SecuriTricks - steganography

Brazilian Caminho Loader Employs LSB Steganography and Fileless Execution to Deliver Multiple Malware Families Across South America, Africa, and Eastern Europe

A new malware loader called Caminho, originating from Brazil, has been identified using steganography to hide .NET payloads in image files hosted on legitimate platforms. Active since March 2025, the campaign has evolved significantly, delivering various malware types across South America, Africa, …

xworm

steganography

Published: October 22, 2025

Downloadable IOCs: 0

XWorm RAT Delivered via Shellcode: Multi-Stage Attack Analysis

This analysis details a sophisticated multi-stage attack delivering the XWorm RAT. The campaign begins with a phishing email containing a malicious .xlam file. The file harbors embedded shellcode that, when executed, retrieves a secondary payload. This payload is a .NET binary that reflectively loa…

reflective dll injection

2025-09-29

Published: September 29, 2025

Downloadable IOCs: 8

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

A sophisticated FileFix attack campaign has been discovered, marking the first use of this technique beyond proof-of-concept. The attack employs a complex phishing infrastructure, including a multilingual site mimicking Facebook security. It uses steganography to conceal malicious code in images, w…

Published: September 16, 2025

Downloadable IOCs: 17

Gh0st RAT-based GodRAT attacks financial organizations

A newly identified Remote Access Trojan named GodRAT, based on the Gh0st RAT codebase, has been targeting financial firms since September 2024. The attackers distribute malicious .scr files via Skype, using steganography to embed shellcode in images. GodRAT supports plugins and is used alongside br…

ms edge password stealer

godrat

chrome password stealer

Published: August 19, 2025

Downloadable IOCs: 0

AI brings back real trojan horse malware

Trojan horses, once rare, are making a resurgence due to AI and Large Language Models (LLMs). These new trojans, disguised as legitimate applications like recipe apps or AI-powered image search tools, are evading traditional security measures. They appear professional, pass VirusTotal scans, and ex…

Published: August 13, 2025

Downloadable IOCs: 0

RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies

A new variant of RoKRAT malware used by APT37 has been identified, employing a two-stage encrypted shellcode injection method and steganography to conceal malicious code in image files. The malware uses shortcut files with embedded commands to execute its attack, distributed via compressed archives…

Published: August 7, 2025

Downloadable IOCs: 0

Likely Belarus-Nexus Threat Actor Delivers Downloader to Poland

A malicious CHM file targeting Poland was discovered, containing an infection chain that drops and executes a C++ downloader. The CHM file displays a decoy image while executing obfuscated JavaScript to extract and run a DLL. The downloader retrieves a payload from a domain associated with previous…

Published: July 14, 2025

Downloadable IOCs: 9

DCRAT Impersonating the Colombian Government

A new email attack distributing DCRAT, a Remote Access Trojan, has been uncovered. The threat actor impersonates a Colombian government entity to target organizations in Colombia. The attack employs multiple evasion techniques, including password-protected archives, obfuscation, steganography, base…

credential harvesting

remote access trojan

colombia

2025-07-02

Published: July 2, 2025

Downloadable IOCs: 8

More Steganography!

A malicious Excel file using steganography was analyzed, revealing embedded XLS sheets and a complex infection chain. The file downloads an HTA file that creates a BAT file, which in turn generates and executes a VBS file. The VBS file fetches a VBA script that creates and runs a PowerShell script.…

Published: June 14, 2025

Downloadable IOCs: 0

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

This article discusses a new obfuscation technique used by threat actors to conceal malware within bitmap resources embedded in seemingly benign 32-bit .NET applications. The malware employs a multi-stage process to extract, deobfuscate, load, and execute secondary payloads, ultimately leading to t…

Published: May 9, 2025

Downloadable IOCs: 0

Steganography Analysis With pngdump.py

This article discusses the analysis of a PNG file containing hidden malicious content using the pngdump.py tool. The image, 31744 pixels wide and 1 pixel high, was found to have a PE file embedded in its pixel data. The author demonstrates how to extract the hidden file using various Python tools a…

Published: April 26, 2025

Downloadable IOCs: 0

Operation Sea Elephant: The Dying Walrus Wandering the Indian Ocean

The CNC group, with South Asian origins, has been targeting domestic teachers, students, and research institutions. Their operation, named 'sea elephant', aims to spy on scientific research achievements in the ocean field. The group employs various tactics, including spear-phishing emails, IM softw…

sogou_pinyinupdater.exe

konlinesetupupdate_xa.exe

ocean research

windowassistance.exe

huaweihisuiteservice64.exe

Published: April 10, 2025

Downloadable IOCs: 0

New Steganographic Campaign Distributing Multiple Malware Variants

A sophisticated steganographic campaign has been observed distributing multiple stealer malware variants, including Remcos, DcRAT, AgentTesla, and VIPKeyLogger. The infection chain begins with a phishing email containing an Excel file that exploits CVE-2017-0199. This leads to the download of an HT…

