Malware 2023

Malware - 2023(634)

DATE	NAME		CATEGORY	SUBC
9.1.24	Lumma Stealer	Deceptive Cracked Software Spreads Lumma Variant on YouTube	Malware	Stealer
9.1.24	Silver RAT	A GAMER TURNED MALWARE DEVELOPER : DIVING INTO SILVERRAT AND IT’S SYRIAN ROOTS	Malware	RAT
6.1.24	SpectralBlur	Today will be a quick post on a TA444 (aka Sapphire Sleet, BLUENOROFF, STARDUST CHOLLIMA) Macho family tracked as SpectralBlur we found in August, and how finding it led us to stumble upon an early iteration of KANDYKORN (aka SockRacket). Please read Elastic’s EXCELLENT piece on that family.	Malware	macOS
6.1.24	No-Justice	Wiper attack on Albania by Iranian APT	Malware	Wipper
5.1.24	Bandook RAT	Bandook - A Persistent Threat That Keeps Evolving	Malware	RAT
5.1.24	Remcos RAT	Ukraine Targeted by UAC-0050 Using Remcos RAT Pipe Method for Evasion	Malware	RAT
3.1.24	WhiteSnake Stealer	WhiteSnake Stealer malware sample on MalwareBazaar	Malware	Stealer
3.1.24	RisePro	RisePro is a stealer that is spread through downloaders like win.privateloader. Once executed on a system, the malware can steal credit card information, passwords, and personal data.	Malware	Stealer
1.1.24	Medusa Stealer	On Christmas Eve, Resecurity's HUNTER (HUMINT) spotted the author of perspective password stealer Meduza has released a new version (2.2).	Malware	Stealer
1.1.24	Jinx	Jinx – Malware 2.0 We know it’s big, we measured it!	Malware	Stealer
29.12.23	TinyNuke	TinyNuke (aka Nuclear Bot) is a fully-fledged banking trojan including HiddenDesktop/VNC server and a reverse socks4 server. It was for sale on underground marketplaces for $2500 in 2016.	Malware	Banking
29.12.23	Appleseed	Kimsuky Attack Group Abusing Chrome Remote Desktop	Malware	Loader
29.12.23	HijackLoader	According to Rapid7, this is a loader first spotted in July 2023. It implements several evasion techniques including Process Doppelgänging, DLL Search Order Hijacking, and Heaven's Gate. It has been observed to store its malicious payload in the IDAT chunk of PNG file format.	Malware	Loader
29.12.23	FakeBat	FakeBat, známý také jako EugenLoader, je nechvalně známý softwarový nakladač a distributor, který se dostal do popředí v oblasti kybernetických hrozeb. FakeBat je spojován s podvodnými reklamními kampaněmi nejdříve od listopadu 2022.	Malware	Loader
29.12.23	DarkGate	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts. New versions of DarkGate have been advertised on a Russian language eCrime forum since May 2023.	Malware	Download
29.12.23	SectopRAT	SectopRAT, aka ArechClient2, is a .NET RAT with numerous capabilities including multiple stealth functions. Arechclient2 can profile victim systems, steal information such as browser and crypto-wallet data, and launch a hidden secondary desktop to control browser sessions. Additionally, it has several anti-VM and anti-emulator capabilities.	Malware	RAT
29.12.23	FlawedGrace	According to ProofPoint, FlawedGrace is written in C++ and can be categorized as a Remote Access Trojan (RAT). It seems to have been developed in the second half of 2017 mainly.	Malware	RAT
29.12.23	BATLOADER	According to PCrisk, BATLOADER is part of the infection chain where it is used to perform the initial compromise. This malware is used to execute payloads like Ursnif. Our team has discovered BATLOADER after executing installers for legitimate software (such as Zoom, TeamViewer Visual Studio) bundled with this malware. We have found those installers on compromised websites.	Malware	Loader
28.12.23	Trojan Dropper Remcos	This is not being detected by ESET , but ESET is picking it up through Advanced Memory Scanner after being ran because it came through Skype as a 1.5mb shortcut pif , i kept a copy of it inside a passworded archieve , I sent the shortcut also for Analysis through right click and submit for analysis	Malware	Dropper
28.12.23	RecordBreaker	This malware is a successor to Raccoon Stealer (also referred to as Raccoon Stealer 2.0), which is however a full rewrite in C/C++.	Malware	Stealer
28.12.23	Rescoms	This threat can give a malicious hacker unauthorized access and control of your PC.	Malware	Backdoor
27.12.23	SALTWATER	According to Mandiant, SALTWATER is a module for the Barracuda SMTP daemon (bsmtpd) that has backdoor functionality. SALTWATER can upload or download arbitrary files, execute commands, and has proxy and tunneling capabilities.	Malware	Linux
27.12.23	SEASPY	According to CISA, this malware is a persistent backdoor that masquerades as a legitimate Barracuda Networks service. The malware is designed to listen to commands received from the Threat Actor’s Command-and-Control through TCP packets	Malware	Linux
27.12.23	Android/Xamalicious	Stealth Backdoor “Android/Xamalicious” Actively Infecting Devices	Malware	Android
26.12.23	Carbanak	MyCERT states that Carbanak is a remote backdoor designed for espionage, data exfiltration, and to remote control.	Malware	Banking
24.12.23	IceXLoader	IceXLoader is a commercial malware used to download and deploy additional malware on infected machines. The latest version is written in Nim, a relatively new language utilized by threat actors the past two years, most notably by the NimzaLoader variant of BazarLoader used by the TrickBot group.	Malware	Loader
24.12.23	BazarNimrod	A rewrite of Bazarloader in the Nim programming language.	Malware	RAT
24.12.23	LONEPAGE	UAC-0099 Exploits WinRAR Vulnerability to Launch LONEPAGE Malware Attacks on Ukrainian Firms	Malware	VBS
24.12.23	FalseFont	Microsoft: Hackers target defense firms with new FalseFont malware	Malware	Backdoor
24.12.23	Intellexa	Intellexa and Cytrox: From fixer-upper to Intel Agency-grade spyware	Malware	Spyware
24.12.23	Chameleon	Android Banking Trojan Chameleon can now bypass any Biometric Authentication	Malware	Android
24.12.23	Agent Tesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	Malware	Stealer
21.12.23	JaskaGO	Behind the scenes: JaskaGO’s coordinated strike on macOS and Windows	Malware	macOS
19.12.23	Pikabot	Discovered in early 2023, the modular Pikabot malware trojan can execute a diverse range of commands.	Malware	Trojan
19.12.23	SLUB	Who is the Threat Actor Behind Operation Earth Kitsune?	Malware	Backdoor
19.12.23	Rhadamanthys	RHADAMANTHYS V0.5.0 – A DEEP DIVE INTO THE STEALER’S COMPONENTS	Malware	Stealer
19.12.23	QakBot	#Qakbot is back! The new version is 64-bit, uses AES for network encryption, and sends POST requests to the path /teorema505.	Malware	Stealer
15.12.23	NKAbuse	Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol	Malware	Backdoor
15.12.23	W4SP Stealer	The final payload is a Trojan written in Python and obfuscated with the same obfuscator as the downloader. The malware is dubbed “W4SP Stealer” by its author in the code.	Malware	Stealer
14.12.23	OilRig	OilRig’s persistent attacks using cloud service-powered downloaders	Malware	Downaloader
14.12.23	Micropsia	This malware written in Delphi is an information stealing malware family dubbed "MICROPSIA". It has s wide range of data theft functionality built in.	Malware	Stealer
14.12.23	DarkCrystalRAT	DCRat is a typical RAT that has been around since at least June 2019.	Malware	RAT
14.12.23	VaporRage	According to Mandiant, VaporRage or BOOMMIC, is a shellcode downloader written in C that communicates over HTTPS.	Malware	Downaloader
14.12.23	GraphicalProton	PANW Unit 42 describes this malware as capable of up and downloading files as well as loading additional shellcode payloads into selected target processes. It uses the Microsoft Graph API and Dropbox API as C&C channel.	Malware	Downaloader
14.12.23	More_eggs	BazarCall Attack Leverages Google Forms to Increase Perceived Credibility	Malware	JS
13.12.23	Meduza Stealer	UAC-0050 mass cyberattack using RemcosRAT/MeduzaStealer against Ukraine and Poland (CERT-UA#8218)	Malware	Stealer
13.12.23	HeadLace	ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware	Malware	Backdoor
12.12.23	MrAnon Stealer	MrAnon Stealer Spreads via Email with Fake Hotel Booking PDF	Malware	Stealer
11.12.23	KEYPLUG	With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets	Malware	Linux
11.12.23	TrickMo’s	TrickMo’s Return: Banking Trojan Resurgence With New Features	Malware	Banking
11.12.23	SpyLoan	Beware of predatory fin(tech): Loan sharks use Android apps to reach new depths	Malware	Android
9.12.23	GULOADER	Getting gooey with GULOADER: deobfuscating the downloader	Malware	Downloader
9.12.23	Trojan-Proxy	New macOS Trojan-Proxy piggybacking on cracked software	Malware	Trojan Proxy
7.12.23	Krasue	Curse of the Krasue: New Linux Remote Access Trojan targets Thailand	Malware	RAT
5.12.23	P2Pinfect	P2Pinfect - New Variant Targets MIPS Devices	Malware	Botnet
2.12.23	Agent Racoon	Organizations in the Middle East, Africa, and the U.S. have been targeted by an unknown threat actor to distribute a new backdoor called Agent Racoon.	Malware	Backdoor
1.12.23	FjordPhantom	Promon discovers new Android banking malware, “FjordPhantom”	Malware	Android
1.12.23	SugarGh0st RAT	New SugarGh0st RAT targets Uzbekistan government and South Korea	Malware	RAT
1.12.23	Ghost RAT	According to Security Ninja, Gh0st RAT (Remote Access Terminal) is a trojan “Remote Access Tool” used on Windows platforms, and has been used to hack into some of the most sensitive computer networks on Earth.	Malware	RAT
29.11.23	GCleaner	Deep Analysis of GCleaner	Malware	Malware
29.11.23	Fabookie	Loader Galore - TaskLoader at the start of a Pay-per-Install Infection Chain	Malware	Loader
29.11.23	Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums.	Malware	Backdoor
29.11.23	PrivateLoader	According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads.	Malware	Loader
29.11.23	SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware.	Malware	Backdoor
28.11.23	KANDYKORN	Elastic catches DPRK passing out KANDYKORN	Malware	osx
28.11.23	RustBucket	BlueNoroff \| How DPRK’s macOS RustBucket Seeks to Evade Analysis and Detection	Malware	masOS
28.11.23	Tiger RAT	This is third stage backdoor mentioned in the Kaspersky blog, "Andariel evolves to target South Korea with ransomware". The third stage payload was created via the second stage payload, is interactively executed in the operation and exists in both x64 and x86 versions.	Malware	RAT
25.11.23	SYSJOKER	ISRAEL-HAMAS WAR SPOTLIGHT: SHAKING THE RUST OFF SYSJOKER	Malware	Backdoor
25.11.23	Konni	Konni is a remote administration tool, observed in the wild since early 2014.	Malware	RAT
25.11.23	WailingCrab	Stealthy WailingCrab Malware misuses MQTT Messaging Protocol	Malware	Loader
22.11.23	Atomic Stealer	Atomic Stealer distributed to Mac users via fake browser updates	Malware	Mac
22.11.23	Agent Tesla	New "Agent Tesla" Variant: Unusual "ZPAQ" Archive Format Delivers Malware	Malware	Stealer
22.11.23	Kinsing	CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits	Malware	Linux
21.11.23	Enchant	Enchant malware uses the Accessibility Service feature to target specific cryptocurrency wallets, including imToken, OKX, Bitpie Wallet, and TokenPocket wallet.	Malware	Android
21.11.23	TONESHELL	My Tea’s not cold. An overview of China’s cyber threat	Malware	Backdoor
21.11.23	BLISTER	Popping Blisters for research: An overview of past payloads and exploring recent developments	Malware	Dropper
21.11.23	IDAT Loader	According to Rapid7, this is a loader first spotted in July 2023. It implements several evasion techniques including Process Doppelgänging, DLL Search Order Hijacking, and Heaven's Gate. IDAT loader got its name as the threat actor stores the malicious payload in the IDAT chunk of PNG file format.	Malware	Loader
21.11.23	QakBot	QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.	Malware	Banking
21.11.23	Pikabot	Introducing Pikabot, an emerging malware family that comprises a downloader/installer, a loader, and a core backdoor component. Despite being in the early stages of development, it already demonstrates advanced techniques in evasion, injection, and anti-analysis.	Malware	Downloader
21.11.23	DarkGate	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation.	Malware	Downloader
20.11.23	Sayler RAT	New Java-Based Sayler RAT Targets Polish Speaking Users	Malware	RAT
20.11.23	Predator AI	Predator AI \| ChatGPT-Powered Infostealer Takes Aim at Cloud Platforms	Malware	Infosteler
20.11.23	Trap Stealer	New Open-Source ‘Trap Stealer’ Pilfers Data in just 6 Seconds	Malware	Stealer
20.11.23	BbyStealer	BbyStealer Malware Resurfaces, Sets Sights on VPN Users	Malware	Stealer
