More_eggs MaaS Expands Operations with RevC2 Backdoor and Venom Loader The threat actors behind the More_eggs malware have been linked to two new malware families, indicating an expansion of its malware-as-a-service (MaaS) operation. This includes a novel information-stealing backdoor called RevC2 and a loader codenamed Venom Loader, both of which Read more…
Sneaky Ghostpulse malware loader hides inside PNG pixels • The Register The Ghostpulse malware strain now retrieves its main payload via a PNG image file’s pixels. This development, security experts say, is “one of the most significant changes” made by the crooks behind it since launching in 2023. The image Read more…
New Malware Campaign Uses PureCrypter Loader to Deliver DarkVision RAT Oct 15, 2024Ravie LakshmananMalware / Cybercrime Cybersecurity researchers have disclosed a new malware campaign that leverages a malware loader named PureCrypter to deliver a commodity remote access trojan (RAT) called DarkVision RAT. The activity, observed by Zscaler ThreatLabz in July Read more…
Researchers Uncover Hijack Loader Malware Using Stolen Code-Signing Certificates Oct 15, 2024Ravie LakshmananThreat Detection / Malware Cybersecurity researchers have disclosed a new malware campaign that delivers Hijack Loader artifacts that are signed with legitimate code-signing certificates. French cybersecurity company HarfangLab, which detected the activity at the start of the month, Read more…
A Proof-Of-Concept Cobalt Strike Reflective Loader Which Aims To Recreate, Integrate, And Enhance Cobalt Strike’s Evasion Features! A proof-of-concept User-Defined Reflective Loader (UDRL) which aims to recreate, integrate, and enhance Cobalt Strike’s evasion features! Contributors: UDRL Usage Considerations The built-in Cobalt Strike reflective loader is robust, handling all Malleable PE Read more…
Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns Cybersecurity researchers have observed a spike in email phishing campaigns starting early March 2024 that delivers Latrodectus, a nascent malware loader believed to be the successor to the IcedID malware. “These campaigns typically involve a recognizable infection chain involving oversized JavaScript Read more…
Hijack Loader Malware Employs Process Hollowing, UAC Bypass in Latest Version A newer version of a malware loader called Hijack Loader has been observed incorporating an updated set of anti-analysis techniques to fly under the radar. “These enhancements aim to increase the malware’s stealthiness, thereby remaining undetected for longer periods of time,” Zscaler ThreatLabz Read more…
Ande Loader Malware Targets Manufacturing Sector in North America The threat actor known as Blind Eagle has been observed using a loader malware called Ande Loader to deliver remote access trojans (RATs) like Remcos RAT and NjRAT. The attacks, which take the form of phishing emails, targeted Spanish-speaking users in Read more…
New IDAT Loader Attacks Using Steganography to Deploy Remcos RAT Ukrainian entities based in Finland have been targeted as part of a malicious campaign distributing a commercial remote access trojan known as Remcos RAT using a malware loader called IDAT Loader. The attack has been attributed to a threat actor Read more…
Water Curupira Hackers Actively Distributing PikaBot Loader Malware Jan 09, 2024NewsroomMalware / Cyber Threat A threat actor called Water Curupira has been observed actively distributing the PikaBot loader malware as part of spam campaigns in 2023. “PikaBot’s operators ran phishing campaigns, targeting victims via its two components — a loader Read more…