Follow on X RSS Feed

Phishing

A collection of 31 posts
Microsoft 365 Exchange Online Direct Send exploited for internal phishing campaigns
Phishing

Microsoft 365 Exchange Online Direct Send exploited for internal phishing campaigns

Threat Group: Opportunistic and financially motivated actors targeting multiple sectors Threat Type: Phishing and email infrastructure abuse Exploited Vulnerabilities: Abuse of Microsoft 365 Exchange Online Direct Send feature; implicit trust of unauthenticated internal-looking emails; weak or unenforced SPF, DKIM, and DMARC Malware Used: None required for initial access; follow-on payloads
4 min read
Charon ransomware adopts APT style tactics to target Middle East public sector and aviation
Ransomware

Charon ransomware adopts APT style tactics to target Middle East public sector and aviation

Threat Group: Suspected China linked Earth Baxia affiliate or imitator Threat Type: Ransomware Exploited Vulnerabilities: None confirmed. Suspected spear phishing and DLL sideloading Malware Used: Ransom.Win64.CHARON.THGBCBE Threat Score: 🔴 High (7.5/10) – Advanced persistent threat style capabilities, targeted operations, destructive behaviours, and potential state alignment Last Threat
3 min read
Scattered Spider Shifts to Aviation, Retail, and Transport in Latest Campaigns
Malware

Scattered Spider Shifts to Aviation, Retail, and Transport in Latest Campaigns

Threat Group: Scattered Spider Threat Type: Cybercrime Group (Focused on Cloud Environments, Ransomware) Exploited Vulnerabilities: Azure Cross-Tenant Synchronization, Federated Identity Providers, Cloud Platforms Malware Used: AlphV ransomware, Spectre RAT Threat Score: 🔴 High (8.8/10) – Due to its sophisticated exploitation of cloud-based systems, privilege escalation methods, and use of advanced
3 min read
DRAT V2 TAG-140 Bypasses Perimeter Defenses Using Social Engineering and mshta Execution
Malware

DRAT V2 TAG-140 Bypasses Perimeter Defenses Using Social Engineering and mshta Execution

Threat Group: TAG-140 / SideCopy / Transparent Tribe (APT36) Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: None directly; leverages social engineering and user execution vectors Malware Used: DRAT V2 (Delphi-compiled) with BroaderAspect.NET Loader Threat Score: 🟠 Elevated (6.5/10) – Due to its attribution to a state-aligned APT group, arbitrary shell
2 min read
FIN6 Skeleton Spider Escalates Enterprise Threats with More_eggs Campaigns
Malware

FIN6 Skeleton Spider Escalates Enterprise Threats with More_eggs Campaigns

Threat Group: Skeleton Spider (aka FIN6, Gold Franklin, ITG08, TAAL, Camouflage Tempest, ATK88, MageCart Group 6, TA4557, White Giant) Threat Type: Cybercrime Syndicate Exploited Vulnerabilities: Credential theft, social engineering, cloud abuse (AWS, GoDaddy), PoS exploitation (historical) Malware Used: More_eggs (MaaS by Golden Chickens/Venom Spider), historical: Trinity, FrameworkPOS, Ryuk,
3 min read
Golden Chickens Deploy TerraStealerV2 and TerraLogger in Credential Theft Surge
Malware

Golden Chickens Deploy TerraStealerV2 and TerraLogger in Credential Theft Surge

Threat Group: Golden Chickens (aka Venom Spider) Threat Type: Malware-as-a-Service (MaaS) Exploited Vulnerabilities: Social engineering via spear-phishing and LOLBins Malware Used: TerraStealerV2, TerraLogger, TerraLoader Threat Score: 🟠 Elevated (6.5/10) – Due to its credential-harvesting capabilities, stealth techniques, and deployment through widely used social engineering tactics. Last Threat Observation: May 3l
3 min read
Cozy Bear Launches Wine-Tasting Phishing Campaign to Deploy WineLoader
Phishing

Cozy Bear Launches Wine-Tasting Phishing Campaign to Deploy WineLoader

Threat Group: APT29 (Cozy Bear / Midnight Blizzard / NOBELIUM) Threat Type: Advanced Persistent Threat (APT) – Cyberespionage Exploited Vulnerabilities: None (social engineering and DLL side-loading) Malware Used: GrapeLoader (initial-stage loader), WineLoader (modular backdoor) Threat Score: 🔥 Critical (9.2/10) due to campaign sophistication, high-value diplomatic targeting, and stealth evasion techniques Last Threat
3 min read