VHDs Used to Distribute VenomRAT and Other Malware

A phishing campaign is utilizing virtual hard disk (VHD) image files to deliver VenomRAT malware. The attack begins with a purchase order-themed email containing a ZIP archive with a VHD file. When opened, the VHD mounts as a drive and executes a heavily obfuscated batch script. This script employs PowerShell to perform malicious activities, including dropping files in the Startup folder for persistence, modifying registries, and connecting to Pastebin for C2 communication. The malware creates a DataLogs.conf file to capture keystrokes and sensitive data, which is then exfiltrated to the C2 server. The campaign also utilizes AES encryption and multiple layers of obfuscation to evade detection.

Pulse ID: 67d4020796732ac274dd165c
Pulse Link: otx.alienvault.com/pulse/67d40…
Pulse Author: AlienVault
Created: 2025-03-14 10:16:39

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Email #Encryption #InfoSec #Malware #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #Venom #ZIP #bot #AlienVault

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit 🕵️‍♂️

Teilen er­be­ten ‼️

#DSGVO #TDDDG ( #unplugtrump )
#Datenschutz #Privatsphäre #sicherheit #Verschlüsselung
#encryption #WEtell #SoloKey #NitroKey #Email #Cybersecurity #Pixelfed #Massenűberwachung
#Google #Metadaten #WhatsApp #Threema #Cryptpad #Signal
#Hateaid #Cyberstalking #Messenger #Browser #Youtube #NewPipe #Chatkontrolle #nichtszuverbergen #ÜberwachungsKapitalismus #Microsoft #Apple #Windows #Linux #Matrix #Mastodon #Friendica #Fediverse #Mastodir #Loops #2FA #Ransomware #Foss #VeraCrypt #HateAid #Coreboot #Volksverpetzer #Netzpolitik #Digitalisierung #FragdenStaat #Shiftphone #OpenSource #GrapheneOS #CCC #Mail #Mullvad #PGP #GnuPG #DNS #Gaming #linuxgaming #Lutris #Protondb #eOS #Enshittification
#Bloatware #TPM #Murena #LiberaPay #GnuTaler #Taler #PreppingforFuture
#FediLZ #BlueLZ #InstaLZ #ThreatModel
#FLOSS #UEFI #Medienkompetenz

cryptpad.digitalcourage.de/fil…

Head Mare and Twelve: Joint attacks on Russian entities

Head Mare and Twelve, two hacktivist groups, have launched joint attacks on Russian companies. Head Mare has expanded its toolkit, now using tools previously associated only with Twelve, such as the CobInt backdoor. The attackers gained initial access through phishing emails and compromised contractors. They used various tools for reconnaissance, privilege escalation, lateral movement, and data exfiltration. The final goal was file encryption using LockBit 3.0 and Babuk ransomware. Overlaps in infrastructure, tactics, and tools suggest collaboration between the two groups. The attacks primarily targeted manufacturing, government, and energy sectors in Russia.

Pulse ID: 67d2f2839a4838011419a38a
Pulse Link: otx.alienvault.com/pulse/67d2f…
Pulse Author: AlienVault
Created: 2025-03-13 14:58:11

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #CyberSecurity #Email #Encryption #Government #Hacktivist #ICS #InfoSec #LockBit #Manufacturing #OTX #OpenThreatExchange #Phishing #RAT #RansomWare #Russia #UK #bot #AlienVault

Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware

A phishing campaign targeting the hospitality industry impersonates Booking.com to deliver multiple credential-stealing malware. The campaign, tracked as Storm-1865, uses a social engineering technique called ClickFix to trick users into downloading malicious payloads. Targets are sent emails with links to fake Booking.com pages, which prompt users to execute commands that download malware. The campaign delivers various malware families including XWorm, Lumma stealer, VenomRAT, AsyncRAT, Danabot, and NetSupport RAT. Organizations in North America, Oceania, Asia, and Europe are targeted. The threat actor's evolving tactics demonstrate attempts to bypass conventional security measures.

