SecuriTricks - spear-phishing

Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper

Anubis is a new ransomware-as-a-service (RaaS) group that combines file encryption with file destruction capabilities. Active since December 2024, it features a 'wipe mode' that permanently erases files, making recovery impossible even if ransom is paid. The group operates a flexible affiliate prog…

privilege-escalation

ransomware-as-a-service

Published: June 13, 2025

Downloadable IOCs: 0

APT 41: Threat Intelligence Report and Malware Analysis

APT41, a sophisticated Chinese state-sponsored threat actor, blends cyber espionage with cybercrime tactics. They target various sectors globally, including healthcare, telecom, and government entities. Recently, APT41 was observed using Google Calendar for malware command-and-control on a Taiwanes…

Published: June 10, 2025

Downloadable IOCs: 10

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story)

APT37, a North Korean state-sponsored hacking group, launched a spear phishing campaign targeting activists focused on North Korea. The attack involved emails with Dropbox links to malicious LNK files, which when executed, activated additional malware. The group utilized legitimate cloud services a…

Published: June 6, 2025

Downloadable IOCs: 1

Operation Sindoor – Anatomy of a Digital Siege

Operation Sindoor, a coordinated cyber campaign targeting critical Indian sectors, involved state-sponsored APT activity and hacktivist operations. The campaign utilized spear phishing, malicious scripts, website defacements, and data leaks. APT36, a Pakistan-aligned threat group, deployed advanced…

Published: June 4, 2025

Downloadable IOCs: 0

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

Void Blizzard, a newly identified Russia-affiliated threat actor, has been conducting global cyberespionage operations since April 2024. Their primary targets are organizations in critical sectors, particularly in NATO member states and Ukraine, including government, defense, transportation, media,…

Published: May 27, 2025

Downloadable IOCs: 3

XELERA Ransomware Campaign: Fake Food Corporation of India Job Offers Targeting Tech Aspirants

A newly discovered ransomware campaign is targeting tech job aspirants in India using fake Food Corporation of India job offers. The XELERA ransomware, written in Python and packed with PyInstaller, is distributed through spear-phishing emails containing malicious Word documents. The infection chai…

Published: February 12, 2025

Downloadable IOCs: 4

Analysis of malicious HWP cases of 'APT37' group distributed through K messenger

The report details a sophisticated APT attack targeting South Korea, utilizing spear-phishing techniques and malicious HWP files distributed through a popular Korean messenger service. The APT37 group exploited trust-based tactics, using compromised accounts to spread malware through group chats. T…

Published: February 5, 2025

Downloadable IOCs: 0

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

A zero-day vulnerability in 7-Zip (CVE-2025-0411) was exploited by Russian cybercrime groups to target Ukrainian organizations. The vulnerability allows bypassing Windows Mark-of-the-Web protections through double archiving, enabling execution of malicious content. The campaign involved spear-phish…

mark-of-the-web bypass

Published: February 4, 2025

Downloadable IOCs: 0

Tag: spear-phishing

Attack reports

Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper

APT 41: Threat Intelligence Report and Malware Analysis

Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story)

Operation Sindoor – Anatomy of a Digital Siege

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

Operation Sindoor: Anatomy of a High-Stakes Cyber Siege

April 2025 Threat Trend Report on APT Attacks (South Korea)

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan

Uyghur Diaspora Group Targeted with Remote Surveillance Malware

New Stealer on the Horizon

March 2025 APT Group Trends (South Korea)

SVC New Stealer on the Horizon

SideWinder targets the maritime and nuclear sectors with an updated toolset

Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

XELERA Ransomware Campaign: Fake Food Corporation of India Job Offers Targeting Tech Aspirants

Analysis of malicious HWP cases of 'APT37' group distributed through K messenger

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks