ALERTS VIRUS

Bandook is a remote access trojan discovered way back in 2007. While it is quite an old malware family, new variants of Bandook reemerge in the wild with new distribution campaigns to this day. In one recent such run, Bandook has been spread with help of malicious PDF files leading to download of password-protected 7z archives that once extracted will deliver the Bandook payload. Upon infection the malware will execute commands received from the attacker-controlled C2 servers. The payload has also more capabilities allowing it to download additional arbitrary modules and executables.

DATE	NAME	CATEGORY	SUBCATE	INFO
1.11.24	New variant of FakeCall Android malware	ALERTS	VIRUS	A new variant of the Android malware called FakeCall has been observed in the wild. The attackers behind this malware employ voice phishing (vishing) techniques in order to trick victims into disclosing sensitive information such as credentials or banking information. While abusing the Android Accessibility Service, FakeCall grants the attackers a considerable remote control over the infected devices, allowing them to simulate user actions, intercept incoming or outgoing calls, manipulate the devices' camera, etc. FakeCall also allows for collection of user contacts, call logs or SMS messages from the compromised devices. The collected data is then forwarded to the C2 servers controlled by the attackers.
1.11.24	A possible Bumblebee Loader resurgence	ALERTS	VIRUS	A new campaign delivering the Bumblebee loader has been reported this month. Bumblebee is a highly sophisticated downloader variant discovered initially back in 2022. The malware has been spread across a multitude of malicious campaigns and used for the delivery and execution of miscellaneous payloads such as Cobalt Strike, ransomware, etc. Since the botnet disruption campaign called Operation Endgame, conducted by Europol in May 2024, Bumblebee has not been observed up until now. The new Bumblebee infection chain incorporates malicious .zip archives, PowerShell commands, .lnk and .msi files, all leading to payloads deployed in form of .dll binaries.
1.11.24	Malicious "Lounge Pass" app targets air travelers in India	ALERTS	VIRUS	A campaign involving a malicious Android app called "Lounge Pass" targeting air travelers at Indian airports has been observed. Distributed through fake domains, the app intercepts and forwards SMS messages from victims' devices to cybercriminals, leading to significant financial losses. The scammers exploited an exposed Firebase endpoint to store the stolen SMS messages. To prevent data theft, it’s recommended to download apps only from official stores and to refrain from granting SMS access to travel or lounge apps.
1.11.24	Adware Campaign uses Fake CAPTCHA to deliver Lumma and Amadey malware	ALERTS	VIRUS	Threat actors are increasingly using fake CAPTCHA as an initial attack vector. A recent adware campaign is targeting online users by presenting them with fake CAPTCHA or update prompts. Attackers are leveraging ad networks to redirect victims to compromised sites that host these social engineering lures. Once lured, victims are triggering PowerShell commands that deploy credential-stealing malware such as Lumma which harvests cryptocurrency wallets, passwords and browser data, or Amadey, which gathers credentials and can deploy Remcos RAT.
1.11.24	Rekoobe malware found potentially targeting TradingView users	ALERTS	VIRUS	An open directory has been discovered hosting Rekoobe malware, potentially aimed at targeting TradingView users along with other cyber espionage campaigns. Rekoobe is a versatile backdoor previously deployed by APT31 and other adversaries engaged in cyber espionage and data theft. Based partially on the publicly available Tiny SHell, the malware has evolved to incorporate enhanced encryption techniques and unique command-and-control configurations, making analysis and detection more difficult.
1.11.24	Daggerfly targets Taiwanese entities with new CloudScout Toolset	ALERTS	VIRUS	Researchers have recently uncovered a malicious campaign spreading the XWorm RAT trojan via fake emails posing as official communications from Namirial, a software and service company. The emails prompt users to open a password-protected PDF, and if it fails, directs them to a Dropbox link that downloads a ZIP file containing a URL that would connect to the attacker's servers and download additional malicious scripts, enabling control over the victim's machine.
27.10.24	Parano Stealer	ALERTS	VIRUS	Parano Stealer is another "run-of-the-mill" infostealer variant recently observed in the wild. This Python-based malware has functionality to collect and exfiltrate various information from the compromised endpoints, including: credentials, cookies, miscellaneous data stored in web browsers, cryptocurrency wallets, system information or data from various 3rd party applications like Steam, Telegram or Discord.
27.10.24	Liberium RAT malware	ALERTS	VIRUS	Liberium RAT (also known as ShadowRoot) is a malware variant recently advertised for sale on hacking forums. The malware has the capabilities allowing the attackers remote access to the vulnerable endpoints, file management operations, registry manipulation as well as theft of system related information and other confidential data.
