Tag: remote access tool

6 Attack Reports | 0 Vulnerabilities

Attack reports

DPRK's Playbook: HttpTroy and New BLINDINGCAN Variant

Recent investigations have uncovered two new toolsets from North Korean threat actors. Kimsuky deployed a new backdoor called HttpTroy, targeting a victim in South Korea through a VPN invoice-themed attack. The attack chain involves a dropper, a loader called MemLoad, and the HttpTroy backdoor, whi…

remote access tool

Published: November 3, 2025

Downloadable IOCs: 15

Think before you Click(Fix): Analyzing the ClickFix social engineering technique

The ClickFix social engineering technique has gained popularity among threat actors, targeting thousands of devices globally. It tricks users into executing malicious commands on their devices by exploiting their tendency to solve minor technical issues. The technique often impersonates legitimate …

social engineering

remote access tool

atomic macos stealer (amos)

windows run dialog

Published: August 21, 2025

Downloadable IOCs: 10

Be Careful With Fake Zoom Client Downloads

A deceptive email containing a fake Zoom meeting invitation has been identified. Clicking the 'join' button leads to a website prompting users to install a purported Zoom client update. The downloaded executable, 'Session.ClientSetup.exe', is actually malware that installs an MSI package. This pack…

remote access tool

Published: June 5, 2025

Downloadable IOCs: 2

Fake Social Security Statement emails trick users into installing remote tool

A phishing campaign is targeting users with fake emails purportedly from the US Social Security Administration. These emails aim to trick recipients into installing ScreenConnect, a legitimate remote access tool that can be misused by cybercriminals. The campaign, attributed to a group called Molat…

social engineering

financial fraud

remote access tool

social security administration

Published: May 1, 2025

Downloadable IOCs: 0

Thunderstruck! Malicious ads for RVTools lead to ThunderShell payload

A security incident involving malicious sponsored ads distributing backdoored administrative tools was detected. Users searching for RVTools were served a tampered version containing ThunderShell, a PowerShell-based remote access tool. The malicious ads, appearing in Google search results, led to a…

remote access tool

trojanized software

Published: April 3, 2025

Downloadable IOCs: 0

Agent Tesla Indicators of Compromise (IOC) Feed

Agent Tesla is a sophisticated malware functioning primarily as a keylogger, capable of capturing sensitive data like usernames and passwords from infected computers. It can also take screenshots, extract credentials from various software, and act as a remote access tool. The malware's versatility …

remote access tool

Published: September 18, 2024

Downloadable IOCs: 9

Click here to see more Attack Reports