified a spear-phishing campaign in which Midnight Blizzard sent phishing emails to thousands of users in over 100 organizations. The emails were highly targeted, using social engineering lures relating to Microsoft, Amazon Web Services (AWS), and the concept of Z…

Published: October 30, 2024

Downloadable IOCs: 281

Unauthorized RDP Connections For Cyberespionage Operations

Cyble Research and Intelligence Labs uncovered an ongoing cyberattack campaign utilizing malicious LNK files to gain unauthorized Remote Desktop access on compromised systems. The sophisticated multi-stage attack chain employs PowerShell and BAT scripts to evade detection, create administrative acc…

Published: October 26, 2024

Downloadable IOCs: 0

Malicious RDP Files Identified in Latest Attack on Ukrainian Entities

CERT-UA has uncovered a new malicious email campaign targeting Ukrainian government agencies, enterprises, and military entities. The campaign uses RDP configuration files to establish remote connections, enabling data theft and further malware deployment. Attributed to UAC-0215 and linked to APT29…

Published: October 26, 2024

Downloadable IOCs: 0

Aiming at domestic government and enterprises! Deeply revealed ransomware operator Rast gang

A new ransomware threat, dubbed Rast, has emerged targeting Chinese government and enterprises since December 2023. Written in Rust, Rast has infected over 6,800 terminals, successfully encrypting more than 5,700. The Rast gang, named after the ransomware, operates primarily between 20:00 and 05:00…

Published: September 30, 2024

Downloadable IOCs: 21

Bondnet Using High-Performance Bots For C2 Server

Security researchers at ASEC have discovered that a threat actor is using high-performance bots to turn compromised systems into their central server (C2) servers, using tools such as the Cloudflare tunneling client.

Published: June 17, 2024

Downloadable IOCs: 27

Threat Actors' Systems Can Also Be Exposed and Used by Other Threat Actors

This report discusses a case where a CoinMiner threat actor's proxy server, used to access an infected botnet, became the target of a ransomware threat actor's Remote Desktop Protocol (RDP) scan attack. The ransomware threat actor successfully breached the proxy server and distributed ransomware to…

Published: June 6, 2024

Downloadable IOCs: 34

Tag: rdp

Attack reports

Ransomware Initial Access Brokers Exposed

Confluence Exploit Leads to LockBit Ransomware

Play Ransomware impersonates SentinelOne for stealth recon

Analysis of Attack Cases Against Korean Solutions by the Andariel Group (SmallTiger)

Unwrapping the emerging Interlock ransomware attack

Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files

Unauthorized RDP Connections For Cyberespionage Operations

Malicious RDP Files Identified in Latest Attack on Ukrainian Entities

Aiming at domestic government and enterprises! Deeply revealed ransomware operator Rast gang

Bondnet Using High-Performance Bots For C2 Server

Threat Actors' Systems Can Also Be Exposed and Used by Other Threat Actors