Published: March 17, 2025

Linked vulnerabilities : CVE-2017-0199

Downloadable IOCs: 13

Formbook Phishing Campaign with old Payloads

A recent phishing campaign has been observed delivering Formbook stealers through email attachments. The malware uses multiple stages and steganography to hide malicious files inside images. The infection chain involves three stages before the final payload: Purchase Order.exe, Arthur.dll, and Mont…

Published: January 7, 2025

Downloadable IOCs: 1

The Mobile Malware Chronicles: Necro.N - Volume 101

Zimperium's zLabs researchers have been tracking Necro.N, a highly intrusive mobile malware campaign, since July. This malware, potentially succeeding Joker, uses obfuscation and steganography to hide malicious payloads within images. It downloads payloads from C2 servers, enabling remote code exec…

Published: October 21, 2024

Downloadable IOCs: 6

The Dark Knight Returns: Joker malware analysis

The report details sophisticated command and control (C2) techniques employed by the APT41 threat group. APT41 uses custom malware and legitimate tools to maintain persistent access to compromised networks while evading detection. Key techniques include DNS tunneling, domain fronting, and steganogr…

Published: October 3, 2024

Downloadable IOCs: 8

Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders

A long-term intrusion targeting a Vietnamese human rights non-profit organization has been discovered, likely spanning at least four years. The attack shows significant overlaps with techniques used by APT32/OceanLotus, a threat actor known for targeting Vietnamese activists. The intrusion involved…

Published: September 3, 2024

Downloadable IOCs: 46

Secret Message: Steganography Tricks of TA558 Group in Cyber Attacks on Enterprises in Russia and Belarus

F.A.C.C.T.'s Threat Intelligence analysts have investigated numerous cyberattacks by the TA558 group targeting enterprises, government institutions, and banks in Russia and Belarus. The attacks aimed to steal data and gain access to the organization's internal systems. TA558 used multi-stage phishi…

Published: July 30, 2024

Linked vulnerabilities : CVE-2017-11882

Downloadable IOCs: 74

To the Moon and back(doors): Lunar landing in diplomatic missions

ESET researchers discovered two previously unknown backdoors – LunarWeb and LunarMail – compromising a European ministry of foreign affairs and its diplomatic missions abroad. LunarWeb, deployed on servers, utilizes HTTP(S) for command and control communications, mimicking legitimate requests to av…

Published: May 16, 2024

Downloadable IOCs: 12

RemcosRAT Distributed Using Steganography

Security researchers have discovered a campaign distributing RemcosRAT through a sophisticated infection chain involving steganography techniques. The attack starts with a malicious Word document exploiting template injection, leading to the download of an RTF file that leverages an equation editor…

Published: May 8, 2024

Downloadable IOCs: 4

Tag: steganography

Attack reports

Operation Artemis: Analysis of HWP-Based DLL Side Loading Attacks

Operation MoneyMount, ISO Deploying Phantom Stealer

ClickFix Gets Creative: Malware Buried in Images

Sophisticated Tuoni C2 Attack on U.S. Real Estate Firm Thwarted

Brazilian Caminho Loader Employs LSB Steganography and Fileless Execution to Deliver Multiple Malware Families Across South America, Africa, and Eastern Europe

XWorm RAT Delivered via Shellcode: Multi-Stage Attack Analysis

FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography

Gh0st RAT-based GodRAT attacks financial organizations

AI brings back real trojan horse malware

RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies

Likely Belarus-Nexus Threat Actor Delivers Downloader to Poland

DCRAT Impersonating the Colombian Government

More Steganography!

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

Steganography Analysis With pngdump.py

Operation Sea Elephant: The Dying Walrus Wandering the Indian Ocean

New Steganographic Campaign Distributing Multiple Malware Variants

Formbook Phishing Campaign with old Payloads

The Mobile Malware Chronicles: Necro.N - Volume 101

The Dark Knight Returns: Joker malware analysis

Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders

Secret Message: Steganography Tricks of TA558 Group in Cyber Attacks on Enterprises in Russia and Belarus

To the Moon and back(doors): Lunar landing in diplomatic missions

RemcosRAT Distributed Using Steganography