Search cyberveille.decio.ch

BRATA is evolving into an Advanced Persistent Threat

Here we go with another episode about our (not so) old friend, BRATA. In almost one year, threat actors (TAs) have further improved the capabilities of this malware. In our previous blog post [1] we defined three main BRATA variants, which appeared during two different waves detected by our telemetries at the very end of 2021. However, during the last months we have observed a change in the attack pattern commonly used.

#cleafy #2022 #EN #malware #BRATA #APT #phishing #analysis #IOCs #banker

·cleafy.com·Jun 20, 2022

BRATA is evolving into an Advanced Persistent Threat

A closer look at Eternity Malware

In this analysis, Cyble looks at the Eternity Malware suite, listing a wide variety of malware for sale on Telegram.

#Cyble #2022 #EN #Eternity #Malware #Telegram #analysis

·blog.cyble.com·May 16, 2022

A closer look at Eternity Malware

BRATA is evolving into an Advanced Persistent Threat

Here we go with another episode about our (not so) old friend, BRATA. In almost one year, threat actors (TAs) have further improved the capabilities of this malware. In our previous blog post [1] we defined three main BRATA variants, which appeared during two different waves detected by our telemetries at the very end of 2021. However, during the last months we have observed a change in the attack pattern commonly used.

#cleafy #2022 #EN #malware #BRATA #APT #phishing #analysis #IOCs #banker

·cleafy.com·Jun 20, 2022

BRATA is evolving into an Advanced Persistent Threat

A closer look at Eternity Malware

In this analysis, Cyble looks at the Eternity Malware suite, listing a wide variety of malware for sale on Telegram.

#Cyble #2022 #EN #Eternity #Malware #Telegram #analysis

·blog.cyble.com·May 16, 2022

A closer look at Eternity Malware

BRATA is evolving into an Advanced Persistent Threat

Here we go with another episode about our (not so) old friend, BRATA. In almost one year, threat actors (TAs) have further improved the capabilities of this malware. In our previous blog post [1] we defined three main BRATA variants, which appeared during two different waves detected by our telemetries at the very end of 2021. However, during the last months we have observed a change in the attack pattern commonly used.

#cleafy #2022 #EN #malware #BRATA #APT #phishing #analysis #IOCs #banker

·cleafy.com·Jun 20, 2022

BRATA is evolving into an Advanced Persistent Threat

A closer look at Eternity Malware

In this analysis, Cyble looks at the Eternity Malware suite, listing a wide variety of malware for sale on Telegram.

#Cyble #2022 #EN #Eternity #Malware #Telegram #analysis

·blog.cyble.com·May 16, 2022

A closer look at Eternity Malware

BRATA is evolving into an Advanced Persistent Threat

Here we go with another episode about our (not so) old friend, BRATA. In almost one year, threat actors (TAs) have further improved the capabilities of this malware. In our previous blog post [1] we defined three main BRATA variants, which appeared during two different waves detected by our telemetries at the very end of 2021. However, during the last months we have observed a change in the attack pattern commonly used.

#cleafy #2022 #EN #malware #BRATA #APT #phishing #analysis #IOCs #banker

·cleafy.com·Jun 20, 2022

BRATA is evolving into an Advanced Persistent Threat

A closer look at Eternity Malware

In this analysis, Cyble looks at the Eternity Malware suite, listing a wide variety of malware for sale on Telegram.

#Cyble #2022 #EN #Eternity #Malware #Telegram #analysis

·blog.cyble.com·May 16, 2022

A closer look at Eternity Malware

BRATA is evolving into an Advanced Persistent Threat

Here we go with another episode about our (not so) old friend, BRATA. In almost one year, threat actors (TAs) have further improved the capabilities of this malware. In our previous blog post [1] we defined three main BRATA variants, which appeared during two different waves detected by our telemetries at the very end of 2021. However, during the last months we have observed a change in the attack pattern commonly used.

#cleafy #2022 #EN #malware #BRATA #APT #phishing #analysis #IOCs #banker

·cleafy.com·Jun 20, 2022

BRATA is evolving into an Advanced Persistent Threat

A closer look at Eternity Malware

In this analysis, Cyble looks at the Eternity Malware suite, listing a wide variety of malware for sale on Telegram.