20.11.23	LummaC2	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022	Malware	Stealer
18.11.23	SmokeLoader	Most of the group’s Phobos variants are distributed by SmokeLoader, a backdoor trojan. This commodity loader typically drops or downloads additional payloads when deployed.	Malware	Backdoor
18.11.23	LitterDrifter	MALWARE SPOTLIGHT – INTO THE TRASH: ANALYZING LITTERDRIFTER	Malware	Worm
17.11.23	AveMaria	Information stealer which uses AutoIT for wrapping.	Malware	RAT
16.11.23	SparkRAT	BlueShell malware used in APT attacks targeting Korea and Thailand	Malware	RAT
14.11.23	XorDdos	Linux DDoS C&C Malware	Malware	Linux
14.11.23	IronWind	TA402 Uses Complex IronWind Infection Chains to Target Middle East-Based Government Entities	Malware	Downloader
14.11.23	Ducktail	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	Malware	Stealer
13.11.23	BiBi-Linux	According to Security Joes, this malware is an x64 ELF executable, lacking obfuscation or protective measures. It allows attackers to specify target folders and can potentially destroy an entire operating system if run with root permissions.	Malware	Wiper
11.11.23	CaddyWiper	CaddyWiper is another destructive malware believed to be deployed to target Ukraine.	Malware	Wiper
11.11.23	Effluence	Detecting “Effluence”, An Unauthenticated Confluence Web Shell	Malware	Backdoor
11.11.23	Kamran	Unlucky Kamran: Android malware spying on Urdu-speaking residents of Gilgit-Baltistan	Malware	Android
11.11.23	FakeBat	FakeBat (also known as EugenLoader) is a malicious software loader and dropper that has emerged as a significant player in the world of cyber threats. FakeBat has been associated with malvertising campaigns since at least November 2022.	Malware	Loader
9.11.23	BlazeStealer	In the realm of software development, open-source tools and packages play a pivotal role in simplifying tasks and accelerating development processes. Yet, as the community grows, so does the number of bad actors looking to exploit it. A recent example involves developers being targeted by seemingly legitimate Python obfuscation packages that harbor malicious code.	Malware	Python
9.11.23	ObjCShellz	Jamf Threat Labs discovered a new later-stage malware variant from BlueNoroff that shares characteristics with their RustBucket campaign. Read this blog to learn more about this malware and view the indicators of compromise.	Malware	MacOS
9.11.23	GootBot	GootBot – Gootloader’s new approach to post-exploitation	Malware	Bot
9.11.23	GootLoader	According to PCrisk, they discovered GootLoader malware while examining legitimate but compromised websites (mainly websites managed using WordPress). It was found that GootLoader is used to infect computers with additional malware. Cybercriminals using GootLoader seek to trick users into unknowingly downloading and executing the malware by disguising it as a document or other file.	Malware	JS
9.11.23	Action RAT	Double Action, Triple Infection, and a New RAT: SideCopy’s Persistent Targeting of Indian Defence	Malware	RAT
9.11.23	AllaKore	AllaKore is a simple Remote Access Tool written in Delphi, first observed in 2015 but still in early stages of development. It implements the RFB protocol which uses frame buffers and thus is able to send back only the changes of screen frames to the controller, speeding up the transport and visualization control.	Malware	RAT
7.11.23	Jupyter	An updated version of an information stealer malware known as Jupyter has resurfaced with "simple yet impactful changes" that aim to stealthily establish a persistent foothold on compromised systems.	Malware	Infostealer
6.11.23	SecuriDropper	Droppers are a specific category of malware whose main purpose is to install a payload on an infected device.	Malware	Android
6.11.23	Google Calendar RAT	The Rising Threat of Covert Cyber Attacks through Google Calendar	Malware	RAT
4.11.23	StripedFly	It’s just another cryptocurrency miner… Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows.	Malware	Crypto
3.11.23	NodeStealer	NodeStealer attacks on Facebook take a provocative turn – threat actors deploy malvertising campaigns to hijack users’ accounts	Malware	Stealer
3.11.23	CanesSpy	Cybersecurity researchers have unearthed a number of WhatsApp mods for Android that come fitted with a spyware module dubbed CanesSpy.	Malware	Spyware
2.11.23	Mozi	P2P Botnets: Review - Status - Continuous Monitoring	Malware	Linux
1.11.23	WINTAPIX	WINTAPIX: A New Kernel Driver Targeting Countries in The Middle East	Malware	Backdoor
1.11.23	LIONTAIL	FROM ALBANIA TO THE MIDDLE EAST: THE SCARRED MANTICORE IS LISTENING	Malware	Steal
1.11.23	RustBucket	Bluenoroff’s RustBucket campaign	Malware	Trojan
1.11.23	RustBucket	BlueNoroff \| How DPRK’s macOS RustBucket Seeks to Evade Analysis and Detection	Malware	OSX
1.11.23	KANDYKORN	Elastic Security Labs exposes an attempt by the DPRK to infect blockchain engineers with novel macOS malware.	Malware	macOS
1.11.23	Kazuar	Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)	Malware	Backdoor
1.11.23	AridViper	Arid Viper disguising mobile spyware as updates for non-malicious Android applications	Malware	Android
28.10.23	StripedFly	It’s just another cryptocurrency miner… Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows.	Malware	Linux
28.10.23	LPEClient	LPEClient is an HTTP(S) downloader that expects two command line parameters: an encrypted string containing two URLs (a primary and a secondary C&C server), and the path on the victim's file system to store the downloaded payload.	Malware	Stealer
28.10.23	SIGNBT	The exploitation led to the deployment of the SIGNBT malware along with shellcode used for injecting the payload into memory for stealthy execution.	Malware	Inject
27.10.23	IMAPLoader	Yellow Liderc ships its scripts and delivers IMAPLoader malware	Malware	Loader
27.10.23	Python-based RAT	Securonix Security Advisory: Python-Based PY#RATION Attack Campaign Leverages Fernet Encryption and Websockets to Avoid Detection	Malware	RAT
27.10.23	Powershell-RAT	In this course, you will learn exfiltration over alternative protocol: exfiltration over unencrypted/obfuscated non-C2 protocol using Powershell RAT.	Malware	RAT
27.10.23	Trojan.Injector	Trojan.Injector is Malwarebytes' generic detection name for malware that injects itself into other processes or files. This is an effective method to hide from the average user as they will only see the regular active processes.	Malware	Injector
27.10.23	GoPIX	Stealer for PIX payment system, new Lumar stealer and Rhysida ransomware	Malware	Stealer
21.10.23	LOBSHOT	According to PCrisk, LOBSHOT is a type of malware with a feature called hVNC (Hidden Virtual Network Computing) that allows attackers to access a victim's computer without being noticed.	Malware	Stealer
21.10.23	DarkGate	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation.	Malware	Loader
21.10.23	DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	Malware	Stealer
20.10.23	ExelaStealer	Another InfoStealer Enters the Field, ExelaStealer	Malware	Stealer
20.10.23	Scout	A downloader that uses Windows messages to control its execution flow.	Malware	Downloader
20.10.23	Volgmer	Analysis Report on Lazarus Threat Group’s Volgmer and Scout Malware	Malware	Backdoor
20.10.23	RokRAT	It is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents.	Malware	RAT
20.10.23	Bankshot	Following the Lazarus group by tracking DeathNote campaign	Malware	Backdoor
20.10.23	LPEClient	LPEClient is an HTTP(S) downloader that expects two command line parameters: an encrypted string containing two URLs (a primary and a secondary C&C server), and the path on the victim's file system to store the downloaded payload.	Malware	Downloader
19.10.23	Venom RAT	VenomRAT - new, hackforums grade, reincarnation of QuassarRAT	Malware	RAT
19.10.23	Typhon Stealer	According to PCrisk, Typhon is a stealer-type malware written in the C# programming language.	Malware	Stealer
19.10.23	Stealerium	According to SecurityScorecard, Stealerium is an open-source stealer available on GitHub. The malware steals information from browsers, cryptocurrency wallets, and applications such as Discord, Pidgin, Outlook, Telegram, Skype, Element, Signal, Tox, Steam, Minecraft, and VPN clients.	Malware	Stealer
17.10.23	Poseidon	Part of Mythic C2, written in Golang.	Malware	Linux
17.10.23	Poseidon	Part of Mythic C2, written in Golang.	Malware	OSX
16.10.23	SpyNote	The malware has been released on github at https://github.com/EVLF/Cypher-Rat-Source-Code	Malware	Android
16.10.23	Hook	According to ThreatFabric, this is a malware family based on apk.ermac. The name hook is the self-advertised named by its vendor DukeEugene.	Malware	RAT
16.10.23	HijackLoader	HijackLoader Targets Hotels: A Technical Analysis	Malware	Loader
16.10.23	ClearFake	For Microsoft Edge’s visitors, ClearFake delivered a malicious Windows Application Packaging Project (APPX file) from Dropbox.	Malware	APPX file
16.10.23	IDAT Loader	Fake Update Utilizes New IDAT Loader To Execute StealC and Lumma Infostealers	Malware	Loader
14.10.23	ROMCOM RAT	Unit 42 observed threat actor Tropical Scorpius using this RAT in operations where also Cuba ransomware was deployed.	Malware	RAT
13.10.23	DarkGate	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation.	Malware	Stealer
13.10.23	SeroXen RAT	Phylum Discovers SeroXen RAT in Typosquatted NuGet Package	Malware	RAT
13.10.23	RecordBreaker	This malware is a successor to Raccoon Stealer (also referred to as Raccoon Stealer 2.0), which is however a full rewrite in C/C++.	Malware	Stealer
13.10.23	Lumma Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022.	Malware	Stealer
13.10.23	PerlBot	ShellBot DDoS Malware Installed Through Hexadecimal Notation Addresses	Malware	Linux
12.10.23	BlueShell	According to AhnLab, BlueShell is a backdoor malware developed in Go language, published on Github, and it supports Windows, Linux, and Mac operating systems.	Malware	Backdoor
12.10.23	Balada Injector	Balada Injector Targets Unpatched tagDiv Plugin, Newspaper Theme & WordPress Admins	Malware	Injector
10.10.23	PEACHPIT	PEACHPIT is an ad fraud branch that comes from the root of the BADBOX tree.	Malware	MultiOS
8.10.23	HyperBro	HyperBro is a RAT that has been observed to target primarily within the gambling industries, though it has been spotted in other places as well.	Malware	RAT
5.10.23	Lu0Bot	According to PCrisk, Lu0bot es un software malicioso. El malware es ligero, por lo que su uso de los recursos del sistema es bajo. Esto complica la detección de Lu0bot, ya que no causa síntomas significativos, como una grave disminución del rendimiento del sistema.	Malware	Bot
5.10.23	DinodasRAT	DinodasRAT uses TEA to decrypt some of its strings, as well as to encrypt/decrypt data sent to, or received from, its C&C server.	Malware	RAT
5.10.23	GoldDigger	Let's dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix	Malware	Android
5.10.23	lightSpy	iOS exploit chain deploys LightSpy feature-rich malware	Malware	iOS
5.10.23	WyrmSpy	Lookout Attributes Advanced Android Surveillanceware to Chinese Espionage Group APT41	Malware	Android
5.10.23	DragonEgg	Lookout Attributes Advanced Android Surveillanceware to Chinese Espionage Group APT41	Malware	Android
5.10.23	SeroXen	SeroXen is a fileless Remote Access Trojan (RAT) that excels in evading detection through both static and dynamic analysis methods	Malware	RAT
5.10.23	r77	According to the author, r77 is a ring 3 rootkit that hides everything: * Files, directories * Processes & CPU usage * Registry keys & values * Services * TCP & UDP connections * Junctions, named pipes, scheduled tasks	Malware	Rootkit
3.10.23	The-Murk-Stealer	The report delves into the intricate workings of “The-Murk-Stealer,” a malicious tool that can discreetly infiltrate systems to collect sensitive information.	Malware	Stealer
3.10.23	Agniane Stealer	Agniane Stealer fraudulently takes credentials, system information, and session details from browsers, tokens, and file transferring tools.	Malware	Stealer
3.10.23	MidgeDropper	One of the most exciting aspects of malware analysis is coming across a family that is new or rare to the reversing community.	Malware	Droper
3.10.23	BunnyLoader	BunnyLoader, the newest Malware-as-a-Service	Malware	Loader
3.10.23	Zanubis	According to cyware, Zanubis malware pretends to be a malicious PDF application. The threat actor uses it as a key to decrypt responses received from the C2 server.	Malware	Android
