Phishing - Cybersec Sentinel

Phishing

A collection of 25 posts

LOSTKEYS Malware Campaign Traced to Cold River Threat Group

LOSTKEYS Malware Campaign Traced to Cold River Threat Group

Threat Group: Cold River (linked to Russia’s Federal Security Service) Threat Type: Advanced Persistent Threat (APT) Malware Exploited Vulnerabilities: Not publicly disclosed Malware Used: LOSTKEYS Threat Score: 🔥 Critical (9.2/10) – Due to its advanced data exfiltration capabilities, targeting of high-profile entities, and association with a state-sponsored group Last

Golden Chickens Deploy TerraStealerV2 and TerraLogger in Credential Theft Surge

Golden Chickens Deploy TerraStealerV2 and TerraLogger in Credential Theft Surge

Threat Group: Golden Chickens (aka Venom Spider) Threat Type: Malware-as-a-Service (MaaS) Exploited Vulnerabilities: Social engineering via spear-phishing and LOLBins Malware Used: TerraStealerV2, TerraLogger, TerraLoader Threat Score: 🟠 Elevated (6.5/10) – Due to its credential-harvesting capabilities, stealth techniques, and deployment through widely used social engineering tactics. Last Threat Observation: May 3l

Cozy Bear Launches Wine-Tasting Phishing Campaign to Deploy WineLoader

Cozy Bear Launches Wine-Tasting Phishing Campaign to Deploy WineLoader

Threat Group: APT29 (Cozy Bear / Midnight Blizzard / NOBELIUM) Threat Type: Advanced Persistent Threat (APT) – Cyberespionage Exploited Vulnerabilities: None (social engineering and DLL side-loading) Malware Used: GrapeLoader (initial-stage loader), WineLoader (modular backdoor) Threat Score: 🔥 Critical (9.2/10) due to campaign sophistication, high-value diplomatic targeting, and stealth evasion techniques Last Threat

PE32 Ransomware Operators Leverage RDP and Phishing to Breach Enterprise Systems

PE32 Ransomware Operators Leverage RDP and Phishing to Breach Enterprise Systems

Threat Group: - Dmc Threat Type: - Ransomware Exploited Vulnerabilities: - None identified (Phishing and RDP compromise suspected) Malware Used: - PE32 Ransomware Threat Score: - 🔴 High (7.5/10) – Due to Telegram-based C2, data exfiltration, and rapid file encryption Last Threat Observation: - 23 April 2025 Overview PE32 ransomware

FatalRAT Phishing Attacks Targeting APAC Industrial Sectors

FatalRAT Phishing Attacks Targeting APAC Industrial Sectors

Threat Group: Unattributed Chinese-speaking Threat Actors Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: No specific software vulnerabilities exploited; relies on social engineering and phishing techniques Malware Used: FatalRAT Threat Score: High (8.5/10) – Due to its sophisticated multi-stage infection chain, targeting of critical industrial sectors, and advanced evasion

Astaroth Phishing Kit Exploits 2FA Weaknesses in Gmail and O365

Astaroth Phishing Kit Exploits 2FA Weaknesses in Gmail and O365

Threat Group: Unknown Threat Type: Phishing Kit Exploited Vulnerabilities: Session Hijacking, Reverse Proxy Techniques Malware Used: Astaroth Phishing Kit Threat Score: High (8.9/10) – Due to its sophisticated methods of bypassing two-factor authentication (2FA) and real-time credential interception, posing significant risks to user accounts. Last Threat Observation: February 26

Google Calendar Vulnerability Exposes Users to Phishing

Google Calendar Vulnerability Exposes Users to Phishing

Threat Group: - Unknown Threat Actors Threat Type: - Phishing/Malware Distribution Exploited Vulnerabilities: - Social engineering via calendar invitations Malware Used: - Various malware strains delivered through phishing links Threat Score: - Medium (7.2/10) – Exploits user trust in a widely used platform and bypasses traditional email security.

FERRET Malware Targets macOS in Sophisticated North Korean Attacks

FERRET Malware Targets macOS in Sophisticated North Korean Attacks

Threat Group: Lazarus Group (also known as Andariel, APT38, Hidden Cobra) Threat Type: Advanced Persistent Threat (APT) Exploited Vulnerabilities: Social engineering tactics, including spear-phishing and fake job lures Malware Used: FERRET Malware Family (including variants such as FlexibleFerret, InvisibleFerret, BeaverTail) Threat Score: High (8.5/10) – Due to its sophisticated

From Stealers to Ransomware PureCrypter Delivers It All

From Stealers to Ransomware PureCrypter Delivers It All

Threat Group: - Unknown (Distributed by cybercriminals through various malware-as-a-service campaigns) Threat Type: - Malware Loader Exploited Vulnerabilities: - Primarily relies on phishing emails with malicious attachments or links Malware Used: - PureCrypter Threat Score: - High (8.2/10) – Due to its ability to deliver multiple malware strains and

InvisibleFerret Malware Leveraging Python for Targeted Attacks

InvisibleFerret Malware Leveraging Python for Targeted Attacks

Threat Group: North Korean Threat Actors (e.g., Lazarus Group) Threat Type: Backdoor Malware Exploited Vulnerabilities: None (Relies on social engineering and malicious delivery) Malware Used: InvisibleFerret (Python-based backdoor), BeaverTail (JavaScript-based stealer and loader) Threat Score: High (8.8/10) – High impact due to complex multi-stage infection and data exfiltration