Related Families: Bumblebee, IcedId
Verticals Targeted: Financial
Executive Summary
BlackBerry recently reported on Emotet’s new TTPs, including new email lures, IcedID, and Bumblebee as secondary payloads and evasion methods.
Emotet’s New TTPs
Feb 13, 2023 12:26:57 PM / by The Hivemind posted in Threat Bulletin, IcedID, Bumblebee, Emotet, xls
Mimic Ransomware
Feb 7, 2023 12:25:08 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Mimic, Everything.exe, Conti
Related Families: Conti
Executive Summary
Trend Micro recently reported on Mimic ransomware, a ransomware family that abuses Everything APIs.
Key Takeaways
Roaming Mantis Wroba.o Android Malware
Feb 3, 2023 1:20:46 PM / by The Hivemind posted in Threat Bulletin, Android, Shaoye, Xloader, Roaming Mantis, DNS, Wroba.o
Related Families: Wroba.o, Xloader
Executive Summary
Kaspersky SecureList recently reported on a Roaming Mantis campaign using Wroba.o with DNS hijacking to infect routers and Android devices.
Key Takeaways
Hook Android Banking Trojan
Jan 31, 2023 12:25:40 PM / by The Hivemind posted in Threat Bulletin, Banking, Android, RAT, Trojan, Hook, Ermac, DukeEugene
Related Families: Ermac
Verticals Targeted: Financial
Executive Summary
Threat Fabric recently reported on Hook, an Android banking trojan that is a fork of Ermac.
Malicious Lolip0p PyPI Packages Drop Wacatac
Jan 27, 2023 2:58:20 PM / by The Hivemind posted in Threat Bulletin, PyPI, Supply Chain Attack, Lolip0p, Wacatac
Related Families: Wacatac
Executive Summary
Fortinet recently reported on a supply chain attack in which threat actors leveraged a 0-day attack embedded in three PyPI packages to deliver Wacatac.
Fake Cracked Software Sites Delivering Stealers
Jan 24, 2023 11:02:41 AM / by PolySwarm Tech Team posted in Threat Bulletin, Stealer, Infostealer, Racoon
Related Families: Raccoon, Vidar
Executive Summary
Sekoia recently reported on a campaign leveraging fake cracked software sites to deliver information stealers, including Raccoon and Vidar.
Recent Turla Activity Targeting Ukraine
Jan 19, 2023 12:39:38 PM / by The Hivemind posted in Ukraine, Russia, Threat Bulletin, Espionage, Venomous Bear, Andromeda, Kopiluwak, Turla, QuietCanary
Related Families: Andromeda, Kopiluwak, QuietCanary
Executive Summary
Mandiant recently reported on a Turla campaign targeting Ukraine. The threat actors used multiple malware families in this campaign, including Kopiluwak, QuietCanary, and Andromeda.
Consulate Health Ransomware attack
Jan 18, 2023 2:35:50 PM / by The Hivemind posted in Malware, Ransomware, Hive, Cybercriminals
Ransomware attacks have become a major concern for businesses and organizations in recent years, with devastating consequences for those who fall victim. The Hive ransomware gang, which recently targeted Consulate Health Care, is one example of cybercriminals constructing sophisticated and ruthless tactics to steal sensitive data and extort money from their victims. But how can you protect yourself from these kinds of attacks in the future?