1.10.23	SideTwist	APT34 Unleashes New Wave of Phishing Attack with Variant of SideTwist Trojan	Malware	Backdoor
1.10.23	Flagpro	According to PICUS, Flagpro is malware that collects information from the victim and executes commands in the victim’s environment. It targets Japan, Taiwan, and English-speaking countries. When a victim is infected with Flagpro malware, the malware can do the following:	Malware	Backdoor
1.10.23	ASMCrypt	As long as cybercriminals want to make money, they’ll keep making malware, and as long as they keep making malware, we’ll keep analyzing it, publishing reports and providing protection.	Malware	Crypt
30.9.23	AtlasAgent	AtlasAgent used in this attack activity is Trojan horse program developed by AtlasCross.	Malware	Trojan
30.9.23	DangerAds	This is a loader Trojan used by AtlasCross in this activity.	Malware	Trojan
30.9.23	ZenRAT	Proofpoint identified a new malware called ZenRAT being distributed via fake installation packages of the password manager Bitwarden.	Malware	RAT
30.9.23	Xenomorph	Xenomorph is a Android Banking RAT developed by the Hadoken.Security actor.	Malware	Android RAT
30.9.23	AndroRAT	Androrat is a remote administration tool developed in Java Android for the client side and in Java/Swing for the Server.	Malware	Android RAT
30.9.23	Gh0stCringe	Gh0stCringe RAT Being Distributed to Vulnerable Database Servers	Malware	RAT
30.9.23	China Chopper	China Chopper is a Web Shell hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server. It has been used by several threat groups.	Malware	RAT
30.9.23	Impacket	Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols	Malware	Tool
30.9.23	Mimikatz	What if we were to tell you that there was a magical tool that could greatly simplify the discovery and pillaging of credentials from Windows-based hosts.	Malware	Tool
30.9.23	AdFind	AdFind is a free command-line query tool that can be used for gathering information from Active Directory.	Malware	Tool
30.9.23	TONESHELL	My Tea’s not cold. An overview of China’s cyber threat	Malware	Backdoor
24.9.23	Deadglyph	Deadglyph: New Advanced Backdoor with Distinctive Malware Tactics	Malware	Backdoor
23.9.23	Predator	Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox’s Predator spyware via links sent on SMS and WhatsApp.	Malware	Apple Spyware
23.9.23	BBtok	360 Security Center describes BBtok as a banking trojan targeting Mexico.	Malware	Banking
23.9.23	Predator	Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox’s Predator spyware via links sent on SMS and WhatsApp.	Malware	Apple Spyware
23.9.23	BBtok	360 Security Center describes BBtok as a banking trojan targeting Mexico.	Malware	Banking
22.9.23	P2PInfect	"This increase in P2PInfect traffic has coincided with a growing number of variants seen in the wild, suggesting that the malware's developers are operating at an extremely high development cadence,"	Malware	P2P Worm
22.9.23	Venom RAT	Attack Activities by Quasar Family	Malware	RAT
20.9.23	ValleyRAT	In March 2023, Proofpoint identified a new malware we dubbed ValleyRAT.	Malware	RAT
19.9.23	ShroudedSnooper	Telecommunication service providers in the Middle East are the target of a new intrusion set dubbed ShroudedSnooper that employs a stealthy backdoor called HTTPSnoop.	Malware	Backdoor
19.9.23	XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	Malware	RAT
19.9.23	SprySOCKS	Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement	Malware	Linux
19.9.23	CapraRAT	According to PCrisk, CapraRAT is the name of an Android remote access trojan (RAT), possibly a modified version of another (open-source) RAT called AndroRAT.	Malware	RAT
19.9.23	Hook	According to ThreatFabric, this is a malware family based on apk.ermac. The name hook is the self-advertised named by its vendor DukeEugene. It provides WebSocket communication and has RAT capabilities.	Malware	Android
19.9.23	RECORDSTEALER	New Info-stealer Disguised as Crack Being Distributed	Malware	Stealer
16.9.23	NodeStealer	New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All Browser Cookies and Login Credentials	Malware	Stealer
16.9.23	RedLine/Vidar	In this blog, we investigate how threat actors used information-stealing malware with EV code signing certificates and later delivered ransomware payloads to its victims via the same delivery method.	Malware	Stealer
16.9.23	SHAPESHIFT	Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware	Malware	Wiper
16.9.23	Bash stealer	Free Download Manager backdoored – a possible supply chain attack on Linux machines	Malware	Stealer
14.9.23	BUGHATCH	According to Elastic, BUGHATCH is an in-memory implant loaded by an obfuscated PowerShell script that decodes and executes an embedded shellcode blob in its allocated memory space using common Windows APIs (VirtualAlloc, CreateThread, WaitForSingleObject).	Malware	Malware
14.9.23	JSSLoader	Malware distributor Storm-0324 facilitates ransomware access	Malware	Loader
13.9.23	MetaStealer	On March 7, 2022, KELA observed a threat actor named _META_ announcing the launch of META – a new information-stealing malware, available for sale for USD125 per month or USD1000 for unlimited use.	Malware	MacOS
13.9.23	MrTonyScam	Hackers Deploy Python-Based Stealer via Facebook Messenger	Malware	Python
13.9.23	Merlin	Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.	Malware	Stealer
13.9.23	RisePro	New RisePro Stealer distributed by the prominent PrivateLoader	Malware	Stealer
10.9.23	DarkGate	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation.	Malware	Loader
9.9.23	NetSupport RAT	Enigma Software notes that NetSupport Manager is a genuine application, which was first released about twenty years ago.	Malware	MacOS
9.9.23	Atomic Stealer	Threat Actor Selling New Atomic macOS (AMOS) Stealer on Telegram	Malware	MacOS
7.9.23	SideTwist	APT34 Unleashes New Wave of Phishing Attack with Variant of SideTwist Trojan	Malware	Trojan
6.9.23	BLISTER	Elastic observed this loader coming with valid code signatures, being used to deploy secondary payloads in-memory.	Malware	Loader
6.9.23	Chaes	Chae$ 4: New Chaes Malware Variant Targeting Financial and Logistics Customers	Malware	Banking
6.9.23	Andardoor	Analysis of Andariel’s New Attack Activities	Malware	Backdoor
6.9.23	Volgmer	Analysis of Andariel’s New Attack Activities	Malware	Backdoor
6.9.23	BlackRAT	Analysis of Andariel’s New Attack Activities	Malware	RAT
6.9.23	GoatRAT	GoatRAT Attacks Automated Payment Systems	Malware	RAT
6.9.23	DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	Malware	Malware
3.9.23	BillGates/Setag	Elasticsearch is no stranger to cybercriminal abuse given its popularity.	Malware	Backdoor
2.9.23	Infamous Chisel	A collection of components associated with Sandworm designed to enable remote access and exfiltrate information from Android phones.	Malware	GRU Malware
2.9.23	NOVEL RAT	ANALYSIS OF NOVEL RAT DISCOVERED DUBBED “SUPERBEAR”. THE RAT HAS BEEN FOUND TARGETING JOURNALIST AND DEPLOYED USING OPEN-SOURCE AUTOIT SCRIPTS.	Malware	RAT
2.9.23	SapphireStealer	Open-source information stealer enables credential and data theft	Malware	Stealer
2.9.23	QRLog	There is little information about how initial compromise was achieved in the known compromises, but analysis of the known components provide a strong link to a trojanized QR code generator discovered in the wild in February 2023.	Malware	QR trojan
2.9.23	JokerSpy	Unknown Adversary Targeting Organizations with Multi-Stage macOS Malware	Malware	MacOS
2.9.23	SnatchCrypto	Malware observed in the SnatchCrypto campaign, attributed by Kaspersky Labs to BlueNoroff with high confidence.	Malware	Crypto
2.9.23	HemiGate	HemiGate is a backdoor used by Earth Estries. Like most of the tools used by this threat actor, this backdoor is also executed via DLL sideloading using one of the loaders that support interchangeable payloads.	Malware	Loader
2.9.23	TrillClient	TrillClient toolset is an information stealer designed to steal browser data, and is packed in a single cabinet file (.cab) and extracted through the utility application expand.exe.	Malware	Tool
2.9.23	Zingdoor	Zingdoor is a new HTTP backdoor written in Go. While we first encountered Zingdoor in April 2023, some logs indicate that the earliest developments of this backdoor took place in June 2022.	Malware	Backdoor
31.8.23	MMRat	The Trend Micro Mobile Application Reputation Service (MARS) team discovered a new, fully undetected Android banking trojan, dubbed MMRat, that has been targeting mobile users in Southeast Asia since late June 2023.	Malware	Android RAT
31.8.23	BadBazaar	ESET researchers have discovered active campaigns linked to the China-aligned APT group known as GREF, distributing espionage code that has previously targeted Uyghurs	Malware	Android
31.8.23	DarkGate	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation.	Malware	Loader
29.8.23	Rust	Phylum routinely identifies malware and other software supply chain attacks targeting high-value, critical assets: an organization’s software developers.	Malware	Python
25.8.23	CollectionRAT	Lazarus Group's infrastructure reuse leads to discovery of new malware	Malware	RAT
25.8.23	QuiteRAT	QuiteRAT is a simple remote access trojan written with the help of Qt libraries.	Malware	RAT
24.8.23	Telekopye	Analysis of Telegram bot that helps cybercriminals scam people on online marketplaces	Malware	Malware
24.8.23	Whiffy Recon	SMOKE LOADER DROPS WHIFFY RECON WI-FI SCANNING AND GEOLOCATION MALWARE	Malware	Loader
23.8.23	Luna Grabber	ReversingLabs researchers have identified more than a dozen malicious packages targeting Roblox API users on the npm repository. This latest campaign recalls a 2021 attack.	Malware	Stealer
23.8.23	Spacecolon	Analysis of Spacecolon, a toolset used to deploy Scarab ransomware on vulnerable servers, and its operators, CosmicBeetle	Malware	Tool
23.8.23	CraxsRAT	‘Malware-as-a-service’ has been around for some time, however of late, it has become increasingly convenient for cybercriminals to kickstart their activities without having to learn malware development itself.	Malware	RAT
23.8.23	CypherRat	The malware has been released on github at https://github.com/EVLF/Cypher-Rat-Source-Code	Malware	RAT
22.8.23	PlugX	RSA describes PlugX as a RAT (Remote Access Trojan) malware family that is around since 2008 and is used as a backdoor to control the victim's machine fully.	Malware	RAT
22.8.23	Xloader	Xloader is a Rebranding of Formbook malware (mainly a stealer), available for macOS as well.	Malware	MacOS
21.8.23	AdLoad	AT&T Alien Labs researchers recently discovered a massive campaign of threats delivering a proxy server application to Windows machines.	Malware	MacOS
21.8.23	HiatusRAT	In March 2023, Lumen Black Lotus Labs reported on a complex campaign called “HiatusRAT” that infected over 100 edge networking devices globally.	Malware	RAT
19.8.23	Gigabud RAT	Gigabud is the name of an Android Remote Access Trojan (RAT) Android that can record the victim's screen and steal banking credentials by abusing the Accessibility Service.	Malware	RAT
14.8.23	QwixxRAT	A new threat has emerged in the realm of cybersecurity, referred to as QwixxRAT. Both businesses and individual users are at risk, as this Trojan silently infiltrates devices, casting a wide net of data extraction.	Malware	RAT
14.8.23	HYPERSCRAPE	New Iranian APT data extraction tool	Malware	Stealer
14.8.23	JanelaRAT	According to Zscaler, JanelaRAT is a heavily modified variant of BX RAT.	Malware	RAT
13.8.23	NightClub	MoustachedBouncer: Espionage against foreign diplomats in Belarus	Malware	Backdoor
12.8.23	XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	Malware	RAT
12.8.23	Statc Stealer	Statc Stealer. Statc Stealer is a sophisticated malware that infects devices powered by Windows, gains access to computer systems, and steals sensitive information.	Malware	Stealer
11.8.23	Spyder	Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors	Malware	Malware
11.8.23	ShadowPad	Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors	Malware	Malware
11.8.23	FunnySwitch	RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale	Malware	Malware
11.8.23	Brute Ratel C4	Brute Ratel is a a Customized Command and Control Center for Red Team and Adversary Simulation	Malware	Malware
8.8.23	LOLBAS	To that end, the Israeli cybersecurity company said it uncovered nine LOLBAS downloaders and three executors that could enable adversaries to download and execute "more robust malware" on infected hosts.	Malware	Downloader
