Tag: russian-speaking

4 Attack Reports | 0 Vulnerabilities

Attack reports

Exposing the Deception: Russian EFF Impersonators Behind Stealc & Pyramid C2

A threat group impersonating the Electronic Frontier Foundation (EFF) is targeting Albion Online players through phishing messages and decoy documents. The campaign uses malware such as Stealc stealer and Pyramid C2 to compromise player accounts. Analysis of an exposed directory revealed PowerShell…

russian-speaking

Published: March 4, 2025

Downloadable IOCs: 0

Gophish Framework Used in Phishing Campaigns to Deploy Remote Access Trojans

A new phishing campaign targeting Russian-speaking users employs the open-source Gophish framework to deliver DarkCrystal RAT and a novel remote access trojan called PowerRAT. The attack utilizes modular infection chains, either through malicious Microsoft Word documents or HTML files with embedded…

darkcrystal rat

russian-speaking

remote access trojan

Published: October 22, 2024

Downloadable IOCs: 2

Key Group uses leaked builders of ransomware and wipers

Key Group, also known as keygroup777, is a financially motivated ransomware group primarily targeting Russian users. The group has been active since 2022, using various leaked ransomware builders and wipers, including Xorist, Chaos, Annabelle, Slam, RuRansom, UX-Cryptor, Hakuna Matata, and Judge/No…

multi-stage loaders

leaked builders

russian-speaking

Published: October 2, 2024

Downloadable IOCs: 24

Key Group: another ransomware group using leaked builders

Key Group is a financially motivated ransomware group primarily targeting Russian users. They use various leaked ransomware builders including Chaos, Xorist, Annabelle, Slam, RuRansom, UX-Cryptor, Hakuna Matata, and Judge/NoCry. The group's activity has been tracked since April 2022, with their tac…

financially motivated

multi-stage loaders

leaked builders

russian-speaking

Published: October 1, 2024

Downloadable IOCs: 0

Click here to see more Attack Reports