27.10.24	DarkComet Backdoor	ALERTS	VIRUS	DarkComet is a powerful Remote Access Trojan (RAT) that remains a significant threat because of its stealthy operations and comprehensive functionality. It enables attackers to remotely control infected devices, exfiltrate sensitive data, and deploy further malware. It can evade detection by altering file attributes, manipulating registry keys and escalating privileges. Additionally, it communicates with a command-and-control (C2) server to carry out various commands including capturing keystrokes and controlling display devices.
27.10.24	Threat actors distribute WarmCookie malware via various campaigns	ALERTS	VIRUS	WarmCookie is malware that has been observed being distributed through various campaigns, including malicious emails. This malware provides initial access to a compromised victim and is used to establish persistence. Additional functionality associated with WarmCookie includes remote command execution, file system manipulation, and payload delivery, among others. A recent report by Cisco Talos provides a technical analysis as well as data to support attribution of the malware to the threat actor group TA866.
27.10.24	Phemedrone Stealer	ALERTS	VIRUS	Phemedrone is an open-source infostealer variant observed being distributed in the wild this year. The malware is written in C# and has the functionality to collect and exfiltrate various sensitive information such as login credentials, data stored in browsers, cookies, credit card information, cryptocurrency wallets, files stored in "My Documents" folders or data from other 3rd party apps such as Steam, Discord or Telegram.
27.10.24	Phemedrone Stealer	ALERTS	VIRUS	Earlier this year, Akira developed a new version of its ransomware encryptor and has since been observed using another novel iteration of the encryptor that targets both Windows and Linux systems. Akira typically employs a double-extortion tactic, exfiltrating critical data before encrypting the victim's systems. However, starting in early 2024, the group appears to be shifting away from encryption tactics, focusing solely on data exfiltration.
27.10.24	Ghostpulse Malware: Shifting tactics from PNGs to Pixel values	ALERTS	VIRUS	According to recent reports, Ghostpulse malware has evolved its tactics by shifting from hiding its encrypted configuration and payload in the IDAT chunk of PNG files, to embedding it directly within the pixel values themselves to evade detection. In recent campaigns, attackers have employed social engineering techniques such as CAPTCHA validations to deceive users which ultimately triggers malicious commands via Windows keyboard shortcuts.
27.10.24	Threat actors abusing open-source phishing framework to deliver RATS	ALERTS	VIRUS	A recent report by (CTA) member Cisco Talos has recently disclosed a new phishing campaign abusing the open-source phishing readiness assessment framework named 'Gophish' to deploy one of two attack chains. The first uses Pidief infected Office docs to deploy a newly discovered PowerShell RAT dubbed 'PowerRAT' while the second employs malicious HTML files and GOLoader to deploy DCRAT.
27.10.24	Lumma Stealer delivered via Fake CAPTCHA	ALERTS	VIRUS	Researchers are monitoring an ongoing phishing campaign where attackers appear to have upped their tactics from traditional phishing to incorporating the use of fake CAPTCHA pages and exploiting legitimate software. The intention being to eventually lure users into executing a payload called Lumma Stealer. This infostealing malware is a MaaS (Malware-as-a-Service) variant that steals sensitive data such as passwords and cryptocurrency information.
27.10.24	Emerging Stealer Variants: Divulge, DedSec, and Duck Stealers	ALERTS	VIRUS	Multiple stealers have been observed being advertised on hacker forums, GitHub, and Telegram, all developed and promoted by the same entity. Notable variants include Divulge Stealer (a copy of Umbral), DedSec Stealer (based on Doenerium), and Duck Stealer (a derivative of AZStealer). These variants primarily target Discord data, browser information, cryptocurrency wallets and employ anti-analysis techniques to evade detection and operate effectively in the background.
27.10.24	TrickMo targeting Android users with fake lock-screen	ALERTS	VIRUS	Security researchers have recently disclosed a new variant of TrickMo, a mobile banking trojan that targets Android and iOS users. This new variant comes with some new functionality in addition to the existing capabilities, such as screen recording, remote control, and permissions granting. Now TrickMo includes the ability to steal screen lock codes and unique device identifiers from infected devices. When the malicious app is run it will display a full screen webpage designed to mimic the standard lock-screen, and if the user inputs their lock-screen code it will be exfiltrated via PHP to the attackers for later use.
27.10.24	Meduza Stealer	ALERTS	VIRUS	Researchers recently published a warning about the Telegram account '@reserveplusbot', linked to a specific application and serving as a contact for technical support. The suspicious messages urged users to install a ZIP file that contains malware. The executable file inside is a variant of Meduza Stealer, which steals files and evades detection by modifying Microsoft Defender settings.
27.10.24	New Linux variant of FASTCash malware discovered	ALERTS	VIRUS	A new Linux variant of the FASTCash malware (a tool which CISA has attributed to North Korea) has been discovered. FASTCash is malware that is implanted within compromised networks and leveraged to perform unauthorized banking transactions. This occurs by way of intercepting transaction messages and generating fraudulent responses in return, thereby defrauding the ATM/PoS card user.