#Cyble #2022 #EN #Eternity #Malware #Telegram #analysis

·blog.cyble.com·May 16, 2022

A closer look at Eternity Malware

BRATA is evolving into an Advanced Persistent Threat

Here we go with another episode about our (not so) old friend, BRATA. In almost one year, threat actors (TAs) have further improved the capabilities of this malware. In our previous blog post [1] we defined three main BRATA variants, which appeared during two different waves detected by our telemetries at the very end of 2021. However, during the last months we have observed a change in the attack pattern commonly used.

#cleafy #2022 #EN #malware #BRATA #APT #phishing #analysis #IOCs #banker

·cleafy.com·Jun 20, 2022

BRATA is evolving into an Advanced Persistent Threat

A closer look at Eternity Malware

In this analysis, Cyble looks at the Eternity Malware suite, listing a wide variety of malware for sale on Telegram.

#Cyble #2022 #EN #Eternity #Malware #Telegram #analysis

·blog.cyble.com·May 16, 2022

A closer look at Eternity Malware

BRATA is evolving into an Advanced Persistent Threat

Here we go with another episode about our (not so) old friend, BRATA. In almost one year, threat actors (TAs) have further improved the capabilities of this malware. In our previous blog post [1] we defined three main BRATA variants, which appeared during two different waves detected by our telemetries at the very end of 2021. However, during the last months we have observed a change in the attack pattern commonly used.

#cleafy #2022 #EN #malware #BRATA #APT #phishing #analysis #IOCs #banker

·cleafy.com·Jun 20, 2022

BRATA is evolving into an Advanced Persistent Threat

A closer look at Eternity Malware

In this analysis, Cyble looks at the Eternity Malware suite, listing a wide variety of malware for sale on Telegram.

#Cyble #2022 #EN #Eternity #Malware #Telegram #analysis

·blog.cyble.com·May 16, 2022

A closer look at Eternity Malware

The Mac Malware of 2022 👾

A comprehensive analysis of the year's new malware

#objective-see #2022 #EN #malware #macos #analysis

·objective-see.org·Jan 2, 2023

The Mac Malware of 2022 👾

New YouTube Bot Malware Spotted Stealing User’s Sensitive Information

#Cyble #EN #2022 #Malware #Bot #YouTube #stealer #analysis

·blog.cyble.com·Dec 30, 2022

New YouTube Bot Malware Spotted Stealing User’s Sensitive Information

Pure coder offers multiple malware for sale in Darkweb forums

Italians Users Targeted By PureLogs Stealer Through Spam Campaigns

#Cyble #EN #2022 #Pure #malware #Darkweb #PureLogs #analysis

·blog.cyble.com·Dec 30, 2022

Pure coder offers multiple malware for sale in Darkweb forums

New RisePro Stealer distributed by the prominent PrivateLoader

PrivateLoader is an active malware in the loader market, used by multiple threat actors to deliver various payloads, mainly information stealer. Since our previous investigation, we keep tracking the malware to map its ecosystem and delivered payloads. Starting from this tria.ge submission, we recognized a now familiar first payload, namely PrivateLoader. However, the dropped stealer was not part of our stealer growing collection, notably including RedLine or Raccoon. Eventually SEKOIA.IO realised it was a new undocumented stealer, known as RisePro. This article aims at presenting SEKOIA.IO RisePro information stealer analysis.

#sekoia #EN #2022 #PrivateLoader #malware #stealer #RisePro #analysis

·blog.sekoia.io·Dec 28, 2022

New RisePro Stealer distributed by the prominent PrivateLoader

L’art de l’évasion How Shlayer hides its configuration inside Apple proprietary DMG files

While conducting routine threat hunting for macOS malware on Ad networks, I stumbled upon an unusual Shlayer sample. Upon further analysis, it became clear that this variant was different from the known Shlayer variants such as OSX/Shlayer.D, OSX/Shlayer.E, or ZShlayer. We have dubbed it OSX/Shlayer.F.

#objective-see #2022 #EN #Shlayer #macos #malware #IoCs #analysis

·objective-see.org·Dec 28, 2022

L’art de l’évasion How Shlayer hides its configuration inside Apple proprietary DMG files

Raspberry Robin Malware Targets Telecom, Governments

We found samples of the Raspberry Robin malware spreading in telecommunications and government office systems beginning September. The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools.

#trendmicro #EN #2022 #malware #apt #endpoints #RaspberryRobin #obfuscation #analysis

·trendmicro.com·Dec 26, 2022

Raspberry Robin Malware Targets Telecom, Governments

GoTrim: Go-based Botnet Actively Brute Forces WordPress Websites

FortiGuard Labs encountered an unreported CMS scanner and brute forcer written in the Go programming language. Read our analysis of the malware and how this active botnet scans and compromises websites.

