Verticals Targeted: Financial
Related Families: Mirai
Executive Summary
Condi is a DDoS as a service botnet based on Mirai. It has been observed leveraging CVE-2023-1389 to propagate.
Related Families: AsyncRAT
Verticals Targeted: Consumer Services
Executive Summary
DcRAT is a clone of AsyncRAT and is used for remote access and stealing information. It also has ransomware capabilities. DcRAT has distributed via adult content-themed lures, including lures for OnlyFans pages.
Related Families: WhisperGate
Verticals Targeted: Government, Law Enforcement, Non-profits, Information Technology, Emergency Services
Executive Summary
Cadet Blizzard is a Russia nexus state-sponsored threat actor group with potential ties to the GRU. However, their activity seems to be distinct from other GRU-associated threat actor groups.
Related Families: SunSeed, AHKBOT, NODEBOT
Verticals Targeted: Government, Cryptocurrency, Financial
Executive Summary
Asylum Ambuscade is a threat actor group known to engage in both cybercrime and espionage activity. Their targets include government, financial, and SMB entities, primarily in Europe and North America.
Associated Families: LemurLoot
Verticals Targeted: Financial, Government
Executive Summary
Industry researchers from multiple vendors observed threat actors leveraging CVE-2023-34362. Microsoft attributed the activity to a Cl0p affiliate dubbed Lace Tempest.
Related Families: Royal
Executive Summary
BlackSuit ransomware targets both Windows and Linux systems and bears a striking resemblance to Royal ransomware.
Verticals Targeted: Energy, Critical Infrastructure
Executive Summary
CosmicEnergy is a novel malware targeting operational technology (OT) and ICS.