Related Families: Remcos RAT, Metasploit
Verticals Targeted: Manufacturing, Retail, Wholesale, Legal, Professional Services
Mallox Ransomware
Sep 15, 2023 2:00:19 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Mallox, Remcos RAT
BadBazaar Spyware Variants Delivered Via Trojanized Android Apps
Sep 11, 2023 3:07:00 PM / by The Hivemind posted in Threat Bulletin, Espionage, Android, Mobile, BadBazaar, GREF
Executive Summary
Two GREF espionage campaigns used trojanized Android apps to deliver BadBazaar spyware variants.
Carderbee Targets Hong Kong in Supply Chain Attack
Sep 8, 2023 2:29:33 PM / by The Hivemind posted in Threat Bulletin, Carderbee, Korplug, PlugX
Related Families: Korplug, PlugX
Executive Summary
In a recent campaign, Carderbee targeted entities in Hong Kong and other regions of Asia via a supply chain attack leveraging the legitimate Cobra DocGuard software.
UNC4841 Targeting Government Entities with Barracuda ESG 0day
Sep 4, 2023 1:24:05 PM / by The Hivemind posted in Threat Bulletin, Government, Defense, Telecommunications, Aerospace, CVE-2023-2868, Military, Technology, DEPTHCHARGE, UNC4841, SKIPJACK, FOXTROT, FOXGLOVE
Related Families: SKIPJACK, DEPTHCHARGE, FOXTROT, FOXGLOVE
Verticals Targeted: Government, Military, Defense, Aerospace, Technology, Telecommunications
Executive Summary
UNC4841 was observed using CVE-2023-2868 to target entities in multiple verticals, including government and military.
New XLoader Variant Disguised as Signed App
Sep 1, 2023 1:24:48 PM / by The Hivemind posted in Threat Bulletin, Xloader, MacOS
Executive Summary
A new XLoader variant has been observed in the wild, targeting MacOS systems and disguising itself as a signed OfficeNote app.
Go-Based Proxy Targets Windows and Mac Systems
Aug 28, 2023 2:57:30 PM / by The Hivemind posted in Threat Bulletin, Windows, Mac, Proxy, Go
Executive Summary
A recent malware campaign delivered a proxy server application to both Windows and Mac systems, turning them into proxy exit nodes.
Cuba Ransomware Used Veeam Vulnerability (CVE-2023-27532)
Aug 25, 2023 1:54:17 PM / by The Hivemind posted in Threat Bulletin, Critical Infrastructure, Ransomware, Information Technology, Cuba
Verticals Targeted: Critical Infrastructure, Information Technology
Executive Summary
Cuba ransomware was observed using the Veeam vulnerability (CVE-2023-27532) in June to target critical infrastructure and IT entities in the US and Latin America.
Monti Ransomware Linux Variant
Aug 21, 2023 12:49:38 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Linux, Conti, Monti
Related Families: Conti
Verticals Targeted: Legal, Government