27.10.24	ThunderKitty malware	ALERTS	VIRUS	ThunderKitty is a GO-based open-source infostealer variant seen in the wild. The malware has the functionality to collect miscellaneous information from infected machines including banking details, Discord session tokens, cookies, browser history and other data stored in the browsers, etc. ThunderKitty implements several evasion and anti-analysis techniques, VM environment and Debugger presence detection as well as persistence mechanisms.
27.10.24	MiyaRat: The latest tool from the Bitter APT group	ALERTS	VIRUS	The Bitter APT group, recognized for its sophisticated cyber espionage activities targeting East and South Asia, has been observed deploying a new malware known as MiyaRat. This malware is capable of collecting system information, capturing screenshots, performing file uploads and downloads, and exfiltrating data to its command-and-control (C2) server, where it waits for further instructions.
27.10.24	Abuse of Code-Signing Certificates in Lumma Stealer deployment via HijackLoader	ALERTS	VIRUS	A malware campaign has been observed deploying Lumma Stealer using HijackLoader. The attack vector employs a "fake CAPTCHA" to lure users into executing a PowerShell payload that downloads a ZIP archive containing either a DLL or a signed HijackLoader binary. This binary is then loaded via DLL sideloading, ultimately installing Lumma Stealer. Multiple code-signing certificates were abused to sign the malware, obtained from various issuing certificate authorities that are largely automated, requiring only a valid company registration number and a contact person.
27.10.24	CoreWarrior Malware	ALERTS	VIRUS	Researchers investigated a malware named CoreWarrior and found that this variant aggressively spreads by creating numerous copies, connecting to various IP addresses, opening multiple backdoor access points, and intercepting Windows UI elements for surveillance purposes.
27.10.24	Core Werewolf utilizes AutoIt loader and Telegram for Cyber attacks	ALERTS	VIRUS	The Core Werewolf threat actor group, which primarily targets Russia's defense industry and critical infrastructure, has been observed using new tools including an AutoIt loader and delivering malicious files via Telegram in addition to email. As part of their attack chain, they utilize RAR archives containing SFX executables that deploy obfuscated AutoIt scripts, legitimate AutoIt interpreters, and decoy PDF documents. The loader collects system information, encrypts and transfers files, and communicates with a command-and-control server for data exfiltration. To evade detection, the attackers employ deceptive file names that correspond to the content of the decoy documents.
27.10.24	ErrorFather Android Trojan	ALERTS	VIRUS	Cerberus Android banking trojan came to light in 2019, and this variant utilizes a multi-stage dropper to deploy its payload and can execute financial fraud through remote attacks, keylogging, and overlay tactics. The emergence of ErrorFather highlights the persistent danger of repurposed malware, as cybercriminals continue to exploit leaked source code years after the original Cerberus malware was discovered.
27.10.24	Demodex targeting American telecommunications	ALERTS	VIRUS	APT group 'Squash' has been reported to be utilizing Demodex to target American telecommunications providers. Demodex, a rootkit, is used to establish persistence and then files with fake file headers (PNG, JPEG and WAV have been observed) are used to help evade detection and utilized to establish C2 communications.
27.10.24	New Pronsis Loader malware leveraged for Lumma Stealer and Latrodectus delivery	ALERTS	VIRUS	Pronsis Loader is a new malware variant leveraged recently in campaigns delivering Lumma Stealer and Latrodectus payloads. The malware utilizes executables compiled in JPHP programming language, which is a Java implementation of PHP. Pronsis also uses Nullsoft Scriptable Install System (NSIS) for the deployments in the observed campaigns. The malware implements certain detection evasion techniques such as exclusion of the user's profile directory path from Windows Defender scanning.
27.10.24	LemonDuck: The evolving Multi-Platform cryptomining malware	ALERTS	VIRUS	LemonDuck, a well-known cryptomining malware, has evolved into a multi-platform threat and has been observed exploiting SMB vulnerabilities, particularly EternalBlue, as part of its attack vector to gain network access. The malware employs techniques such as brute-force attacks, creating hidden administrative shares, and executing malicious actions via batch files and PowerShell scripts. LemonDuck has the capability to create scheduled tasks, disable Windows Defender, and utilize anti-detection mechanisms for persistence. It disguises itself as legitimate system services, manipulates firewall settings, in addition to using Mimikatz for credential theft.
27.10.24	Havoc Framework	ALERTS	VIRUS	Researchers have found that cybercriminals are increasingly leveraging pen testing tools like the Havoc framework to evade security systems. This tool is less recognized than others, such as Cobalt Strike or Metasploit, which makes it harder to spot. The Mysterious Werewolf group is using strategies similar to the Mythic framework, and phishing emails that mimic legitimate organizations remain a common tactic for gaining unauthorized access.