8.8.23	OpenBullet	Multiple malicious OpenBullet configuration files are being shared within these communities, resulting in the installation of a Remote Access Trojan (RAT) on the user’s machine.	Malware	RAT
8.8.23	OpenCarrot	North Korea Compromises Sanctioned Russian Missile Engineering Company	Malware	Backdoor
7.8.23	SkidMap	While analyzing the latest logs of our honeypot located in central Europe, we found a rather interesting entry that repeated again less than two weeks later.	Malware	Linux
3.8.23	SharkBot	SharkBot is a piece of malicious software targeting Android Operating Systems (OSes).	Malware	Android
3.8.23	GraphDrop	PANW Unit 42 describes this malware as capable of up and downloading files as well as loading additional shellcode payloads into selected target processes.	Malware	Backdoor
3.8.23	Phorpiex	Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers.	Malware	RAT
3.8.23	Ekipa RAT	Malicious Macros Adapt to Use Microsoft Publisher to Push Ekipa RAT	Malware	RAT
2.8.23	NodeStealer 2.0	About eight months later, in March 2023, FakeGPT, a new variant of a fake ChatGPT Chrome extension that steals Facebook Ad accounts, was reported.	Malware	Stealer
2.8.23	h2miner	A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities	Malware	Linux
2.8.23	HeadCrab	Known as HeadCrab, this advanced threat actor utilizes a state-of-the-art, custom-made malware that is undetectable by agentless and traditional anti-virus solutions	Malware	Malware
2.8.23	BADNEWS	is a a .NET-based modular backdoor that comes with capabilities to establish contact with a remote command-and-control (C2) server and execute commands to enumerate files.	Malware	Backdoor
2.8.23	ORPCBackdoor	Bitter, also known as Cranberry, is an advanced threat group with suspected roots in South Asia.	Malware	Backdoor
2.8.23	Rekoobe	A Trojan for Winows with the same code structure and functionalities of elf.rekoobe, for Linux environment instead.	Malware	Trojan
2.8.23	Rekoobe	A Trojan for Linux intended to infect machines with the SPARC architecture and Intel x86, x86-64 computers.	Malware	Linux
1.8.23	WikiLoader	Organizations in Italy are the target of a new phishing campaign that leverages a new strain of malware called WikiLoader with an ultimate aim to install a banking trojan, stealer.	Malware	Banking
31.7.23	AVrecon	AVrecon is a Linux-based Remote Access Trojan (RAT) targeting small-office/home-office (SOHO) routers and other ARM-embedded devices.	Malware	RAT
31.7.23	Fruity	Fruity trojan downloader performs multi-stage infection of Windows computers	Malware	Downloader
30.7.23	CherryBlos	Trend Micro’s Mobile Application Reputation Service (MARS) team discovered two new related Android malware families involved in cryptocurrency-mining and financially-motivated scam campaigns targeting Android users.	Malware	Android
30.7.23	SEASPY Backdoor MAR-10454006-r2.v1.CLEAR	CISA obtained 14 malware samples comprised of Barracuda exploit payloads and reverse shell backdoors. The malware was used by threat actors exploiting CVE-2023-2868...	Malware	Backdoor
30.7.23	Exploit Payload Backdoor MAR-10454006-r3.v1.CLEAR	CISA obtained two SEASPY malware samples. The malware was used by threat actors exploiting CVE-2023-2868...	Malware	Backdoor
30.7.23	SUBMARINE	CISA obtained seven malware samples related to a novel backdoor CISA has named SUBMARINE. The malware was used by threat actors exploiting CVE-2023-2868, a former zero-day vulnerability affecting certain versions 5.1.3.001 - 9.2.0.006 of Barracuda Email Security Gateway (ESG).	Malware	Backdoor
30.7.23	QUARTERRIG	A stager used by APT29 to download and run CobaltStrike.	Malware	Trojan
30.7.23	HALFRIG	A stager used by APT29 to deploy CobaltStrike.	Malware	Trojan
30.7.23	GraphicalNeutrino	This loader abuses the benign service Notion for data exchange.	Malware	Loader
27.7.23	Nitrogen	The element originally known as “foul air” stinks up computers as a new initial-access campaign exhibiting some uncommon techniques	Malware	Trojan
27.7.23	PurpleFox	Using AhnLab Smart Defense (ASD) infrastructure, AhnLab Security Emergency response Center (ASEC) has recently discovered the PurpleFox malware being installed on poorly managed MS-SQL servers.	Malware	CoinMiners
26.7.23	Decoy Dog	Decoy Dog has a full suite of powerful, previously unknown capabilities	Malware	Backdoor
26.7.23	Pupy RAT	Pupy is the name of an open-source Remote Administration Trojan (RAT) written in Python.	Malware	RAT
26.7.23	Realst	In the case of macOS, the infostealer turned out to be a new malware written in Rust, dubbed “realst”.	Malware	MacOS
25.7.23	Casbaneiro	According to BitDefender, Metamorfo is a family of banker Trojans that has been active since mid-2018.	Malware	Banking
22.7.23	DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component.	Malware	Loader
22.7.23	DarkComet	DarkComet is one of the most famous RATs, developed by Jean-Pierre Lesueur in 2008.	Malware	RAT
22.7.23	BianLian	Hunting the AndroidBianLian botnet	Malware	Android
22.7.23	BianLian	BianLian Ransomware Expanding C2 Infrastructure and Operational Tempo	Malware	Linux
22.7.23	BianLian	BianLian is a GoLang-based ransomware that continues to breach several industries and demand large ransom amounts.	Malware	Ransom
22.7.23	HotRat	HotRat: The Risks of Illegal Software Downloads and Hidden AutoHotkey Script Within	Malware	RAT
21.7.23	BundleBot	Sophisticated BundleBot Malware Disguised as Google AI Chatbot and Utilities	Malware	Bot
21.7.23	DeliveryCheck	According to CERT-UA, this malware makes use of XSLT (Extensible Stylesheet Language Transformations) and COM-hijacking.	Malware	Backdoor
20.7.23	HeadCrab	Aqua Nautilus researchers discovered a new elusive and severe threat that has been infiltrating and residing on servers worldwide since early September 2021	Malware	Bot
20.7.23	Redigo	Aqua Nautilus discovered new Go based malware that targets Redis servers.	Malware	Backdoor
20.7.23	P2PInfect	The P2PInfect worm infects vulnerable Redis instances by exploiting the Lua sandbox escape vulnerability, CVE-2022-0543.	Malware	P2P virus
19.7.23	DragonEgg	Lookout Attributes Advanced Android Surveillanceware to Chinese Espionage Group APT41	Malware	Android
19.7.23	WyrmSpy	Lookout Attributes Advanced Android Surveillanceware to Chinese Espionage Group APT41	Malware	Android
18.7.23	Deed RAT	Deed RAT, a piece of remote access trojan malware, has seen a resurgence in use over the recent weeks.	Malware	RAT
18.7.23	Sardonic	They've also switched from BadHatch to a C++-based backdoor known as Sardonic, which, according to Bitdefender security.	Malware	Backdoor
17.7.23	WispRider	BEYOND THE HORIZON: TRAVELING THE WORLD ON CAMARO DRAGON’S USB FLASH DRIVES	Malware	USB
17.7.23	WormGPT	WormGPT – The Generative AI Tool Cybercriminals Are Using to Launch Business Email Compromise Attacks	Malware	GPT
15.7.23	Cigril	Backdoor malware	Malware	Backdoor
14.7.23	TRISIS Malware	The team identifies this malware as TRISIS because it targets Schneider Electric’s Triconex safety instrumented system (SIS)...	Malware	ICS
14.7.23	Colour-Blind	Kroll has identified a fully featured information stealer and remote access tool (RAT) in the Python Package Index (PyPI) that it is calling “Colour-Blind”.	Malware	RAT
14.7.23	Trojan:Win64/Cigril.D!dha	This trojan is designed to decrypt encrypted files and run them directly from the system's memory.	Malware	Crypto
13.7.23	RedDriver	Undocumented driver-based browser hijacker RedDriver targets Chinese speakers and internet cafes	Malware	Ransom
13.7.23	FiveSys	Digitally-Signed Rootkits are Back – A Look at FiveSys and Companions	Malware	Rootkit
13.7.23	PyLoose	PyLoose is a newly discovered Python-based fileless malware targeting cloud workloads.	Malware	Python
11.7.23	Pandora RAT	Github Repository with source code for Pandora hVNC	Malware	RAT
11.7.23	Pandora	Pandora ransomware was obtained by vx-underground at 2022-03-14.	Malware	Ransom
11.7.23	neshta	Neshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something."	Malware	Virus
10.7.23	TOITOIN	Discover the intricate layers of a new sophisticated and persistent malware campaign targeting businesses in the LATAM region delivering the TOITOIN Trojan.	Malware	Banking
10.7.23	RomCom RAT	Unit 42 observed threat actor Tropical Scorpius using this RAT in operations where also Cuba ransomware was deployed.	Malware	RAT
9.7.23	Noknok	Noknok is a remote administration tool (RAT). RATs vary in severity and have a variety of functions to meet the needs of the attacker.	Malware	MacOS RAT
8.7.23	Letscall	In recent years, the rise of Vishing, also known as Voice over IP Phishing, has become so popular that it has eroded trust in calls from unknown numbers.	Malware	Vishing toolset
7.7.23	FlawedGrace	According to ProofPoint, FlawedGrace is written in C++ and can be categorized as a Remote Access Trojan (RAT)	Malware	RAT
7.7.23	GorjolEcho	TA453 continues to adapt its malware arsenal, deploying novel file types and targeting new operating systems, specifically sending Mac malware..	Malware	MacOS
7.7.23	Tsunami	8220 Gang Deploys a New Campaign with Upgraded Techniques	Malware	LINUX
7.7.23	ROMCOM RAT	Unit 42 observed threat actor Tropical Scorpius using this RAT in operations where also Cuba ransomware was deployed.	Malware	RAT
7.7.23	Venom RAT	VenomRAT - new, hackforums grade, reincarnation of QuassarRAT	Malware	RAT
4.7.23	Neo_Net	Neo_Net has been conducting an eCrime campaign targeting clients of prominent banks globally, with a focus on Spanish and Chilean banks..	Malware	Android
3.7.23	Meduza Stealer	The Meduza Stealer has a singular objective: comprehensive data theft.	Malware	Stealer
3.7.23	SVCReady	According to PCrisk, SVCReady collects information about the infected system such as username, computer name, time zone, computer manufacturer..	Malware	Malware
3.7.23	Pikabot	Introducing Pikabot, an emerging malware family that comprises a downloader/installer, a loader, and a core backdoor component.	Malware	Downloader
3.7.23	Minodo	Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor	Malware	Backdoor
3.7.23	Matanbuchus	According to PCrisk, Matanbuchus is a loader-type malicious program offered by its developers as Malware-as-a-Service (MaaS).	Malware	Malware
3.7.23	Lumma Stealer	Lumma is an information stealer written in C, sold as a Malware-as-a-Service by LummaC on Russian-speaking underground forums and Telegram since at least August 2022.	Malware	Stealer
3.7.23	CargoBay	CargoBay is a newer malware family which was first observed in 2022 and is notable for being written in the Rust language.	Malware	Malware
3.7.23	AresLoader	AresLoader is a new malware "downloader" that has been advertised on some Russian language Dark Web forums “RAMP and "XSS" by a threat actor called "DarkBLUP"	Malware	Downloader
1.7.23	RustBucket	Bluenoroff’s RustBucket campaign	Malware	Malware
1.7.23	RustBucket	Attack trends related to the attack campaign DangerousPassword	Malware	OSX
1.7.23	CharmPower	CharmPower is a PowerShell-based, modular backdoor that has been used by Magic Hound since at least 2022.	Malware	Backdoor
1.7.23	POWERSTAR	Charming Kitten Updates POWERSTAR with an InterPlanetary Twist	Malware	Backdoor
1.7.23	PhonyC2	The Iranian state-sponsored group dubbed MuddyWater has been attributed to a previously unseen command-and-control (C2) framework	Malware	Framework
1.7.23	Proxyjacking	Proxyjacking: The Latest Cybercriminal Side Hustle	Hacking	Hacking
30.6.23	Fluhorse	According to Check Point, this malware features several malicious Android applications that mimic legitimate applications...	Malware	Android
30.6.23	YamaBot	Lazarus and the tale of three RATs	Malware	RAT
30.6.23	MagicRAT	Emulating the Highly Sophisticated North Korean Adversary Lazarus Group	Malware	RAT
30.6.23	Dtrack	Dtrack is a Remote Administration Tool (RAT) developed by the Lazarus group.	Malware	RAT
30.6.23	EarlyRat	Andariel, a part of the notorious Lazarus group, is known for its use of the DTrack malware and Maui ransomware in mid-2022	Malware	RAT
30.6.23	LetMeSpy	Polish security research blog Niebezpiecznik, which first reported the breach and analyzed a dump of the stolen data..	Malware	Android
30.6.23	SeroXen	This is the third installment of a three-part technical analysis of the fully undetectable (FUD) obfuscation engine BatCloak and SeroXen malware.	Malware	RAT
