Related Families: Phobos
Recent Posts
Faust Ransomware
Feb 12, 2024 1:07:27 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Windows, Faust, Phobos
New Zloader Variant Discovered
Feb 9, 2024 1:16:59 PM / by The Hivemind posted in Threat Bulletin, Windows, Trojan, Zloader, ZeuS, 64-bit
Related Families: ZeuS
Executive Summary
A new variant of the modular trojan Zloader was recently identified. The new variant has been in development since September 2023.
Cactus Ransomware
Feb 5, 2024 2:04:38 PM / by The Hivemind posted in Threat Bulletin, Critical Infrastructure, Ransomware, Energy, Cactus
Verticals Targeted: Energy
Executive Summary
Cactus is a ransomware family that has been active since at least March 2023 and has been gaining momentum in recent months. Cactus recently claimed an attack on Schneider Electric.
ColdRiver Using Spica Backdoor
Feb 2, 2024 1:06:16 PM / by The Hivemind posted in Russia, Threat Bulletin, Backdoor, Spica, ColdRiver
Executive Summary
Russia nexus threat actor group ColdRiver was recently observed using Spica backdoor in an espionage campaign.
Androxgh0st
Jan 29, 2024 1:52:50 PM / by The Hivemind posted in Threat Bulletin, Botnet, Androxgh0st, SMTP cracker
Executive Summary
Androxghost is a Python-based SMTP cracker that has been active in the wild since at least 2022. The FBI and CISA released a joint advisory warning of the dangers of Androxgh0st.
Volt Typhoon's KV-Botnet
Jan 22, 2024 1:38:21 PM / by The Hivemind posted in Threat Bulletin, APT, Critical Infrastructure, China, Linux, Volt Typhoon, KV-Botnet
Verticals Targeted: Government
Executive Summary
Volt Typhoon was observed compromising Cisco RV325 devices with KV-Botnet.
SpectralBlur MacOS Backdoor
Jan 19, 2024 2:03:16 PM / by The Hivemind posted in Threat Bulletin, Backdoor, MacOS, Stardust Chollima, SpectralBlur, KandyKorn
Related Families: KandyKorn
Executive Summary
SpectralBlur is a fairly unsophisticated backdoor targeting MacOS devices. It has been attributed to Stardust Chollima.
Xamalicious Android Backdoor
Jan 16, 2024 7:42:21 AM / by The Hivemind posted in Threat Bulletin, Android, Backdoor, Mobile, Xamalicious