Tag: redline stealer
5 attack reports | 0 vulnerabilities
Attack reports
Not All Fun and Games: Lua Malware Targets Educational Sector and Student Gaming Engines
Over the past year, the delivery of Lua malware appears to have undergone simplification, possibly to reduce exposure to detection mechanisms. The malware is frequently delivered using obfuscated Lua scripts instead of compiled Lua bytecode, as the latter can trigger suspicion more easily.
Downloadable IOCs 18
No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection
This article analyzes four previously undisclosed DNS tunneling campaigns identified through a new campaign monitoring system. The system detects tunneling domains based on common techniques and attributes used in malicious campaigns. Four new campaigns were uncovered: FinHealthXDS (targeting finan…
Downloadable IOCs 0
Ransomware in the Cloud: Scattered Spider Targeting Insurance and Financial Industries
The Scattered Spider cybercriminal group is targeting cloud infrastructures in the insurance and financial sectors using advanced techniques. They exploit leaked authentication tokens, conduct phishing and smishing campaigns, and leverage SIM swapping to bypass multi-factor authentication. The grou…
Downloadable IOCs 12
Fake update puts visitors at risk
This intelligence report discusses SocGholish, a JavaScript downloader used by threat actors to deliver malware payloads disguised as fake browser updates. It analyzes the recent tactics, techniques, and procedures employed by threat groups like Evil Corp in compromising WordPress websites, fingerp…
Downloadable IOCs 10
VayGren and Mr.Burns: Strong Ties in Finance
F.A.C.C.T experts analyzed the tools and connections of cybercriminals attacking Russian accountants. An analysis of the infection chain of the VasyGrek attacker, his forum activity and connection with the malware developer Mr.Burns is presented. The history of Mr.Burns, starting in 2010, is given,…
Downloadable IOCs 131