30.6.23	ThirdEye	New Fast-Developing ThirdEye Infostealer Pries Open System Information	Malware	Infostealer
27.6.23	Anatsa	Anatsa banking Trojan hits UK, US and DACH with new campaign	Malware	Banking
26.6.23	JOKERSPY	An overview of JOKERSPY, discovered in June 2023, which deployed custom and open source macOS tools to exploit a cryptocurrency exchange located in Japan.	Malware	MacOS
24.6.23	PindOS	PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID	Malware	Dropper
24.6.23	BlackLotus	BlackLotus stage 2 bootkit-rootkit analysis	Malware	Rootkit
24.6.23	reptile	Operation Earth Berberoka	Malware	Linux
24.6.23	Kaiten	According to netenrich, Kaiten is a Trojan horse that opens a back door on the compromised computer that allows it to perform other malicious activities.	Malware	Linux
24.6.23	DARKDEW	Mandiant associates this with UNC4191, this malware spreads to removable drives.	Malware	Malware
24.6.23	BLUEHAZE	Mandiant associates this with UNC4191, this malware is a launcher for NCAT to establish a reverse tunnel.	Malware	Malware
24.6.23	MISTCLOAK	Mandiant associates this with UNC4191, this malware decrypts and runs DARKDEW.	Malware	Malware
24.6.23	WispRider	Camaro Dragon is a Chinese-based espionage threat actor whose operations are actively focused on Southeast Asian	Malware	Malware
22.6.23	Condi	A new malware called Condi has been observed exploiting a security vulnerability in TP-Link Archer AX21 (AX1800) Wi-Fi routers to rope the devices into a distributed denial-of-service (DDoS) botnet.	Malware	Backdoor
22.6.23	Graphican	Graphican is an evolution of the known Flea backdoor Ketrican, which itself was based on a previous malware — BS2005 — also used by Flea.	Malware	Backdoor
22.6.23	Snip3	Zscaler ThreatLabz researchers observed multiple threat campaigns utilizing the Snip3 crypter, a multi-stage remote access trojan (RAT).	Malware	RAT
22.6.23	Rhadamanthys	Rhadamanthys is an information stealer that consists of two components, the loader and the main module (responsible for exfiltrating collected credentials).	Malware	Crpyto
22.6.23	Fractureiser	The oldest sample we were able to track until now (e69b50d1d58056fc770c88c514af9a82) shows the malware during its early development stage.	Malware	InfoStealer
22.6.23	Devopt	Zscaler ThreatLabz has recently unearthed a new backdoor called 'Devopt'.	Malware	Backdoor
22.6.23	Bandit Stealer	Bandit is a new information stealer that harvests stored credentials from web browsers, FTP clients, email clients, and targets cryptocurrency wallet applications.	Malware	Stealer
22.6.23	Aurora Stealer	Drive-by downloads are becoming increasingly common as attackers find new ways to access and exfiltrate sensitive data.	Malware	Stealer
22.6.23	Album Stealer	Album Stealer is disguised as a photo album that drops decoy adult images while performing malicious activity in the background.	Malware	Stealer
22.6.23	Mystic Stealer	Mystic Stealer is a new information stealer that was first advertised in April 2023	Malware	Stealer
17.6.23	ChamelDoH	The malware, dubbed ChamelDoH by Stairwell, is a C++-based tool for communicating via DNS-over-HTTPS (DoH) tunneling.	Malware	Malware
16.6.23	Arkei Stealer	Arkei is a stealer that appeared around May 2018.	Malware	Stealer
16.6.23	Pteranodon	Cybergun: Technical Analysis of the Armageddon's Infostealer	Malware	InfoStealer
16.6.23	Graphiron	Downloader / information stealer used by UAC-0056, observed since at least October 2022.	Malware	Stealer
16.6.23	GrimPlant	This malware was seen during the cyberattacks on Ukrainian state organizations. It is one of two used backdoors written in Go and attributed to UAC-0056 (SaintBear, UNC2589, TA471).	Malware	Backdoor
16.6.23	GraphSteel	This malware was seen during the cyberattacks on Ukrainian state organizations. It is one of two used backdoors written in Go and attributed to UAC-0056 (SaintBear, UNC2589, TA471).	Malware	Backdoor
16.6.23	OutSteel	According to MITRE, OutSteel is a file uploader and document stealer developed with the scripting language AutoIT that has been used by Ember Bear since at least March 2021.	Malware	Stealer
16.6.23	WhisperGate	Destructive malware deployed against targets in Ukraine in January 2022.	Malware	Destructive
14.6.23	Skuld	Skuld: The Infostealer that Speaks Golang	Malware	InfoStealer
14.6.23	DoubleFinger	Sneaky DoubleFinger loads GreetingGhoul targeting your cryptocurrency	Malware	Malware
13.6.23	VenomRAT	The first messages about VenomRAT started to appear in June 2020.	Malware	RAT
13.6.23	DCRat	DCRat is a typical RAT that has been around since at least June 2019.	Malware	RAT
13.6.23	Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums.	Malware	Malware
13.6.23	ScrubCrypt	ScrubCrypt is the rebranded "Jlaive" crypter, with a unique capability of .BAT packing	Malware	Crypter
11.6.23	SPECTRALVIPER	Elastic Security Labs has been tracking an intrusion set targeting large Vietnamese public companies for several months, REF2754.	Malware	Backdoor
10.6.23	Stealth Soldier	Check Point Research observed a wave of highly-targeted espionage attacks in Libya that utilize a new custom modular backdoor.	Malware	Backdoor
8.6.23	PowerDrop	PowerDrop: A New Insidious PowerShell Script for Command and Control Attacks Targets U.S. Aerospace Defense Industry	Malware	Malware
8.6.23	Legion Loader	Malware often arrives hand in hand with other malware.	Malware	Loader
3.6.23	Horabot	Cisco Talos has observed a threat actor deploying a previously unidentified botnet program Talos is calling “Horabot,”.	Malware	Malware
3.6.23	MQsTTang	MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT	Malware	Malware
3.6.23	RandomQuery	According to SentinelLabs, this is a VisualBasic-based malware that gathers system and file information and exfiltrates the data using InternetExplorer.Application or Microsoft.XMLHTTP objects.	Malware	Malware
3.6.23	BabyShark	BabyShark is Microsoft Visual Basic (VB) script-based malware family first seen in November 2018.	Malware	Malware
31.5.23	Lojack	ASERT recently discovered Lojack agents containing malicious C2s. These hijacked agents pointed to suspected Fancy Bear (a.k.a. APT28, Pawn Storm) domains.	Malware	Malware
31.5.23	RomCom RAT	Unit 42 observed threat actor Tropical Scorpius using this RAT in operations where also Cuba ransomware was deployed.	Malware	RAT
30.5.23	Predator	Predator: Looking under the hood of Intellexa’s Android spyware	Malware	Android
30.5.23	COSMICENERGY	COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises	Malware	OT malware
25.5.23	PowerExchange	An unnamed government entity associated with the United Arab Emirates (U.A.E.) was targeted by a likely Iranian threat actor to breach the victim's Microsoft Exchange Server with a "simple yet effective" backdoor dubbed PowerExchange.	Malware	Backdoor
25.5.23	PeepingTitle	The reason why the attackers drop two variants is to use one for capturing the victim's screen and the second for monitoring windows and the user's interactions with those.	Malware	Backdoor
25.5.23	Maxtrilha	A new banking trojan dubbed maxtrilha (due to its encryption key) has been discovered in the last few days and targeting customers of European and South American banks.	Malware	Trojan
25.5.23	BackdoorDiplomacy	An APT group that we are calling BackdoorDiplomacy, due to the main vertical of its victims, has been targeting Ministries of Foreign Affairs and telecommunication companies in Africa and the Middle East since at least 2017.	Malware	Backdoor
25.5.23	AhRat	It is rare for a developer to upload a legitimate app, wait almost a year, and then update it with malicious code.	Malware	Android
25.5.23	JackalWorm	A worm that's engineered to infect systems using removable USB drives and install the JackalControl trojan.	Malware	Worm
25.5.23	JackalSteal	An implant that's used to find files of interest, including those located in removable USB drives, and transmit them to a remote server.	Malware	Steal
25.5.23	POORTRY	According to Mandiant, POORTRY is a malware written as a driver, signed with a Microsoft Windows Hardware Compatibility Authenticode signature.	Malware	Loader
25.5.23	WinTapix.sys	Since Iranian threat actors are known to exploit Exchange servers to deploy additional malware, it is also possible that this driver has been employed alongside Exchange attacks.	Malware	Loader
25.5.23	Prikormka	Operation Groundbait: Analysis of a surveillance toolkit	Malware	Toolkit
20.5.23	POWERTRASH	This PowerShell written malware is an in-memory dropper used by FIN7 to execute the included/embedded payload.	Malware	PowerShell
19.5.23	KEKW	Stealer with Clipper Making Rounds in a Mass Campaign	Malware	Python
19.5.23	TurkoRat	ReversingLabs researchers discovered two malicious packages that contained TurkoRat, an open source infostealer that lurked on npm for two months before being detected.	Malware	RAT
19.5.23	Triada	It's worth noting that the same technique of modifying the zygote process has also been adopted by another mobile trojan called Triada.	Malware	Android
18.5.23	Zmutzy: Stealer	Zmutzy is a spyware and information stealer Trojan written in Microsoft’s .NET language.	Malware	Stealer
18.5.23	Kryptik	The Kryptik trojan was created to obtain information on an infected host’s FTP servers.	Malware	Trojan
18.5.23	ScrubCrypt	ScrubCrypt is the rebranded "Jlaive" crypter, with a unique capability of .BAT packing	Malware	Crypt
18.5.23	PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021	Malware	Crypt
18.5.23	SpyNote	Android Spyware is one of the most common kinds of malware used by attackers to gain access to personal data and carry out fraud operations.	Malware	RAT
17.5.2023	POORTRY	According to Mandiant, POORTRY is a malware written as a driver, signed with a Microsoft Windows Hardware Compatibility Authenticode signature.	Malware	Malware
16.5.2023	TrafficStealer	The TrafficStealer malware employs open container APIs to redirect web traffic to specific sites and manipulate user interaction with ads.	Malware	MacOS
16.5.2023	PrivateLoader	According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads.	Malware	Loader
16.5.2023	CopperStealer	According to PCRIsk, CopperStealer, also known as Mingloa, is a malicious program designed to steal sensitive/personal information.	Malware	Stealer
16.5.2023	Horse Shell	The firmware image contained several malicious components, including a custom MIPS32 ELF implant dubbed “Horse Shell”	Malware	ELF
15.5.2023	Merdoor	Merdoor is a fully-featured backdoor that appears to have been in existence since 2018.	Malware	Backdoor
15.5.2023	XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	Malware	Worm
15.5.2023	BPFDoor	BPFDoor is a passive backdoor used by a China-based threat actor.	Malware	Linux
12.5.2023	AllaKore	AllaKore is a simple Remote Access Tool written in Delphi, first observed in 2015 but still in early stages of development.	Malware	RAT
12.5.2023	Action RAT	Action RAT is a remote access tool written in Delphi that has been used by SideCopy since at least December 2021 against Indian and Afghani government personnel.	Malware	RAT
12.5.2023	SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware.	Malware	LOADER
6.5.23	ReconShark	Ongoing campaigns use a new malware component we call ReconShark, which is actively delivered to specifically targeted individuals through spear-phishing emails, OneDrive links leading to document downloads, and the execution of malicious macros.	Malware	Macro
6.5.23	sLoad	sLoad is a PowerShell downloader that most frequently delivers Ramnit banker and includes noteworthy reconnaissance features.	Malware	Downloader
6.5.23	goatRat	goatRat is the name of a remote access trojan (RAT) - a malicious app that allows attackers to take control of an Android device.	Malware	RAT
6.5.23	Nexus	Nexus is the name of a banking trojan targeting Android Operating Systems (OSes). According to the research done by Cyble analysts, Nexus is the rebranded version of the S.O.V.A. banking trojan.	Malware	Android
6.5.23	Predator	Predator is the name of spyware (malicious software) targeting Android users. Between August and October 2021, the attackers utilized zero-day exploits that targeted Chrome and the Android OS to install Predator spyware implants on Android devices, even those that were fully up-to-date.	Malware	Android
6.5.23	Goldoson	Goldoson is an Android malware that compiles a list of installed applications and records the history of Wi-Fi and Bluetooth devices, including GPS locations in close proximity.	Malware	Android
