Malware - Cybersec Sentinel (Page 6)

Malware

A collection of 88 posts

OilRig APT Escalates Cyber Espionage with Windows Kernel Exploits and Persistent Attacks

OilRig APT Escalates Cyber Espionage with Windows Kernel Exploits and Persistent Attacks

Threat Group: OilRig (APT34, Earth Simnavaz, Crambus, Cobalt Gypsy, GreenBug, Helix Kitten, Hazel Sandstorm) Threat Type: Cyberespionage Exploited Vulnerabilities: CVE-2024-30088 (Windows Kernel Privilege Escalation), Microsoft Exchange Web Services Malware Used: Menorah, STEALHOOK, SC5k, OilCheck, ODAgent, OilBooster Threat Score: High (8.5/10) — Exploitation of advanced kernel vulnerabilities and widespread espionage

New Infostealer Malware Yunit Stealer Targets Credentials and Crypto

New Infostealer Malware Yunit Stealer Targets Credentials and Crypto

Threat Group: Freeboox Threat Type: Infostealer Malware Exploited Vulnerabilities: Browser data storage, registry manipulation, scheduled tasks, system utilities Malware Used: Yunit Stealer Threat Score: High (8.7/10) — Due to its advanced evasion techniques, ability to extract sensitive data, and its persistence in critical system areas Last Threat Observation: October

New Vilsa Stealer Malware Infiltrates Systems and Steals Sensitive Data

New Vilsa Stealer Malware Infiltrates Systems and Steals Sensitive Data

Threat Group: - Unknown Threat Type: - Information Stealer Exploited Vulnerabilities: - Virtual Machine Detection, Browser Data Extraction, Cryptocurrency Wallets Malware Used: - Vilsa Stealer, hvnc.py Threat Score: - High (8.5/10) — Due to its advanced encryption, persistence mechanisms, and broad targeting capabilities. Last Threat Observation: - October

KLogExe and FPSpy Signal a New Wave of Espionage by Sparkling Pisces Hackers

KLogExe and FPSpy Signal a New Wave of Espionage by Sparkling Pisces Hackers

Threat Group: Sparkling Pisces (aka Kimsuky, THALLIUM) Threat Type: Keylogger & Backdoor Malware Exploited Vulnerabilities: User exploitation via spear phishing, DLL hijacking Malware Used: KLogExe (keylogger), FPSpy (backdoor) Threat Score: High (8.0/10) — Due to the combination of data exfiltration and its ability to bypass static detection Last Threat

Perfctl Malware Hijacks Linux Servers for Cryptomining and Proxyjacking

Perfctl Malware Hijacks Linux Servers for Cryptomining and Proxyjacking

Threat Group: - Unknown Threat Type: - Cryptomining & Proxyjacking Malware Exploited Vulnerabilities: - Polkit (CVE-2021-4043), Apache RocketMQ (CVE-2023-33246) Malware Used: - Perfctl Threat Score: - High (8/10) Last Threat Observation: - October 3, 2024 Overview: Perfctl is a stealthy and persistent malware targeting Linux servers, leveraging misconfigurations and

RomCom Malware Variant SnipBot Targets IT and Legal Sectors

RomCom Malware Variant SnipBot Targets IT and Legal Sectors

Threat Group: RomCom Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Social engineering (phishing emails) and PDF exploits Malware Used: SnipBot (RomCom 5.0 variant) Threat Score: High (8.8/10) – due to its advanced command execution capabilities, obfuscation techniques, and wide target range across industries Last Threat Observation: September

Necro Trojan Malware Resurfaces in Google Play and Modded Apps

Necro Trojan Malware Resurfaces in Google Play and Modded Apps

Threat Group: Necro Trojan Operators Threat Type: Android Trojan Downloader Exploited Vulnerabilities: Supply chain attack via SDKs in Android apps Malware Used: Necro Trojan (Trojan-Downloader.AndroidOS.Necro variants) Threat Score: High (8.2/10) — Due to large-scale infiltration and the advanced use of steganography for payload concealment. Last Threat Observation:

PondRAT Malware Targets Linux and macOS Python Developers in New Attack

PondRAT Malware Targets Linux and macOS Python Developers in New Attack

Threat Group: Gleaming Pisces (also known as Citrine Sleet, Labyrinth Chollima, Nickel Academy, and UNC4736) Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Supply chain attacks through Python Package Index (PyPI) Malware Used: PondRAT (variant of POOLRAT) Threat Score: High (8.3/10) Last Threat Observation: September 22, 2024 Overview

SambaSpy RAT Aims at Italian Targets in a Focused Phishing Attack

SambaSpy RAT Aims at Italian Targets in a Focused Phishing Attack

Threat Group: Suspected Brazilian Portuguese-speaking actors Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: None publicly listed, targets Italian users via phishing Malware Used: SambaSpy (Java-based RAT, obfuscated with Zelix KlassMaster) Threat Score: High (7.5/10) – Focused and highly targeted campaign with the potential for broader exploitation Last Threat

Raptor Train Botnet Disrupted After Targeting Global Critical Infrastructure

Raptor Train Botnet Disrupted After Targeting Global Critical Infrastructure

Threat Details and Score Threat Group: Flax Typhoon (Chinese state-sponsored) Threat Type: Botnet (IoT) Exploited Vulnerabilities: IoT device vulnerabilities, including zero-day and n-day vulnerabilities in over 20 device types Malware Used: Nosedive (a variant of Mirai) Threat Score: High (8.9/10) — Due to its scale, complexity, and targeting of