ALERT MENU 2024

A new multi-stage macOS stealer malware has been recently reported. The malware exhibits many traits such as the following:

Over the past two weeks, Symantec has observed an actor leveraging a peculiar attack chain to distribute highly obfuscated payload onto compromised systems. The attacks start with malicious emails containing a malicious PDF, DOCX, or SVG file (REMITIRA A TRAVES DEL SERVICIO POSTAL AUTORIZADO.docx, Radicado juridico 23156484.svg, and 99-DEMANDA .docx).

Symantec has observed a new wave of phish runs spoofing International Card Services BV to steal credentials. In this run, threat actors have not hyperlinked the phishing URL but included it in plain text along with the email content.

Bandook is a remote access trojan discovered way back in 2007. While it is quite an old malware family, new variants of Bandook reemerge in the wild with new distribution campaigns to this day.

DATE	NAME	INFO	CATEGORY	SUBCATE
31.12.24	SpyMax Targets Uzbek Mobile Users Through Fake Uzum Apps	In 2024, a malicious actor exploited Uzum's brand in a series of campaigns targeting mobile users in Uzbekistan. These campaigns utilized SpyMax, a well-known remote access trojan disguised as a fake Uzum Bank Android application, to compromise victims’ devices and steal sensitive data.	ALERTS	VIRUS
30.12.24	Ficora and Capsaicin botnets leverage old vulnerabilities for distribution	According to the researchers from Fortinet, two Linux botnet variants Ficora and Capsaicin have been distributed in recently observed campaigns. The botnets leverage several old D-Link vulnerabilities affecting the HNAP (Home Network Administration Protocol) interface including CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112.	ALERTS	BOTNET
28.12.24	Skuld Infostealer malware continues to target developers via npm registry	A malware campaign deploying the Skuld infostealer via the npm registry has been reported, targeting developers with ambiguous packages.	ALERTS	VIRUS
28.12.24	Gosar - a new Golang-based variant of Quasar backdoor	Gosar is a recently identified Golang-based variant of the Quasar backdoor. The malware is spread in campaigns leveraging .MSI installer files disguised as legitimate software packages (such as Telegram or Opera).	ALERTS	VIRUS
28.12.24	Latest XWorm distribution campaign targets the hospitality sector	A new campaign distributing the XWorm commodity malware has been reported in the wild. The attack targets the hospitality sector in the UK.	ALERTS	VIRUS
28.12.24	Recent I2PRAT malware variant leverages anonymous peer-to-peer network communication	The latest I2PRAT malware variant has been observed to leverage I2P anonymous peer-to-peer network for the purpose of C2 communication.	ALERTS	VIRUS
27.11.24	Multiple vulnerabilities affecting Palo Alto Networks Expedition	Multiple vulnerabilities affecting Palo Alto Networks Expedition have been disclosed this month. The reported flaws (CVE-2024-9463, CVE-2024-9464, CVE-2024-9465, CVE-2024-9466, CVE-2024-9467) have been rated between CVSS 7.0 and CVSS 9.9 and include a mix of command injection, cross-site scripting (XSS), cleartext storage of sensitive information, missing authentication, and SQL injection vulnerabilities.	ALERTS	VULNEREBILITY
27.11.24	CVE-2024-47575 - Fortinet FortiManager Missing Authentication vulnerability	CVE-2024-47575 is a Zero-day vulnerability affecting Fortinet FortiManager, that has been disclosed just this month. The vulnerability has been rated with a critical CVSS score of 9.8. If successfully exploited, it could allow remote unauthenticated attackers to execute arbitrary code via specially crafted requests.	ALERTS	VULNEREBILITY
27.11.24	Parano Stealer	Parano Stealer is another "run-of-the-mill" infostealer variant recently observed in the wild. This Python-based malware has functionality to collect and exfiltrate various information from the compromised endpoints, including: credentials, cookies, miscellaneous data stored in web browsers, cryptocurrency wallets, system information or data from various 3rd party applications like Steam, Telegram or Discord.	ALERTS	VIRUS
27.11.24	Liberium RAT malware	Liberium RAT (also known as ShadowRoot) is a malware variant recently advertised for sale on hacking forums. The malware has the capabilities allowing the attackers remote access to the vulnerable endpoints, file management operations, registry manipulation as well as theft of system related information and other confidential data.	ALERTS	VIRUS
27.11.24	CVE-2024-38094 - Microsoft SharePoint Deserialization vulnerability exploited in the wild	CVE-2024-38094 is a deserialization vulnerability affecting Microsoft SharePoint, which was initially disclosed and patched back in July 2024. The flaw rated with a CVSS score of 7.2 arises from the product deserializing data without enough verification that the resulting data output will be valid.	ALERTS	VULNEREBILITY