6.5.23	Chameleon	Chameleon is the name of a trojan targeting Android Operating Systems (OSes).	Malware	Android
6.5.23	Fleckpe	Fleckpe is a recently discovered Android Trojan family found on Google Play, which secretly subscribes victims to paid services.	Malware	Android
5.5.23	Dirty Vanity	Dirty Vanity is a new code-injection technique that abuses forking, a lesser-known mechanism that exists in Windows operating systems.	Malware	Code-injection
5.5.23	Gravity RAT	GravityRAT malware takes your system's temperature	Malware	RAT
5.5.23	CryCryptor	New ransomware posing as COVID‑19 tracing app targets Canada; ESET offers decryptor	Malware	Android
5.5.23	BouldSpy	Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy	Malware	Spyware
5.5.23	LOBSHOT	Elastic Security Labs discovers the LOBSHOT malware	Malware	Malware
5.5.23	RambleOn	Scarcruft Bolsters Arsenal for targeting individual Android devices	Malware	Android
5.5.23	CloudMensis	Twitter Thread linking CloudMensis to RokRAT / ScarCruft	Malware	OSX
5.5.23	RokRAT	It is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents.	Malware	RAT
28.4.23	ViperSoftX	ViperSoftX: Hiding in System Logs and Spreading VenomSoftX	Malware	Stealer
28.4.23	Bisonal	Targets of Interest - Russian Organizations Increasingly Under Attack By Chinese APTs	Malware	RAT
28.4.23	PortDoor	“PortDoor” is a Chinese Backdoor that targeted ministry and public organizations such as ministry agencies, and industrial plants in East Europe countries (Russia, Belarus and Ukraine)	Malware	Backdoor
28.4.23	CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system.	Malware	Crypto
28.4.23	LimeRAT	Simple yet powerful RAT for Windows machines. This project is simple and easy to understand, It should give you a general knowledge about dotNET malwares and how it behaves.	Malware	RAT
28.4.23	POWERTRASH	This PowerShell written malware is an in-memory dropper used by FIN7 to execute the included/embedded payload.	Malware	PowerShell
28.4.23	PingPull	Chinese Alloy Taurus Updates PingPull Malware	Malware	Linux
28.4.23	BellaCiao	The name used by malware developers is BellaCiao, a reference to the Italian folk song about resistance fighting.	Malware	Malware
27.4.23	PowerLess	PowerLess is a PowerShell-based modular backdoor that has been used by Magic Hound since at least 2022.	Malware	Backdoor
26.4.23	RustBucket	BlueNoroff APT group targets macOS with ‘RustBucket’ Malware	Malware	OSX
26.4.23	JLORAT		Malware	RAT
26.4.23	Telemiris	Tomiris called, they want their Turla malware back	Malware	Python
26.4.23	Ave Maria	Information stealer which uses AutoIT for wrapping.	Malware	RAT
26.4.23	RATel	Github Repository: RATel	Malware	Malware
26.4.23	SUNBURST	FireEye describes SUNBURST as a trojanized SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers.	Malware	Backdoor
26.4.23	Kazuar	Sunburst backdoor – code overlaps with Kazuar	Malware	Backdoor
26.4.23	Tomiris	Tomiris called, they want their Turla malware back	Malware	Malware
26.4.23	AuKill	According to Sophos, the AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying either a backdoor or ransomware on the target system.	Malware	Killer
24.4.23	EvilExtractor	EvilExtractor (sometimes spelled Evil Extractor) is an attack tool designed to target Windows operating systems and extract data and files from endpoint devices.	Malware	Stealer
20.4.23	BADCALL	Malware Analysis Report (AR19-252A)	Malware	Android
20.4.23	BADCALL	The Lazarus Constellation A study on North Korean malware	Malware	Win
20.4.23	MgBot loader	Tweet on some unknown threat actor dropping Mgbot, custom IIS modular backdoor and cobalstrike using exploiting ProxyShell	Malware	Backdoor
20.4.23	RomCom RAT	Unit 42 observed threat actor Tropical Scorpius using this RAT in operations where also Cuba ransomware was deployed.	Malware	RAT
20.4.23	Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.	Malware	Stealer
20.4.23	CharmPower	CharmPower is a PowerShell-based, modular backdoor that has been used by Magic Hound since at least 2022.	Malware	Backdoor
20.4.23	Drokbk	Drokbk Malware Uses GitHub as Dead Drop Resolver	Malware	Backdoor
19.4.23	Goldoson	A new Android malware strain named Goldoson has been detected in the official Google Play Store spanning more than 60 legitimate apps that collectively have over 100 million downloads.	Malware	Adware
19.4.23	QuaDreams	A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers	Malware	Spyware
19.4.23	Domino	Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor	Malware	Backdoor
17.4.23	GraphicalNeutrino	This loader abuses the benign service Notion for data exchange.	Malware	Loader
17.4.23	EnvyScout	NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine	Malware	Military Malware
14.4.23	CapraRAT	Love scam or espionage? Transparent Tribe lures Indian and Pakistani officials	Malware	RAT
14.4.23	Bankshot	Lazarus DeathNote campaign	Malware
14.4.23	BLINDINGCAN	According to SentinelOne, this RAT can gather and transmit a defined set of system features, create/terminate/manipulate processes and files, and has self-updating and deletion capability.	Malware	RAT
14.4.23	Manuscrypt		Malware	OSX
12.4.23	KingsPawn	Contains a monitor agent and the primary malware agent, both of which are Mach-O files written in Objective-C and Go, respectively.	Malware	MacOS
12.4.23	Gopuram	Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack	Malware	Stealer
12.4.23	IconicStealer	Follow-up payload in 3CX supply chain incident, which according to Volexity is an infostealer collecting information about the system and browser using an embedded copy of the SQLite3 library.	Malware	Stealer
11.4.23	Xenomorph	Xenomorph is a Android Banking RAT developed by the Hadoken.Security actor.	Malware	Banking RAT
11.4.23	SOVA ANDROID BANKING	BEWARE: SOVA ANDROID BANKING TROJAN EMERGES MORE POWERFUL WITH NEW CAPABILITIES	Malware	Android
11.4.23	Impala Stealer	Analyzing Impala Stealer – Payload of the first NuGet attack campaign	Malware	Stealer
9.4.23	Creal Stealer	Recently Cyble Research and Intelligence Labs (CRIL) discovered a phishing site mimicking a Cryptocurrency mining platform that was spreading Creal Stealer.	Malware	Stealer
8.4.23	Prynt Stealer	No Honor Among Thieves - Prynt Stealer’s Backdoor Exposed	Malware	Stealer
8.4.23	Typhon Stealer	Typhon Reborn V2: Updated stealer features enhanced anti-analysis and evasion capabilities	Malware	Stealer
8.4.23	Ekipa RAT	Malicious Macros Adapt to Use Microsoft Publisher to Push Ekipa RAT	Malware	RAT
8.4.23	FrozenCell	Lookout researchers have discovered a new mobile surveillanceware family, FrozenCell. The threat is likely targeting employees of various Palestinian government agencies, security services, Palestinian students, and those affiliated with the Fatah political party.	Malware	Mobil
8.4.23	ViperRat	ViperRAT is an active, advanced persistent threat (APT) that sophisticated threat actors are actively using to target and spy on the Israeli Defense Force.	Malware	RAT
8.4.23	BarbWire	Operation Bearded Barbie: APT-C-23 Campaign Targeting Israeli Officials	Malware	Backdoor
8.4.23	Micropsia	This malware written in Delphi is an information stealing malware family dubbed "MICROPSIA". It has s wide range of data theft functionality built in.	Malware	Stealer
7.6.23	AndroxGh0st	Hackers may hijack AWS infrastructure for a number of reasons. However, the most common motives are to facilitate illicit cryptomining or spamming. While cryptomining is more profitable on infrastructure owned by somebody else, the same can also be said for SMTP abuse and spam.	Malware	CryptoMining
7.6.23	MacStealer	Being yet another infostealing malware surfacing in the cybercriminal arena within the latest month, MacStealer gains popularity on the underground forums due to its relatively low price and broad malicious capabilities. To tune up security protections against novel malware strains, security practitioners need a reliable source of detection content to spot possible attacks at the earliest stages of development.	Malware	MacOS
7.6.23	KEYPLUG	The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT (slides)	Malware	Linux
6.4.23	Pupy RAT	Pupy rat is an open source tool for cross-platform remote administration (Windows, Linux, OSX, Android are supported as “clients”) and subsequent exploitation (post-exploitation). Written mostly in Python.	Malware	RAT
6.4.23	Mélofée	Mélofée: a new alien malware in the Panda's toolset targeting Linux hosts	Malware	Linux
4.4.23	Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about 500$ on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	Malware	Malware
4.4.23	FastFire	Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware	Malware	Android
4.4.23	BabyShark	BabyShark is Microsoft Visual Basic (VB) script-based malware family first seen in November 2018. The malware is launched by executing the first stage HTA from a remote location, thus it can be delivered via different file types including PE files as well as malicious documents. It exfiltrates system information to C2 server, maintains persistence on the system, and waits for further instruction from the operator	Malware	Malware
3.4.23	HookSpoofer	The Uptycs Threat Research Team has discovered a new infostealer. Spread by multiple bundlers and new on cybercrime forums, HookSpoofer has keylogging and clipper abilities. (A bundler combines two or more files in a single package.) It sends its stolen data to a Telegram bot.	Malware	Stealer
3.4.23	Parallax RAT	Parallax RAT (aka, ParallaxRAT) has been distributed through spam campaigns or phishing emails (with attachments) since December 2019. The malware performs malicious activities such as reading login credentials, accessing files, keylogging, remote desktop control, and remote control of compromised machines.	Malware	Cryptocurrency
3.4.23	Titan Stealer	The Uptycs threat research team recently discovered a campaign involving the Titan Stealer malware, which is being marketed and sold by a threat actor (TA) through a Telegram channel for cybercrime purposes.	Malware	Stealer
3.4.23	MacStealer	Dubbed MacStealer, it's the latest example of a threat that uses Telegram as a command-and-control (C2) platform to exfiltrate data. It primarily affects devices running macOS versions Catalina and later running on M1 and M2 CPUs.	Malware	MacOS
3.4.23	Action RAT	Action RAT is a remote access tool written in Delphi that has been used by SideCopy since at least December 2021 against Indian and Afghani government personnel.	Malware	RAT
3.4.23	DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	Malware	Loader
25.3.23	TONEINS	TONEINS is the name of a backdoor malware. This software is designed to open a "backdoor" for additional malicious components or programs into compromised systems.	Malware	Backdoor
25.3.23	MQsTTang	MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT	Malware	Backdoor
25.3.23	BLUEHAZE	Mandiant associates this with UNC4191, this malware is a launcher for NCAT to establish a reverse tunnel.	Malware	Malware
25.3.23	MISTCLOAK	Mandiant associates this with UNC4191, this malware decrypts and runs DARKDEW.	Malware	Malware
23.3.23	SiestaGraph	NAPLISTENER: more bad dreams from developers of SIESTAGRAPH	Malware
23.3.23	DoorMe	Update to the REF2924 intrusion set and related campaigns	Malware
23.3.23	NAPLISTENER	This unique malware sample contains a C# class called MsEXGHealthd that consists of three methods: Main, SetRespHeader, and Listener.	Malware	Malware
23.3.23	VIRTUALGATE (Windows)	The Windows guest virtual machines which were hosted by the infected hypervisors also contained a unique malware sample located at C:\Windows\Temp\avp.exe. This malware, which we refer to as VIRTUALGATE, is a utility program written in C that is comprised of two (2) parts, a dropper, and the payload.	Malware	Windows
23.3.23	VIRTUALPITA (LINUX)	Mandiant discovered two (2) additional VIRTUALPITA samples listening on TCP port 7475 that were persistent as an init.d startup service on Linux vCenter systems. To disguise themselves, the binaries shared the name of the legitimate binary ksmd. KSMD (Kernel Same-Page Merging Daemon) is normally in charge of memory-saving de-duplication on Linux and would not be listening on this port.	Malware	LINUX