Pulse ID: 67d30e5c763aea4dce897014
Pulse Link: otx.alienvault.com/pulse/67d30…
Pulse Author: AlienVault
Created: 2025-03-13 16:57:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #AsyncRAT #CyberSecurity #DanaBot #Email #Europe #Hospital #ICS #InfoSec #LummaStealer #Malware #NetSupport #NetSupportRAT #NorthAmerica #OTX #OpenThreatExchange #Phishing #RAT #SocialEngineering #Venom #Worm #XWorm #bot #AlienVault

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

Threat actors are increasingly using legitimate remote monitoring and management (RMM) tools as initial payloads in email campaigns. This trend aligns with a decrease in the use of traditional loaders and botnets by initial access brokers. RMMs can be exploited for data collection, financial theft, lateral movement, and installing additional malware. Notable RMM tools observed in campaigns include ScreenConnect, Fleetdeck, and Atera. The shift towards RMM usage coincides with law enforcement disruptions of major malware families and a decline in ransomware payments. Specific threat actors like TA583 and TA2725 have been observed incorporating RMMs into their attack strategies. Organizations are advised to restrict unauthorized RMM installations, implement network detections, and train users to identify suspicious activity.

Pulse ID: 67d1afa2d9e59f25878898b6
Pulse Link: otx.alienvault.com/pulse/67d1a…
Pulse Author: AlienVault
Created: 2025-03-12 16:00:34

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Email #InfoSec #LawEnforcement #Malware #OTX #OpenThreatExchange #RAT #RCE #RansomWare #ScreenConnect #bot #botnet #AlienVault

APT37 - RokRat

APT37, a North Korean state-sponsored hacking group, has expanded its operations to target users on Windows and Android platforms through phishing campaigns. The group's attack vector involves malicious LNK files distributed via group chat platforms. The infection process begins with phishing emails containing ZIP attachments that conceal malicious LNK files. When executed, these files initiate a multi-stage attack using batch scripts and PowerShell, ultimately deploying RokRat as the final payload. RokRat, a remote access Trojan, collects detailed system information, abuses cloud services for command and control, and employs anti-analysis techniques. It can execute remote commands, exfiltrate data, and perform various malicious activities on infected systems.

Pulse ID: 67d1765e955b4c08e7d77807
Pulse Link: otx.alienvault.com/pulse/67d17…
Pulse Author: AlienVault
Created: 2025-03-12 11:56:13

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT37 #Android #Cloud #CyberSecurity #Email #InfoSec #Korea #LNK #NorthKorea #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #RemoteAccessTrojan #Trojan #Windows #ZIP #bot #AlienVault

Trump Cryptocurrency Delivers ConnectWise RAT

An email campaign impersonating Binance is offering fake TRUMP coins to lure victims into downloading a malicious 'Binance Desktop' application, which actually installs ConnectWise RAT. The attackers have created a convincing web page mimicking Binance's interface to host the malware download. Once infected, threat actors quickly establish remote control of the victim's computer, targeting saved passwords in applications like Microsoft Edge. The campaign employs sophisticated social engineering tactics, including sender name spoofing and risk warnings, to appear legitimate. Threat actors are actively monitoring infections and can connect to compromised systems within minutes of installation.

Pulse ID: 67d0743fa696bc6ef3985a7d
Pulse Link: otx.alienvault.com/pulse/67d07…
Pulse Author: AlienVault
Created: 2025-03-11 17:34:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Binance #ConnectWise #CyberSecurity #Edge #Email #ICS #InfoSec #Malware #Microsoft #MicrosoftEdge #Mimic #OTX #OpenThreatExchange #Password #Passwords #RAT #SocialEngineering #Word #bot #cryptocurrency #AlienVault

A Deep Dive into Strela Stealer and how it Targets European Countries

Strela Stealer is an infostealer targeting email clients in specific European countries. It exfiltrates login credentials from Mozilla Thunderbird and Microsoft Outlook. The malware is delivered through phishing campaigns, primarily affecting Spain, Italy, Germany, and Ukraine. Recent campaigns involve forwarding legitimate emails with malicious attachments. Strela Stealer employs custom obfuscation techniques and code-flow flattening to complicate analysis. The malware verifies the system's locale before executing, targeting specific language regions. It searches for email client profile data, encrypts it, and exfiltrates it to a command-and-control server. The infrastructure used by Strela Stealer is linked to Russian bulletproof hosting providers, suggesting potential ties to Russian threat actors.

Pulse ID: 67d045cff4f0a2adaabd0c05
Pulse Link: otx.alienvault.com/pulse/67d04…
Pulse Author: AlienVault
Created: 2025-03-11 14:16:47

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #Email #Europe #Germany #InfoSec #InfoStealer #Italy #Malware #Microsoft #OTX #OpenThreatExchange #Outlook #Phishing #RAT #Russia #Spain #UK #Ukr #Ukraine #bot #AlienVault