27.11.24	Prometei botnet activity	New Prometei botnet activity has been reported in the wild. The botnet has been historically used mostly for Monero cryptomining operations but with time the attackers behind it updated the botnet capabilities to conduct even more complex attacks, allowing for a full control over the infected machines a well as additional arbitrary payload deployments.	ALERTS	BOTNET
27.11.24	DarkComet Backdoor	DarkComet is a powerful Remote Access Trojan (RAT) that remains a significant threat because of its stealthy operations and comprehensive functionality. It enables attackers to remotely control infected devices, exfiltrate sensitive data, and deploy further malware.	ALERTS	VIRUS
27.11.24	Threat actors distribute WarmCookie malware via various campaigns	WarmCookie is malware that has been observed being distributed through various campaigns, including malicious emails. This malware provides initial access to a compromised victim and is used to establish persistence.	ALERTS	VIRUS
27.11.24	Crystal Rans0m: Rust-Based Hybrid Ransomware	Crystal Rans0m is a Rust-based hybrid ransomware that combines file encryption with data-stealing capabilities that has been observed targeting Italy and Russia. The malware can steal browser data, Discord tokens, Steam files, Riot Games data and utilizes Discord webhooks for data exfiltration.	ALERTS	RANSOM
27.11.24	CVE-2024-9680 - Mozilla Firefox Remote Code Execution vulnerability	CVE-2024-9680 is a recently disclosed Remote Code Execution (RCE) vulnerability affecting Mozilla Firefox and Thunderbird software. The vulnerability has been assigned a critical CVSS score of 9.8 and arises from a "use-after-free" flaw in the animation timeline component of the browser.	ALERTS	VULNEREBILITY
27.11.24	Phemedrone Stealer	Phemedrone is an open-source infostealer variant observed being distributed in the wild this year. The malware is written in C# and has the functionality to collect and exfiltrate various sensitive information such as login credentials, data stored in browsers, cookies, credit card information, cryptocurrency wallets, files stored in "My Documents" folders or data from other 3rd party apps such as Steam, Discord or Telegram.	ALERTS	VIRUS
27.11.24	Phemedrone Stealer	Earlier this year, Akira developed a new version of its ransomware encryptor and has since been observed using another novel iteration of the encryptor that targets both Windows and Linux systems. Akira typically employs a double-extortion tactic, exfiltrating critical data before encrypting the victim's systems.	ALERTS	VIRUS
27.11.24	Akira Ransomware Evolution: A move towards cross-platform adaptability	Earlier this year, Akira developed a new version of its ransomware encryptor and has since been observed using another novel iteration of the encryptor that targets both Windows and Linux systems. Akira typically employs a double-extortion tactic, exfiltrating critical data before encrypting the victim's systems.	ALERTS	RANSOM
27.11.24	Ghostpulse Malware: Shifting tactics from PNGs to Pixel values	According to recent reports, Ghostpulse malware has evolved its tactics by shifting from hiding its encrypted configuration and payload in the IDAT chunk of PNG files, to embedding it directly within the pixel values themselves to evade detection.	ALERTS	VIRUS
27.11.24	CVE-2024-28987 - SolarWinds Web Help Desk Hardcoded Credential vulnerability	CVE-2024-28987 is a recently disclosed hardcoded credential vulnerability affecting the SolarWinds Web Help Desk (WHD) software. The flaw is rated as critical (CVSS score 9.1 and if successfully exploited could allow remote unauthenticated attackers to access internal software functionality and modify data.	ALERTS	VULNEREBILITY
27.11.24	Threat actors abusing open-source phishing framework to deliver RATS	A recent report by (CTA) member Cisco Talos has recently disclosed a new phishing campaign abusing the open-source phishing readiness assessment framework named 'Gophish' to deploy one of two attack chains.	ALERTS	VIRUS
27.11.24	IcePeony: China-linked APT group targeting Southeast Asian governments	A recently identified APT group linked to China dubbed IcePeony has been detected conducting malware campaigns targeting government agencies and institutions in countries such as India, Mauritius, and Vietnam.	ALERTS	APT
27.11.24	Lumma Stealer delivered via Fake CAPTCHA	Researchers are monitoring an ongoing phishing campaign where attackers appear to have upped their tactics from traditional phishing to incorporating the use of fake CAPTCHA pages and exploiting legitimate software. The intention being to eventually lure users into executing a payload called Lumma Stealer. This infostealing malware is a MaaS (Malware-as-a-Service) variant that steals sensitive data such as passwords and cryptocurrency information.	ALERTS	VIRUS
27.11.24	Phishing Campaign Delivering Wiper Malware	A recent campaign was observed by researchers where threat actors were seen targeting Israeli organizations, by impersonating a certain antivirus vendor and sending out phishing emails warning of state-backed threats. The emails include a link to a fake program that downloads a malware called Wiper, designed to erase data.	ALERTS	PHISHING
