Tag: tag-124

3 Attack Reports | 0 Vulnerabilities

Attack reports

New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

Insikt Group uncovered new infrastructure linked to GrayAlpha, a threat actor associated with FIN7. They identified a custom PowerShell loader named PowerNet that deploys NetSupport RAT, and another loader called MaskBat. Three main infection vectors were discovered: fake browser updates, fake 7-Zi…
netsupport rat
infrastructure
tag-124
7-zip
fin7
fake updates
2025-06-13
powernet
maskbat
Published: June 13, 2025
Downloadable IOCs: 0

MintsLoader Malware Analysis: Multi-Stage Loader Used in Cyber Attacks

MintsLoader, a malicious loader first observed in 2024, is employed in phishing and drive-by download campaigns to deploy payloads like GhostWeaver, StealC, and modified BOINC clients. It uses obfuscated JavaScript and PowerShell scripts in a multi-stage infection chain, featuring sandbox evasion t…
phishing
socgholish
asyncrat
stealc
drive-by download
boinc
mintsloader
tag-124
ghostweaver
2025-04-29
multi-stage loader
Published: April 29, 2025
Downloadable IOCs: 0

TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base

Insikt Group has identified a complex infrastructure linked to the traffic distribution system TAG-124, which overlaps with several threat activity clusters and includes compromised WordPress sites and various servers. Multiple threat actors, including operators of Rhysida and Interlock ransomware,…
remcos
cleanuploader
mintsloader
2025-01-31
tag-124
ta582
Published: January 31, 2025
Downloadable IOCs: 102
Click here to see more Attack Reports