SecuriTricks - redline stealer

Not All Fun and Games: Lua Malware Targets Educational Sector and Student Gaming Engines

Over the past year, the delivery of Lua malware appears to have undergone simplification, possibly to reduce exposure to detection mechanisms. The malware is frequently delivered using obfuscated Lua scripts instead of compiled Lua bytecode, as the latter can trigger suspicion more easily.

ransomware

powershell

Published: October 9, 2024

Downloadable IOCs: 18

No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection

This article analyzes four previously undisclosed DNS tunneling campaigns identified through a new campaign monitoring system. The system detects tunneling domains based on common techniques and attributes used in malicious campaigns. Four new campaigns were uncovered: FinHealthXDS (targeting finan…

covert communications

hiloti

finhealthxds

Published: October 5, 2024

Downloadable IOCs: 0

Ransomware in the Cloud: Scattered Spider Targeting Insurance and Financial Industries

The Scattered Spider cybercriminal group is targeting cloud infrastructures in the insurance and financial sectors using advanced techniques. They exploit leaked authentication tokens, conduct phishing and smishing campaigns, and leverage SIM swapping to bypass multi-factor authentication. The grou…

Published: September 11, 2024

Downloadable IOCs: 12

Fake update puts visitors at risk

This intelligence report discusses SocGholish, a JavaScript downloader used by threat actors to deliver malware payloads disguised as fake browser updates. It analyzes the recent tactics, techniques, and procedures employed by threat groups like Evil Corp in compromising WordPress websites, fingerp…

Published: July 24, 2024

Downloadable IOCs: 10

VayGren and Mr.Burns: Strong Ties in Finance

F.A.C.C.T experts analyzed the tools and connections of cybercriminals attacking Russian accountants. An analysis of the infection chain of the VasyGrek attacker, his forum activity and connection with the malware developer Mr.Burns is presented. The history of Mr.Burns, starting in 2010, is given,…

Published: July 10, 2024

Downloadable IOCs: 131

Tag: redline stealer

Attack reports

Malicious Infrastructure Finds Stability with aurologic GmbH

Inside a Malware Campaign: A Nigerian Hacker's Perspective

Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation

Pirated Business Software Activator Spreads RedLine Stealer

Life on a crooked RedLine: Analyzing the infamous infostealer's backend

Not All Fun and Games: Lua Malware Targets Educational Sector and Student Gaming Engines

No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection

Ransomware in the Cloud: Scattered Spider Targeting Insurance and Financial Industries

Fake update puts visitors at risk

VayGren and Mr.Burns: Strong Ties in Finance