Related Families: MuddyRot aka BugSleep
Verticals Targeted: Transportation, Government, Media, Travel
MuddyWater Using New Backdoor to Target Middle East
Jul 22, 2024 1:09:20 PM / by The Hivemind posted in Threat Bulletin, Middle East, Static Kitten, MuddyWater, MuddyRot, BugSleep
Eldorado Ransomware
Jul 15, 2024 2:43:58 PM / by The Hivemind posted in Healthcare, Education, Manufacturing, Real Estate, Professional Services
Verticals Targeted: Real Estate, Education, Professional Services, Healthcare, Manufacturing
Executive Summary
Eldorado is a relatively new ransomware as a service (RaaS) that targets both Windows and Linux systems. The ransomware has already claimed 16 victims and is gaining momentum.
New CapraRAT Activity
Jul 12, 2024 2:44:05 PM / by The Hivemind posted in Threat Bulletin, Espionage, Android, CapraRAT, Spyware, Mobile, Surveillance
Executive Summary
Pakistan-based threat actor group Mythic Leopard was recently observed using new CapraRAT samples to expand their targeting.
GhostLocker Ransomware
Jul 5, 2024 2:05:23 PM / by The Hivemind posted in Threat Bulletin, Ransomware, GhostLocker, GhostSec, Stormous
Verticals Targeted: Technology, Education, Manufacturing, Transportation, Government
Executive Summary
GhostLocker, a ransomware family that has been in the wild since late 2023, is now under new management. Stormous, the new GhostLocker operators, have stated they are updating the program and will offer some ransomware services for free.
New Medusa Android Banking Trojan Variant Discovered
Jul 1, 2024 1:28:23 PM / by The Hivemind posted in Threat Bulletin, Banking, Financial, Android, Trojan, Mobile, Medusa, on-device fraud
Verticals Targeted: Financial
Executive Summary
A new variant of the Android banking trojan Medusa was recently discovered. This variant boasts a smaller footprint, needs fewer device permissions, and has full-screen overlay capabilities.
FickleStealer
Jun 28, 2024 3:08:23 PM / by The Hivemind posted in Threat Bulletin, Stealer, Infostealer, FickleStealer
Executive Summary
FickleStealer is a Rust-based stealer that targets Windows devices. It is distributed in a variety of ways and steals information, likely with the intent of using the information for follow-on attacks.
BadSpace Backdoor
Jun 25, 2024 1:23:38 PM / by The Hivemind posted in Threat Bulletin, Backdoor, BadSpace, WarmCookie, SocGholish
Executive Summary
BadSpace, also known as WarmCookie, is a novel backdoor delivered via a multistage attack leveraging infected websites.
DISGOMOJI Linux RAT Controlled Via Discord Emojis
Jun 24, 2024 3:02:07 PM / by The Hivemind posted in Threat Bulletin, Espionage, India, Pakistan, Government, RAT, Discord, DISGOMOJI
Verticals Targeted: Government