Verticals Targeted: Professional Services, Media and Entertainment, Manufacturing, Healthcare, Energy and Utilities, Education, Financial
Executive Summary
Cyble recently reported on BianLian, a new ransomware variant written in Go. It has been used to target multiple verticals.
Recent Posts
BianLian Ransomware
Sep 26, 2022 4:05:33 PM / by PolySwarm Tech Team posted in Threat Bulletin, Ransomware, BianLian
New Armageddon Activity Targets Ukraine
Sep 22, 2022 12:45:11 PM / by PolySwarm Tech Team posted in Ukraine, Russia, Threat Bulletin, Infostealer, Armageddon, Gameredon, Primitive Bear, Shuckworm
Executive Summary
Cisco Talos researchers recently reported on new activity perpetrated by Russian nexus threat actor group Armageddon. The group is using a new infostealer to target entities in Ukraine.
Key Takeaways
Kimsuky GoldDragon C2 Cluster
Sep 19, 2022 2:06:44 PM / by PolySwarm Tech Team posted in Threat Bulletin, Espionage, North Korea, Kimsuky, GoldDragon
Verticals Targeted: Think Tanks, Media, Government
Executive Summary
In early 2022, the North Korean threat actor group Kimsuky targeted a South Korean think tank and media entities. In this campaign, they leveraged what is known as the GoldDragon backdoor and associated C2 cluster.
Key Takeaways
Shikitega Linux Malware
Sep 15, 2022 1:51:05 PM / by PolySwarm Tech Team posted in Threat Bulletin, Linux, Shikitega, CVE-2021-4034, CVE-2021-3493
Executive Summary
In our 2021 Year in Review, we predicted a rise in Linux malware for 2022. AT&T Alien Labs recently reported on Shikitega, a new Linux malware with stealth capabilities.
Key Takeaways
DarkAngels Linux Ransomware
Sep 12, 2022 1:45:13 PM / by PolySwarm Tech Team posted in Threat Bulletin, Ransomware, Linux, DarkAngels
Related families: Babuk
Executive Summary
Uptycs recently reported on a new DarkAngels Linux ransomware variant that appears to still be in development.
Charming Kitten Hyperscrape Tool
Sep 9, 2022 1:13:55 PM / by PolySwarm Tech Team posted in Threat Bulletin, Iran, Hyperscrape, Scraper, Charming Kitten, APT35
Executive Summary
Google’s Threat Analysis Group (TAG) recently reported on Hyperscrape, a new data extraction tool used by the Iranian nexus threat actor group Charming Kitten.
Key Takeaways
Agenda Ransomware
Sep 6, 2022 3:11:38 PM / by PolySwarm Tech Team posted in Threat Bulletin, Agenda Ransomware, GoLang
Related Families: Black Basta, Black Matter, REvil
Verticals Targeted: healthcare, education
Executive Summary
Trend Micro recently reported on Agenda Ransomware, a tailored ransomware written in GoLang.
Lightning Framework
Sep 1, 2022 12:30:19 PM / by PolySwarm Tech Team posted in Threat Bulletin, Linux, Lightning Framework
Executive Summary
Intezer recently reported on Lightning Framework, a Linux malware with modular plugins and the ability to install rootkits.
Key Takeaways