23.3.23	VIRTUALPIE (VMware ESXi)	VIRTUALPIE is a lightweight backdoor written in Python that spawns a daemonized IPv6 listener on a hardcoded port on a VMware ESXi server. It supports arbitrary command line execution, file transfer capabilities, and reverse shell capabilities. Communications use a custom protocol and are encrypted using RC4.	Malware	VMware ESXi
23.3.23	VIRTUALPITA (VMware ESXi)	VIRTUALPITA is a 64-bit passive backdoor that creates a listener on a hardcoded port number on a VMware ESXi server. The backdoor often utilizes VMware service names and ports to masquerade as a legitimate service. It supports arbitrary command execution, file upload and download, and the ability to start and stop vmsyslogd.	Malware	VMware ESXi
23.3.23	Mispadu	According to ESET Research, Mispadu is an ambitious Latin American banking trojan that utilizes McDonald’s malvertising and extends its attack surface to web browsers.	Malware	Banking
23.3.23	DOTRUNPEX	DEMYSTIFYING NEW VIRTUALIZED .NET INJECTOR USED IN THE WILD	Malware	RAT
23.3.23	PowerMagic	Bad magic: new APT found in the area of Russo-Ukrainian conflict	Malware	Backdoor
23.3.23	ShellBot	ShellBot Malware Being Distributed to Linux SSH Servers	Malware	Linux
18.3.23	BrasDex	The mobile malware landscape of the LATAM region, more specifically Brazil, has recently risen to prominence in the news due to families like Brata and Amextroll, extending their reach all the way to Europe.	Malware	Android
18.3.23	PixPirate	Between the end of 2022 and the beginning of 2023, a new Android banking trojan was discovered by the Cleafy TIR team. Since the lack of information and the absence of a proper nomenclature of this malware family, we decided to dub it PixPirate, to better track this family inside our internal Threat Intelligence taxonomy.	Malware	Android
17.3.23	SILKLOADER	Malware	Malware	Malware
15.3.23	REDBALDKNIGHT	REDBALDKNIGHT a.k.a BRONZE BUTLER cyberespionage group employ the Daserf backdoor in campaigns. We found that Daserf was not only used on Japanese targets, but also against other countries. We also found versions of Daserf that use steganography.	Malware	Backdoor
15.3.23	YoroTrooper	YoroTrooper’s main targets are government or energy organizations in Azerbaijan, Tajikistan, Kyrgyzstan and other Commonwealth of Independent States (CIS), based on our analysis. We also observed YoroTrooper compromise accounts from at least two international organizations: a critical European Union (EU) health care agency and the World Intellectual Property Organization (WIPO).	Malware	Espionage
14.3.23	LummaC2 Stealer	During a threat-hunting exercise, Cyble Research and Intelligence Labs (CRIL) discovered a post on the cybercrime forum about an information stealer targeting both Chromium and Mozilla-based browsers. This stealer was named LummaC2 Stealer, which targets crypto wallets, extensions, and two-factor authentication (2FA) and steals sensitive information from the victim’s machine.	Malware	Stealer
14.3.23	WhiteSnake Stealer	Cyble Research and Intelligence Labs (CRIL) came across a new malware strain called “WhiteSnake” Stealer. The stealer was first identified on cybercrime forums at the beginning of this month. It is designed to extract sensitive information from the victim’s computer.	Malware	Stealer
14.3.23	ImBetter	Threat Actors (TAs) employ sophisticated techniques to create phishing websites that are designed to appear legitimate and attractive to users. These deceptive sites are carefully crafted to trick unsuspecting users into downloading and executing malware, which can result in stealing the victim’s sensitive data.	Malware	Stealer
14.3.23	R3NIN Sniffer Toolkit	Credit card sniffers are malicious codes usually programmed in JavaScript and designed to covertly steal payment card information and Personally Identifiable Information (PII) entered by the victim on a compromised e-commerce/merchant website. Sniffer programs are also often termed ‘Online Skimmer’. R3NIN is a recent example of one such sniffer.	Malware	Toolkit
13.3.23	KamiKakaBot	In February 2023, EclecticIQ researchers identified multiple KamiKakaBot malwares which are very likely used to target government entities in ASEAN (Association of Southeast Asian Nations) countries.	Malware	Malware
11.3.23	GoBruteforcer	According to researchers with Palo Alto Networks' Unit 42, who first spotted it in the wild and dubbed it GoBruteforcer, the malware is compatible with x86, x64, and ARM architectures.	Malware	Malware
10.3.23	TinyShell	A Trojan for Winows with the same code structure and functionalities of elf.rekoobe, for Linux environment instead.	Malware	Trojan
10.3.23	NetWire	Netwire is a RAT, its functionality seems focused on password stealing and keylogging, but includes remote control capabilities as well.	Malware	RAT
10.3.23	LIGHTSHOW	In June 2022, Mandiant Managed Defense detected and responded to an UNC2970 phishing campaign targeting a U.S.-based technology company.	Malware	Malware
10.3.23	LIGHTSHIFT	In part one on North Korea's UNC2970, we covered UNC2970’s tactics, techniques and procedures (TTPs) and tooling that they used over the course of multiple intrusions. In this installment, we will focus on how UNC2970 utilized Bring Your Own Vulnerable Device (BYOVD) to further enable their operations.	Malware	Malware
10.3.23	Xenomorph	Xenomorph is a Android Banking RAT developed by the Hadoken.Security actor.	Malware	RAT
10.3.23	PlugX	PlugX malware through the Chinese remote control programs Sunlogin and Awesun’s remote code execution vulnerability.	Malware	Malware
7.3.23	SYS01stealer	We have seen SYS01 stealer attacking critical government infrastructure employees, manufacturing companies, and other industries.	Malware	Stealer
7.3.23	CrimsonRat	CrimsonRAT is a remote access Trojan used to take remote control of infected systems and steal data. We know this particular RAT is used by the Transparent Tribe APT group.	Malware	RAT
7.3.23	CapraRAT	Most likely active since July 2022, the campaign has distributed CapraRAT backdoors through at least two similar websites, while representing them as untainted versions of those secure messaging apps.	Malware	RAT
6.3.23	ZuoRAT	According to Black Lotus Labs, ZuoRAT is a MIPS file compiled for SOHO routers that can enumerate a host and internal LAN, capture packets being transmitted over the infected device and perform person-in-the-middle attacks (DNS and HTTPS hijacking based on predefined rules).	Malware	RAT
6.3.23	HiatusRAT	Just nine months after discovering ZuoRAT – a novel malware targeting small office/home office (SOHO) routers – Lumen Black Lotus Labs®	Malware	RAT
4.3.23	ATMii	While some criminals blow up ATMs to steal cash, others use less destructive methods, such as infecting the ATM with malware and then stealing the money.	Malware	ATM Malware
4.3.23	Skimer	Backdoor: Win32/Hesetox.A: vSkimmer POS Malware Analysis	Malware	ATM Malware
4.3.23	ATMitch	A look at the ATM/PoS malware landscape from 2017-2019	Malware	ATM Malware
4.3.23	Alice	The following table summarizes the properties of various ATM malware families that we have encountere.	Malware	ATM Malware
4.3.23	RIPPER	Cashing in on ATM Malware: A Comprehensive Look at Various Attack Types	Malware	ATM Malware
4.3.23	GreenDispenser	On the heels of recent disclosures of ATM malware such as Suceful [1], Plotus [2] and Padpin [3] (aka Tyupkin), Proofpoint research has discovered yet another variant of ATM malware, which we have dubbed GreenDispenser.	Malware	ATM Malware
4.3.23	SUCEFUL	If you answered ‘c’ you might be correct! FireEye Labs discovered a new piece of ATM malware (4BDD67FF852C221112337FECD0681EAC) that we detect as Backdoor.ATM.Suceful	Malware	ATM Malware
4.3.23	Prilex	Prilex is a Brazilian threat actor that has evolved out of ATM-focused malware into modular point-of-sale malware.	Malware	ATM Malware
4.3.23	Ploutus	Ploutus, one of the most sophisticated ATM malware families worldwide, is back with a new variant focused on Latin America.	Malware	ATM Malware
4.3.23	FiXS	ATMs are a core part of the financial system, providing users access to their money anytime at different physical locations.	Malware	ATM Malware
3.3.23	MQsTTang	Mustang Panda is known for its customized Korplug variants (also dubbed PlugX) and elaborate loading chains. In a departure from the group’s usual tactics, MQsTTang has only a single stage and doesn’t use any obfuscation techniques.	Malware	Backdoor
2.3.23	Rshell	Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users	Malware	Linux
2.3.23	HyperBro	HyperBro is a RAT that has been observed to target primarily within the gambling industries, though it has been spotted in other places as well.	Malware	RAT
2.3.23	SysUpdate	Sideloader used by EmissaryPanda	Malware	Malware
2.3.23	GootLoader	Gootloader Malware Leads to Cobalt Strike and Hand-on-Keyboard Activity	Malware	Malware
2.3.23	FAKEUPDATES	FAKEUPDATES is a downloader written in JavaScript that communicates via HTTP. Supported payload types include executables and JavaScript. It writes the payloads to disk prior to launching them.	Malware	Malware
1.3.23	BlackLotus	The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality.	Malware	UEFI bootkit
28.2.23	BitRAT	According to Bitdefender, BitRAT is a notorious remote access trojan (RAT) marketed on underground cybercriminal web markets and forums. Its price tag of $20 for lifetime access makes it irresistible to cybercriminals and helps the malicious payload spread.	Malware	RAT
27.2.23	ChromeLoader	A new ChromeLoader malware campaign has been observed being distributed via virtual hard disk (VHD) files, marking a deviation from the ISO optical disc image format.	Malware	VHD malware
27.2.23	PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021 The malware has been observed distributing a variety of remote access trojans and information stealers	Malware	Stealer
27.2.23	PlugX	RSA describes PlugX as a RAT (Remote Access Trojan) malware family that is around since 2008 and is used as a backdoor to control the victim's machine fully. Once the device is infected, an attacker can remotely execute several kinds of commands on the affected system.	Malware	RAT
27.2.23	XMRig	Evasive cryptojacking malware targeting macOS found lurking in pirated applications.	Malware	Crypto-mining tool
23.2.23	Atharvan	Atharvan is so-named because when the malware is run, it creates a mutex named: "SAPTARISHI-ATHARVAN-101" to ensure that only one copy is running.	Malware	Backdoor
23.2.23	Lilith RAT	New Ransomware Groups On The Rise: “RedAlert,” LILITH And 0mega Leading A Wave Of Ransomware Campaigns	Malware	RAT
23.2.23	Wslink	Under the hood of Wslink’s multilayered virtual machine	Malware	WM virus
23.2.23	S1deload	S1deload Stealer relies on DLL sideloading techniques to run its malicious components. It uses a legitimate, digitally-signed executable that inadvertently loads malicious code if clicked.	Malware	Stealer
21.2.23	Stealc	Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity – Part 1	Malware	Stealer
21.2.23	ReverseRAT	APT SideCopy Targeting Indian Government Entities - Analysis of the new version of ReverseRAT	Malware	RAT
18.2.23	WhiskerSpy	Security researchers have discovered a new backdoor called WhiskerSpy used in a campaign from a relatively new advanced threat actor tracked as Earth Kitsune, known for targeting individuals showing an interest in North Korea.	Malware	Backdoor
18.2.23	RambleOn	The malware has multiple stages, payloads and exfiltrates data from the Android device continually. Below, we describe in simple steps how the malware executes and compromises its victims.	Malware	Android
18.2.23	OxtaRAT	Operation Silent Watch: Desktop Surveillance in Azerbaijan and Armenia	Malware	RAT
18.2.23	FatalRat	'Purple Fox' Hackers Spotted Using New Variant of FatalRAT in Recent Malware Attacks	Malware	RAT
15.2.23	M2RAT	The RedEyes group is known to steal personal PC information as well as mobile phone data targeting specific individuals, not companies. The main characteristics of this RedEyes group attack case are the use of the Hangul EPS vulnerability and the spread of malicious code using the steganography technique.	Malware	RAT
15.2.23	GOLDBACKDOOR	Stairwell assesses with medium-high confidence that GOLDBACKDOOR is the successor of, or used in parallel with, the malware BLUELIGHT, attributed to APT37 / Ricochet Chollima. This assessment is based on technical overlaps between the two malware families and the impersonation of NK News, a South Korean news site focused on the DPR	Malware	Backdoor
