Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool Malware Trend Micro’s Managed Extended Detection and Response (MxDR) team discovered that a file called x32dbg.exe was used to sideload a malicious DLL we identified as a variant of PlugX. By: Buddy Tancio, Abraham Camba, Catherine Loveria February 24, 2023 Read time:  ( words) Trend Micro’s Managed Extended Detection and Response (MxDR) team discovered that a file called x32dbg.exe was used (via the DLL…

Read More

In Review: What GPT-3 Taught ChatGPT in a Year

In Review: What GPT-3 Taught ChatGPT in a Year

ChatGPT spotted and called the error, recognizing not only the difference between the previous and latest uploaded code but also that the new code would not work altogether. The reason is in ChatGPT’s stateful session: By “remembering” the previously input correct snippet of code, the system is able to draw a direct comparison — something that GPT-3 was unable to do unless we provided the input ourselves. As further proof, we retried the experiment in…

Read More

Invitation to a Secret Event: Uncovering Earth Yako’s Campaigns

Invitation to a Secret Event: Uncovering Earth Yako’s Campaigns

Technical perspectives Based on the arsenals and TTPs, we believe Earth Yako may be related to a number of existing groups. However, since we could only observe partial technical overlaps between Earth Yako and the following groups, we note that this is not our final attribution. We found the overlaps similar with the following groups: 1.      Darkhotel Darkhotel (a.k.a. DUBNIUM) is a threat actor observed to frequently target Japanese organizations in the past. Earth Yako’s…

Read More

Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs

Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs

Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs Malware We discovered an active campaign targeting Eastern Europeans in the cryptocurrency industry using fake job lures. By: Aliakbar Zahravi, Peter Girnus February 09, 2023 Read time:  ( words) We recently found an active campaign that uses a fake employment pretext targeting Eastern Europeans in the cryptocurrency industry to install an information stealer. In this campaign, the suspected Russian threat actors, use several highly obfuscated and underdevelopment…

Read More

TgToxic Malware’s Automated Framework Targets Southeast Asia Android Users

TgToxic Malware’s Automated Framework Targets Southeast Asia Android Users

Conclusion Despite having different deployment periods, we found the social media phishing campaigns and network infrastructure targeting Taiwan, Indonesia, and Thailand similar. When the victim downloads the fake app from the website given by the threat actor, or if victim tries to send a direct message to the threat actor through messaging apps such as WhatsApp or Viber, the cybercriminal deceives the user into registering, installing the malware, and enabling the permissions it needs. Once…

Read More

New APT34 Malware Targets The Middle East

New APT34 Malware Targets The Middle East

APT34 Targeting and Arsenal Evolution APT34 has been documented to target organizations worldwide, particularly companies from the financial, government, energy, chemical, and telecommunications industries in the Middle East since at least 2014. Documented as a group primarily involved for cyberespionage, APT34 has been previously recorded targeting government offices and show no signs of stopping with their intrusions. Our continuous monitoring of the group proves it continues to create new and updated tools to minimize the detection…

Read More

Defense-in-depth protects against known and unknown cyber threats

Defense-in-depth protects against known and unknown cyber threats

Defense-in-depth protects against known and unknown cyber threats | Security Magazine This website requires certain cookies to work and uses other cookies to help you have the best experience. By visiting this website, certain cookies have already been set, which you may delete and block. By closing this message or continuing to use our site, you agree to the use of cookies. Visit our updated privacy and cookie policy to learn more. This Website…

Read More

Most wanted malware: Glupteba in top 10 and Qbot in 1st place

Most wanted malware: Glupteba in top 10 and Qbot in 1st place

Most Wanted Malware: Glupteba Entering Top Ten and Qbot in First Place | Security Magazine This website requires certain cookies to work and uses other cookies to help you have the best experience. By visiting this website, certain cookies have already been set, which you may delete and block. By closing this message or continuing to use our site, you agree to the use of cookies. Visit our updated privacy and cookie policy to learn…

Read More

Attacking The Supply Chain: Developer

Attacking The Supply Chain: Developer

In 2021, we published an entry identifying the weak parts of the supply chain security. In the face of the surge in documented attacks, the entry gave a summarized overview of how malicious actors found gaps to abuse and take advantage of for possible gains and disruptions. In this entry, we focus on one specific part of the supply chain: the developers themselves. To find a suitable attack model focusing on the developer, we must…

Read More

Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures

Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures

Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures Malware We discovered an active campaign ongoing since at least mid-2022 which uses Middle Eastern geopolitical-themed lures to distribute NjRAT (also known as Bladabindi) to infect victims across the Middle East and North Africa. By: Peter Girnus, Aliakbar Zahravi January 17, 2023 Read time:  ( words) While threat hunting, we found an active campaign using Middle Eastern geopolitical themes as a lure to target potential…

Read More
1 7 8 9 10 11 24