Verticals Targeted: Financial
New Medusa Android Banking Trojan Variant Discovered
Jul 1, 2024 1:28:23 PM / by The Hivemind posted in Threat Bulletin, Banking, Financial, Android, Trojan, Mobile, Medusa, on-device fraud
FickleStealer
Jun 28, 2024 3:08:23 PM / by The Hivemind posted in Threat Bulletin, Stealer, Infostealer, FickleStealer
Executive Summary
FickleStealer is a Rust-based stealer that targets Windows devices. It is distributed in a variety of ways and steals information, likely with the intent of using the information for follow-on attacks.
BadSpace Backdoor
Jun 25, 2024 1:23:38 PM / by The Hivemind posted in Threat Bulletin, Backdoor, BadSpace, WarmCookie, SocGholish
Executive Summary
BadSpace, also known as WarmCookie, is a novel backdoor delivered via a multistage attack leveraging infected websites.
DISGOMOJI Linux RAT Controlled Via Discord Emojis
Jun 24, 2024 3:02:07 PM / by The Hivemind posted in Threat Bulletin, Espionage, India, Pakistan, Government, RAT, Discord, DISGOMOJI
Verticals Targeted: Government
Executive Summary
DISGOMOJI is a RAT controlled via emojis sent over Discord. It was recently observed targeting government entities in India.
PolySwarm.AI: Rewarding the Community for Eradicating Invasive Phish
Jun 21, 2024 9:14:34 AM / by PolySwarm Team posted in Blockchain, Cryptocurrency, NCT, Nectar
PolySwarm, the decentralized threat detection marketplace, is excited to announce that we are developing an expansion of our groundbreaking NectarNet browser extension.
Cosmic Leopard Activity Targets Windows, MacOS, & Android
Jun 17, 2024 3:15:17 PM / by The Hivemind posted in Threat Bulletin, Android, Windows, MacOS, Cosmic Leopard, GravityRAT, Operation Celestial Force, HeavyLift, GravityAdmin
Related Families: GravityRAT, HeavyLift, GravityAdmin
Verticals Targeted: Defense, Government, Technology
Executive Summary
Cosmic Leopard was observed targeting Windows, MacOS, and Android devices in a series of ongoing campaigns dubbed Operation Celestial Force. The threat actors used GravityRAT and HeavyLift to target entities in India.
RansomHub
Jun 14, 2024 2:22:45 PM / by The Hivemind posted in Threat Bulletin, Ransomware, RansomHub, Knight
Related Families: Knight
Verticals Targeted: Healthcare, Financial, Auction House, Technology, Government
Executive Summary
RansomHub, a ransomware as a service (RaaS), is an offshoot of Knight and has quickly become one of the most active ransomware families in 2024.
TargetCompany Ransomware Linux Variant
Jun 10, 2024 2:25:02 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Linux, Asia, APAC, TargetCompany, ESXi
Verticals Targeted: Healthcare, Finance, Government, Manufacturing, Education, Information Technology, Retail, Transportation, Utilities, Telecommunications