27.11.24	Phishing attack aims at Meta Ads Professionals with Quasar RAT	A malware campaign targeting job seekers and digital marketing professionals has been reported. The campaign specifically focuses on Meta Ads professionals and is believed to be driven by a Vietnamese Threat Actor.	ALERTS	PHISHING
27.11.24	ClickFix Tactic: New malware campaigns preying on Google Meet users	Various malware campaigns utilizing the emerging ClickFix tactic have been reported since June 2024. One such campaign distributing infostealers through fake Google Meet pages, a popular video communication service has been reported in the wild. Users are lured by emails that appear to be legitimate Google Meet invitations for work meetings, conferences, or other significant events.	ALERTS	CAMPAIGN
27.11.24	Recent malicious activities attributed to the UAT-5647 threat group	According to the report published by Cisco Talos, UAT-5647 threat group has been targeting entities in Ukraine and Poland in their most recent campaigns. The threat actors have been distributing two distinct downloader variants called RustyClaw and MeltingClaw, a new RomCom malware variant dubbed SingleCamper, as well as DustyHammock and ShadyHammock backdoors.	ALERTS	GROUP
27.11.24	Emerging Stealer Variants: Divulge, DedSec, and Duck Stealers	Multiple stealers have been observed being advertised on hacker forums, GitHub, and Telegram, all developed and promoted by the same entity. Notable variants include Divulge Stealer (a copy of Umbral), DedSec Stealer (based on Doenerium), and Duck Stealer (a derivative of AZStealer).	ALERTS	VIRUS
27.11.24	TrickMo targeting Android users with fake lock-screen	Security researchers have recently disclosed a new variant of TrickMo, a mobile banking trojan that targets Android and iOS users. This new variant comes with some new functionality in addition to the existing capabilities, such as screen recording, remote control, and permissions granting.	ALERTS	VIRUS
27.11.24	Lockbit ransomware pretender targets macOS and Windows environments for data theft	A new campaign leveraging a malware variant disguised as Lockbit ransomware has been reported in the wild. The GO-based malware targets both macOS and Windows users in attempts to encrypt and exfiltrate confidential data.	ALERTS	RANSOM
27.11.24	Microsoft Windows Kernel TOCTOU Race Condition Vulnerability (CVE-2024-30088)	CVE-2024-30088 is a Time-Of-Check Time-Of-Use (TOCTOU) race condition vulnerability in the Microsoft Windows Kernel. It arises when the state of a resource is modified between its validation (check) and actual use, allowing attackers to exploit the gap for privilege escalation.	ALERTS	VULNEREBILITY
27.11.24	Leafperforator APT group expands operations into the Middle East and Africa	Researchers recently published a warning about the Telegram account '@reserveplusbot', linked to a specific application and serving as a contact for technical support. The suspicious messages urged users to install a ZIP file that contains malware. The executable file inside is a variant of Meduza Stealer, which steals files and evades detection by modifying Microsoft Defender settings.	ALERTS	APT
27.11.24	Meduza Stealer	Researchers recently published a warning about the Telegram account '@reserveplusbot', linked to a specific application and serving as a contact for technical support. The suspicious messages urged users to install a ZIP file that contains malware.	ALERTS	VIRUS
27.11.24	New Linux variant of FASTCash malware discovered	A new Linux variant of the FASTCash malware (a tool which CISA has attributed to North Korea) has been discovered. FASTCash is malware that is implanted within compromised networks and leveraged to perform unauthorized banking transactions.	ALERTS	VIRUS
27.11.24	CVE-2024-44849 - Qualitor Remote Code Execution (RCE) vulnerability	CVE-2024-44849 is a critical (CVSS: 9.8) Remote Code Execution (RCE) vulnerability in Qualitor, which is a platform for managing customer service processes and centralizing services. This exploit allows remote code execution (RCE) through an arbitrary file upload in Qualitor version before 8.24.	ALERTS	VULNEREBILITY
27.11.24	ThunderKitty malware	ThunderKitty is a GO-based open-source infostealer variant seen in the wild. The malware has the functionality to collect miscellaneous information from infected machines including banking details, Discord session tokens, cookies, browser history and other data stored in the browsers, etc.	ALERTS	VIRUS
27.11.24	CVE-2024-45519 - Remote Command Execution vulnerability in Zimbra Collaboration Suite	CVE-2024-45519 is a recently disclosed Remote Code Execution (RCE) vulnerability in Zimbra Collaboration Suite (ZCS) affecting versions before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1.	ALERTS	VULNEREBILITY
27.11.24	INTERLOCK Ransomware	A new ransomware actor, going by the name INTERLOCK, has recently emerged in the threat landscape. This group appears to employ a double-extortion tactic. On successful compromise, encrypted files are appended with the ".interlock" extension.	ALERTS	RANSOM