Overview: Sharpil RAT, initially identified as a Remote Access Trojan (RAT), has been reclassified as a remote-controlled data stealer. It targets a wide range of data, notably from gaming platforms and applications. A new variant, referred to as Sharp Stealer, emerged in 2024, exhibiting similar malicious functionalities and focusing particularly

Overview SteganoAmor is a malicious malware campaign orchestrated by the TA558 hacking group, employing steganography to embed malicious code within images. This technique disguises the malware within benign-looking files to evade detection by users and security software. TA558, active since 2018, primarily targets the hospitality and tourism sectors, especially in

Executive Summary Recent discoveries and analysis have highlighted the resurgence and evolution of ScrubCrypt malware, a sophisticated cyberthreat aimed at Microsoft Windows platforms. This malware is associated with deploying the RedLine Stealer malware, broadening the attack vector to include credential theft, cryptocurrency wallet exfiltration, and facilitating account takeover and fraud.

Overview: The Latrodectus malware, a sophisticated and adaptable threat in the cyber landscape, has been actively distributed via email phishing campaigns since at least late November 2023. Emerging as a potential successor to the IcedID loader, it has shown significant capabilities in evasion and payload delivery. Distribution and Tactics: The

Overview The StrelaStealer malware has emerged as a significant cybersecurity threat, primarily through phishing campaigns targeting over 100 organizations across the European Union and the United States. The malware is designed to exfiltrate email login credentials from popular clients like Outlook and Thunderbird, sending the stolen data to an attacker-controlled

Overview: A new malware strain named WogRAT has been identified targeting both Windows and Linux systems. This malware exploits the online notepad service "aNotepad" as a covert channel for storing and retrieving malicious payloads. The primary function and distribution method of WogRAT, including its impact on infected systems,

Overview SSH-Snake is a sophisticated malware that targets SSH (Secure Shell) services. It is a self-propagating, self-replicating, file-less script designed for post-exploitation tasks such as SSH private key and host discovery. Its main goal is to automate the discovery and exploitation of SSH services by utilizing found private keys to

Overview Volt Typhoon, identified as a state-sponsored cyber threat group by various cybersecurity organizations, has been actively targeting U.S. critical infrastructure with a focus on espionage, information gathering, and potentially disruptive activities against critical communications infrastructure. This group, attributed to the People's Republic of China, has been

Executive Summary Mystic Stealer is an information-stealing malware first advertised in April 2023. It is designed to pilfer credentials from nearly 40 web browsers and more than 70 browser extensions, targeting also cryptocurrency wallets, Steam, and Telegram accounts. The malware exhibits advanced obfuscation techniques including polymorphic string obfuscation, hash-based import

Executive Summary Qbot, also known as QakBot, is a prevalent and evolving piece of malware initially identified as a banking trojan. Over time, it has expanded its capabilities to include information theft, delivery of additional malware payloads, and facilitation of ransomware attacks. Qbot is known for its persistence, sophisticated evasion