A cyber operation against a Philippine military contractor has exposed a newly discovered and highly sophisticated malicious infrastructure, codenamed EggStreme. Research conducted by Bitdefender attributes the campaign to a Chinese threat group engaged in...
Researchers at Kroll have reported a new espionage campaign deploying the GONEPOSTAL malware. This tool was uncovered in operations attributed to the group KTA007, also known as Fancy Bear, APT28, and Pawn Storm. Its...
ThreatFabric analysts have reported the emergence of a new and highly sophisticated banking trojan named RatOn, which fuses the capabilities of a traditional Android malware strain with advanced remote-access features and targeted attacks on...
Researchers at FortiGuard Labs have documented a new campaign deploying the MostereRAT remote access trojan, which targets Windows systems and leverages legitimate tools such as AnyDesk and TightVNC to maintain covert access. The attack...
Researchers at Arctic Wolf have reported a new campaign, dubbed GPUGate, in which adversaries exploit Google Ads and fraudulent GitHub commits to distribute malware targeting IT firms and developers across Western Europe. Active since...
In mid-August, researchers encountered a new ransomware strain, Cephalus, in two separate incidents. Following the recent emergence of families such as Crux and KawaLocker, attention was quickly drawn to a ransom note that began...
In recent months, specialists at Acronis TRU have observed a surge in attacks where adversaries deploy counterfeit installers of ConnectWise ScreenConnect to gain initial access into the networks of American companies. This strategy reflects...
Experts at eSentire have reported the discovery of a new botnet known as NightshadeC2, which employs unconventional techniques to evade defenses and sandbox environments. The malware is distributed through counterfeit versions of legitimate programs—such...
The threat group TAG-150, which researchers associate with the development of the CastleLoader malware, has expanded its arsenal with a new remote access trojan (RAT) known as CastleRAT. The discovery was reported by Recorded...
Low-profile droppers, long considered auxiliary tools in the arsenals of Android banking trojans and RATs, are undergoing a rapid and troubling transformation. According to ThreatFabric researchers, these once secondary instruments are now being actively...
Researchers at Socket have uncovered a malicious npm package named nodejs-smtp, masquerading as the widely used nodemailer library (which averages 3.9 million weekly downloads). In reality, the package serves as a tool for covert...
Experts at Truesec have reported a large-scale malicious campaign in which attackers promoted a fake PDF-editing application, AppSuite PDF Editor, through Google Ads. Beneath its veneer of legitimacy lurked the TamperedChef infostealer, capable of...