#fortinet #EN #2022 #analysis #malware #scanner #Wordpress #go #brute-force-attack #FortiGuards-Labs #Threat-Research #botnet

·fortinet.com·Dec 19, 2022

GoTrim: Go-based Botnet Actively Brute Forces WordPress Websites

Aurora: a rising stealer flying under the radar

Since September 2022, Aurora malware is advertised as an infostealer and several traffers teams announced they added it to their malware toolset.

#sekoia #2022 #EN #infostealer #malware #technical #analysis #IoCs #Malware-as-a-Service

·blog.sekoia.io·Nov 21, 2022

Aurora: a rising stealer flying under the radar

Massive ois[.]is Black Hat Redirect Malware Campaign

Learn how attackers are redirecting WordPress website visitors to fake Q&A sites via ois[.]is. Nearly 15,000 websites affected by this malware so far.

#sucuri #EN #2022 #campaign #WordPress #malware #Malicious #SEO #Analysis #ois.is

·blog.sucuri.net·Nov 12, 2022

Massive ois[.]is Black Hat Redirect Malware Campaign

The Case of Cloud9 Chrome Botnet

The Zimperium zLabs team recently discovered a malicious browser extension, originally called Cloud9, which not only steals the information available during the browser session but can also install malware on a user's device and subsequently assume control of the entire device. In this blog, we will take a deeper look into this malicious browser extension.

#zimperium #EN #2022 #browser #extension #Cloud9 #malicious #stealer #malware #Analysis

·zimperium.com·Nov 8, 2022

The Case of Cloud9 Chrome Botnet

Cyble Phishing ERMAC Android Malware Increasingly Active

CRIL Investigates the resurgence of ERMAC Android Malware as an increasing number of users are falling prey to their phishing attacks.

#cyble #EN #2022 #ERMAC #Android #Malware #phishing #Analysis

·blog.cyble.com·Oct 18, 2022

Cyble Phishing ERMAC Android Malware Increasingly Active

MAR-10365227-3.v1 China Chopper Webshells

CISA analyzed 15 files associated with China Chopper malware. The files are modified Offline Address Book (OAB) Virtual Directory (VD) configuration files for Microsoft Exchange servers. The files have been modified with a variant of the China Chopper webshell. The webshells allow an attacker to remotely access the server and execute arbitrary code on the system(s).referenced in this bulletin or otherwise.

#uscert #csirt #cert #en #2022 #CISA #China #Chopper #malware #Analysis

·cisa.gov·Oct 5, 2022

MAR-10365227-3.v1 China Chopper Webshells

MAR-10365227-2.v1 HyperBro

CISA analyzed 4 files associated with HyperBro malware. The files creates a backdoor program that is capable of uploading and downloading files to and from the system. The RAT is also capable of logging keystrokes and executing commands on the system.

#uscert #csirt #cert #CISA #HyperBro #malware #Analysis #RAT #EN #2022

·cisa.gov·Oct 5, 2022

MAR-10365227-2.v1 HyperBro

Bumblebee: increasing its capacity and evolving its TTPs

The spring of 2022 saw a spike in activity of Bumblebee loader, a recent threat that has garnered a lot of attention due to its many links to several well-known malware families.

#checkpoint #EN #2022 #Bumblebee #loader #malware #Analysis

·research.checkpoint.com·Oct 4, 2022

Bumblebee: increasing its capacity and evolving its TTPs

MAR-10400779-1.v1 – Zimbra 1

CISA received seven files for analysis. Six Java Server Pages (JSP) webshells and a Bourne Again SHell (bash) file. Five JSP webshell files are designed to parse inbound requests for commands for execution, download files, and upload files. One JSP webshell file contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in a JSP page. The bash file is designed to perform ldapsearch queries and store the output into a newly created directory.

#uscert #csirt #cert #EN #2022 #Malware #Analysis #Report #AR22-270A #Zimbra

·cisa.gov·Sep 28, 2022

MAR-10400779-1.v1 – Zimbra 1

The Evolution of the Chromeloader Malware - VMware Security Blog - VMware

The VMware Carbon Black MDR team goes in depth on the latest variants of the Chromeloader malware and how to detect them.

#vmware #EN #2022 #Chromeloader #malware #IoCs #Analysis

·blogs.vmware.com·Sep 21, 2022

The Evolution of the Chromeloader Malware - VMware Security Blog - VMware