SecuriTricks - remote access

Newly Registered Domains Distributing SpyNote Malware

Cybercriminals are employing deceptive websites on newly registered domains to distribute AndroidOS SpyNote malware. These sites imitate the Google Chrome install page on the Google Play Store, tricking users into downloading SpyNote, a powerful Android remote access trojan. SpyNote is used for sur…

rat

phishing

Published: April 15, 2025

Downloadable IOCs: 0

TookPS distributed under the guise of UltraViewer, AutoCAD, and Ableton

A malware campaign is distributing the TookPS downloader by impersonating popular software like UltraViewer, AutoCAD, SketchUp, Ableton, and Quicken. The malware establishes an SSH tunnel for remote access and deploys additional payloads like TeviRat and Lapmon backdoors. The attackers gain full sy…

software impersonation

Published: April 3, 2025

Downloadable IOCs: 17

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

Threat actors are increasingly using legitimate remote monitoring and management (RMM) tools as initial payloads in email campaigns. This trend aligns with a decrease in the use of traditional loaders and botnets by initial access brokers. RMMs can be exploited for data collection, financial theft,…

Published: March 12, 2025

Downloadable IOCs: 15

JSPSpy and 'Filebroser': A Custom File Management Tool in Webshell Infrastructure

Researchers have identified a cluster of JSPSpy web shell servers featuring 'Filebroser', a modified version of the open-source File Browser project. The infrastructure spans multiple hosting providers in China and the United States, using both cloud services and traditional ISPs. JSPSpy, a Java-ba…

Published: March 12, 2025

Downloadable IOCs: 4

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware

The report describes a recent campaign by the threat actor Storm-1811, a financially motivated cybercriminal group known for deploying Black Basta ransomware. The campaign begins with social engineering tactics like voice phishing (vishing) and email bombing to trick users into granting remote acce…

Published: May 16, 2024

Downloadable IOCs: 12

Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four

This comprehensive analysis provides a thorough examination of the REMCOS Remote Access Trojan (RAT), a prominent malware threat that gained significant prevalence in 2024. The analysis delves into the malware's configuration structure, command and control capabilities, persistence mechanisms, and …

Published: May 9, 2024

Downloadable IOCs: 34

Tag: remote access

Attack reports

Newly Registered Domains Distributing SpyNote Malware

TookPS distributed under the guise of UltraViewer, AutoCAD, and Ableton

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

JSPSpy and 'Filebroser': A Custom File Management Tool in Webshell Infrastructure

Camera off: Akira deploys ransomware via webcam

Deep Dive Into a Linux Rootkit Malware

Attackers exploiting a FortiClient EMS vulnerability in the wild

NetSupport RAT and RMS in malicious emails

Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT

Know Thy Enemy: A Novel November Case on Persistent Remote Access

HEXON STEALER: THE LONG JOURNEY OF COPYING, HIDING, AND REBRANDING

Rat King: How the Android Trojan CraxsRAT Steals User Data

Grandoreiro banking trojan: overview of recent versions and new tricks

XWorm: Analysis of Latest Version and Execution Flow

The trojan horse that wanted to fly

Threat actor targeting UK banks in ongoing AnyDesk social engineering campaign

SharpRhino – New Hunters International RAT

Strikes with commercial malware against organizations in Kazakhstan

Analysis of Attack Case Installing VPN on Korean ERP Server

RAT Distributed as UUEncoding (UUE) File

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware

Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four