27.10.24	CleanUpLoader Leveraged By Rhysida	ALERTS	VIRUS	A recent report shed light on a loader/backdoor known as "CleanUpLoader," used by the double-extortion ransomware actor "Rhysida" as an initial vector of infection. It is typically disguised as software installers like Microsoft Teams or Google Chrome. The loader facilitates communication with multiple command-and-control (C2) servers, allowing Rhysida to establish persistence and perform data exfiltration.
27.10.24	Lua-based malware variants target the educational sector	ALERTS	VIRUS	There has been a recent surge in Lua-based malware targeting students, specifically targeted attacks capitalizing on popular games within the student gamer community who are searching for gaming cheats. Fake game cheats are being leveraged by threat actors to trick users into downloading this malware. Lua-based malware is capable of establishing persistence on infected systems, exfiltrating sensitive harvested credential information, and delivering additional payloads.
27.10.24	Horus Protector	ALERTS	VIRUS	A new malware distribution service has been uncovered called Horus Protector that claims to be a Fully Undetectable (FUD) crypter and distributes various malware families, including AgentTesla, Remcos, Snake, and NjRat. The service distributes malware using a .zip file that contains a VBE script and gathers information from users' machines to transmit to its server.
27.10.24	A Recent PhantomLoader Campaign	ALERTS	VIRUS	PhantomLoader is a malware that disguises itself as a legitimate 32-bit DLL for a certain antivirus software and was recently found posing as “PatchUp.exe,” a genuine component of the software. The malicious loader was observed using binary patching and self-modifying techniques to load rust-based malware dubbed SSLoad into memory.
27.10.24	Malvertising campaign leads to malicious Windows and Mac payloads	ALERTS	VIRUS	A recently published report identified a campaign whereby advertisers are pushing ads for utility software, such as Slack or Notion, which lead to downloads of malicious payloads. The advertisers registered under existing businesses and distributed ads that target both Windows and Mac users. After multiple redirects, the users are provided downloads of stealer type malware which are masquerading as the advertised software.
27.10.24	Yunit Stealer - an infostealing malware with geofencing capabilities	ALERTS	VIRUS	Yunit Stealer is a malware variant recently distributed in the wild. Yunit has extensive infostealing capabilities including theft and exfiltration of credentials, credit card data, cryptocurrency wallets, cookies, auto-fill data and others. The collected information is exfiltrated via Discord or Telegram webhooks back to the attackers. Yunit employs various persistence techniques, obfuscation, defense evasion as well as some geofencing techniques ensuring only victims from targeted geographic locations will get infected with the malware.
27.10.24	Vilsa Stealer	ALERTS	VIRUS	Vilsa Stealer is a new infostealer malware variant identified in the wild. The malware has the functionality to exfiltrate miscellaneous confidential data from the infected machine including: browser data, credentials, autofill data, cookies, banking information, cryptocurrency wallets, Discord tokens and Telegram data, among others. The extracted information is uploaded back to the remote attackers by leveraging GoFile API. Vilsa Stealer also employs some anti-analysis and anti-VM capabilities meant to make the detection and protection against this infostealer more difficult.
27.10.24	Falcon Keylogger	ALERTS	VIRUS	Falcon is a keylogger variant recently active in the wild. Older samples of this malware date back even to 2019 while the latest observed are from just last month. Falcon has the functionality to record keystrokes on the infected machine, collect system information, screenshots, etc. The collected data is consecutively exfiltrated to the C2 servers controlled by the attackers. Keyloggers such as Falcon can be used by threat actors for the purpose of gaining access to confidential information including credentials, banking data and others.
27.10.24	Nunu Stealer malware	ALERTS	VIRUS	Nunu Stealer is a recently discovered Python-based infostealing malware variant which is based off an older Akira Stealer strain. The functionality includes exfiltration of various confidential information such as banking details, credit card data, credentials, autofill data stored in browsers, cookies, 3rd app session data, Discord tokens, cryptocurrency wallets and more. Nunu can be potentially used by attackers to compromise various user accounts and leverage those for further intrusions.
27.10.24	SmartLoader Delivering Lumma Stealer	ALERTS	VIRUS	SmartLoader has been traced back to July 2024, involving a private GitHub account called "user-attachments." It starts with a zip archive containing four files: compiler.exe, conf.txt, Launcher.bat, and lua51.dll. The user runs Launcher.bat, which executes compiler.exe with conf.txt, triggering SmartLoader and deploying Lumma Stealer. This infostealer written in C is known to steal data stored in the system browsers as well any present cryptocurrency wallets.