15.2.23	Beep	Once we dug into this sample, we observed the use of a significant amount of evasion techniques. It seemed as if the authors of this malware were trying to implement as many anti-debugging and anti-VM (anti-sandbox) techniques as they could find. One such technique involved delaying execution through the use of the Beep API function, hence the malware’s name.	Malware	Dropper
14.2.23	ShadowPad	Tracking the entire iceberg: long-term APT malware C2 protocol emulation and scanning	Malware	Malware
14.2.23	QUICKMUTE	QuickMute is a malware developed using the C/C++ programming language. Functionally provides download, RC4 decryption, and in-memory launch of the payload (waiting for a PE file with the export function "HttpsVictimMain"). To communicate with the management server, a number of protocols are provided, in particular: TCP, UDP, HTTP, HTTPS.	Malware	Malware
14.2.23	Clipper	First clipper malware discovered on Google Play	Malware	Android
14.2.23	Rhadamanthys	Rhadamanthys is a stealer trojan that is written in C++ and compiled on 2022-08-22, according to the information received from the hacker, Stealer is still under development.	Malware	Stealer
12.2.23	VectorStealer	Information stealers are malware designed to steal sensitive information from infected computers, such as login credentials, financial data, and personal information	Malware	Stealer
12.2.23	Enigma Stealer	We discovered an active campaign targeting Eastern Europeans in the cryptocurrency industry using fake job lures.	Malware	Stealer
11.2.23	BumbleBee	This malware is delivered by an ISO file, with an DLL inside with a custom loader. Because of the unique user-agent "bumblebee" this malware was dubbed BUMBLEBEE. At the time of Analysis by Google's Threat Analysis Group (TAG) BumbleBee was observed to fetch Cobalt Strike Payloads.	Malware	Malware
11.2.23	Anchor	Anchor is a sophisticated backdoor served as a module to a subset of TrickBot installations. Operating since August 2018 it is not delivered to everybody, but contrary is delivered only to high-profile targets. Since its C2 communication scheme is very similar to the one implemented in the early TrickBot, multiple experts believe it could be attributed to the same authors.	Malware	Backdoor
11.2.23	BazarBackdoor	BazarBackdoor is a small backdoor, probably by a TrickBot "spin-off" like anchor. Its called team9 backdoor (and the corresponding loader: team9 restart loader).	Malware	Backdoor
11.2.23	Diavol	A ransomware with potential ties to Wizard Spider.	Malware	Ransomware
11.2.23	Cl0p ELF Variant Files Decryptor	Python3 script which decrypts files encrypted by flawed Cl0p ELF variant.	Malware	Anti-Ransom Tool
11.2.23	Ghost RAT	According to Security Ninja, Gh0st RAT (Remote Access Terminal) is a trojan “Remote Access Tool” used on Windows platforms, and has been used to hack into some of the most sensitive computer networks on Earth.	Malware	RAT
11.2.23	Formbook	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	Malware	Crypter
11.2.23	CloudEyE	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	Malware	RAT
11.2.23	PixPirate	That said, on top of this evolution, one of the most crucial elements which have been disrupting the current state-of-art of anti-fraud departments is Instant Payments.	Malware	Banking Malware
9.2.23	NewsPenguin	A previously unknown threat actor is targeting organizations in Pakistan using a complex payload delivery mechanism. The threat actor abuses the upcoming Pakistan International Maritime Expo & Conference (PIMEC-2023) as a lure to trick their victims.	Malware	Advanced Espionage Tool
9.2.23	GootLoader ^Update	THREAT ALERT: GootLoader - SEO Poisoning and Large Payloads Leading to Compromise	Malware	Malware
8.2.23	GraphSteel	This malware was seen during the cyberattacks on Ukrainian state organizations. It is one of two used backdoors written in Go and attributed to UAC-0056 (SaintBear, UNC2589, TA471).	Malware	Military Malware
8.2.23	GrimPlant	This malware was seen during the cyberattacks on Ukrainian state organizations. It is one of two used backdoors written in Go and attributed to UAC-0056 (SaintBear, UNC2589, TA471).	Malware	Military Malware
8.2.23	Graphiron	Russia-linked Nodaria group has deployed a new threat designed to steal a wide range of information from infected computers.	Malware	Military Malware
8.2.23	Remcos	Remcos (acronym of Remote Control & Surveillance Software) is a Remote Access Software used to remotely control computers. Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user. Remcos can be used for surveillance and penetration testing purposes, and in some instances has been used in hacking campaigns.	Malware	RAT
7.2.23	Trojan.MSIL.REDCAP.AD	We analyze an infection campaign targeting organizations in the Middle East for cyberespionage in December 2022 using a new backdoor malware. The campaign abuses legitimate but compromised email accounts to send stolen data to external mail accounts controlled by the attackers.	Malware	Backdoor
4.2.23	Prilex PoS	Prilex is a singular threat actor that has evolved from ATM-focused malware into unique modular PoS malware—actually, the most advanced PoS threat we have seen so far,	Malware	PoS Malware
4.2.23	Industroyer	Industroyer is a malware framework considered to have been used in the cyberattack on Ukraine’s power grid on December 17, 2016. The attack cut a fifth of Kiev, the capital, off power for one hour. It is the first ever known malware specifically designed to attack electrical grids.	Malware	Wiper
4.2.23	Industroyer 2	Overview of the Cyber Weapons Used in the Ukraine - Russia War	Malware	Wiper
4.2.23	RURansom Wiper	A conflict in cyberspace is unfolding parallel to the conflict between Russia and Ukraine on the ground. Cyberattacks are being lobbed against both Russian and Ukrainian sides, with a new wiper directed against Russia joining the fray.	Malware	Wiper
4.2.23	IsaacWiper	There is no description at this point.	Malware	Wiper
4.2.23	HermeticWiper	According to SentinelLabs, HermeticWiper is a custom-written application with very few standard functions. It abuses a signed driver called "empntdrv.sys" which is associated with the legitimate Software "EaseUS Partition Master Software" to enumerate the MBR and all partitions of all Physical Drives connected to the victims Windows Device and overwrite the first 512 Bytes of every MBR and Partition it can find, rendering them useless.	Malware	Wiper
3.2.23	CaddyWiper	CaddyWiper is another destructive malware believed to be deployed to target Ukraine.	Malware	Wiper
3.2.23	TRICKGATE	Cyber criminals increasingly rely on packers to carry out their malicious activities. The packer, also referred to as “Crypter” and “FUD” on hacking forums, makes it harder for antivirus programs to detect the malicious code. By using a packer, malicious actors can spread their malware more easily with fewer repercussions	Malware
3.2.23	The Titan Stealer	The Uptycs threat research team recently discovered a campaign involving the Titan Stealer malware, which is being marketed and sold by a threat actor (TA) through a Telegram channel for cybercrime purposes.	Malware	Stealer
28.1.23	Callisto	The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions.	Malware
28.1.23	Golden Chickens	From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter “the Provider”) offered by a known individual (hereinafter “the Provider Operator”).	Malware
28.1.23	Orcus RAT	Orcus has been advertised as a Remote Administration Tool (RAT) since early 2016. It has all the features that would be expected from a RAT and probably more.	Malware	RAT
28.1.23	SparkRAT	Attacks Evade Detection with SparkRAT and Golang Source Code Interpretation	Malware	RAT
28.1.23	CageyChameleon	CageyChameleon Malware is a VBS-based backdoor which has the capability to enumerate the list of running processes and check for the presence of several antivirus products. CageyChameleon will collect user host information, system current process information, etc. The collected information is sent back to the C2 server, and continue to initiate requests to perform subsequent operations.	Malware	RAT
27.1.23	StrifeWater	StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations	Malware	RAT
27.1.23	PY#RATION	According to Securonix, this malware exhibits remote access trojan (RAT) behavior, allowing for control of and persistence on the affected host.	Malware	RAT
22.1.23	Wroba	Wroba to infiltrate Wi-Fi routers and undertake Domain Name System (DNS) hijacking.	Malware	Android
20.1.23	BOLDMOVE	Suspected Chinese hackers exploited a recently disclosed FortiOS SSL-VPN vulnerability as a zero-day in December, targeting a European government and an African MSP with a new custom 'BOLDMOVE' Linux and Windows malware.	Malware	Linux malware
20.1.23	BackdoorDiplomacy	The threat actor known as BackdoorDiplomacy has been linked to a new wave of attacks targeting Iranian government entities between July and late December 2022.	Malware	Military Malware
20.1.23	ERMAC	On July 23 a forum post appeared regarding a new Android banking trojan. The attached screenshots show that it is named ERMAC	Malware	Banking Malware
20.1.23	BlackRock	Around May 2020 ThreatFabric analysts have uncovered a new strain of banking malware dubbed BlackRock that looked pretty familiar.	Malware	Banking Malware
20.1.23	NjRAT	We discovered an active campaign ongoing since at least mid-2022 which uses Middle Eastern geopolitical-themed lures to distribute NjRAT (also known as Bladabindi) to infect victims across the Middle East and North Africa.	Malware	RAT
17.1.23	Raccoon Stealer’s	Team Cymru’s S2 Research Team has blogged previously on the initial Raccoon stealer command and control methodology (Raccoon Stealer - An Insight into Victim “Gates”), which utilized “gate” IP addresses to proxy victim traffic / data to static threat actor-controlled infrastructure.	Malware	Stealer
17.1.23	Hive	Hive solves a critical problem for the malware operators at the CIA.	Malware	Military Malware
14.1.23	EyeSpy	EyeSpy - Iranian Spyware Delivered in VPN Installers	Malware	SpyMalware
14.1.23	STRRAT	Let’s take a look at a recent sample of the Java-based malware known as STRRAT.	Malware	RAT
14.1.23	StrelaStealer	information stealer dubbed StrelaStealer that's spread as a DLL/HTML polyglot.	Malware	Stealer
10.1.23	StrongPity backdoor	This StrongPity backdoor has various spying features: its 11 dynamically triggered modules are responsible for recording phone calls, collecting SMS messages, lists of call logs, contact lists, and much more.	Malware	Android Backdoor
9.1.23	Kinsing Crypto Malware	Kinsing is a known malware that targets Linux environments for cryptocurrency purposes. Kinsing uses some unique techniques that target containerized environments, making it also common in Kubernetes clusters. The evolving behavior of Kinsing has been analyzed in several different blog posts.	Malware	Crypto Malware
9.1.23	poweRAT	In yet another campaign targeting the Python Package Index (PyPI) repository, six malicious packages have been found deploying information stealers on developer systems.	Malware	PyPI malware
9.1.23	ANDROMEDA	"UNC4210 re-registered at least three expired ANDROMEDA command-and-control (C2) domains and began profiling victims to selectively deploy KOPILUWAK and QUIETCANARY in September 2022	Malware	Military Malware
9.1.23	Gootkit	We analyzed the infection routine used in recent Gootkit loader attacks on the Australian healthcare industry and found that Gootkit leveraged SEO poisoning for its initial access and abused legitimate tools like VLC Media Player.	Malware	Rootkit
9.1.23	Dridex	Originally, this post claimed that Dridex had returned. However, further research and analysis has led us to believe that the initial conclusion was incorrect.	Malware	MacOS malware
9.1.23	BitRAT	A new malware campaign has been observed using sensitive information stolen from a bank as a lure in phishing emails to drop a remote access trojan called BitRAT.	Malware	RAT
9.1.23	GuLoader	Cybersecurity researchers have exposed a wide variety of techniques adopted by an advanced malware downloader called GuLoader to evade security software.	Malware	Malware
9.1.23	SpyNote	Android Spyware is one of the most common kinds of malware used by attackers to gain access to personal data and carry out fraud operations.	Malware	Android RAT
9.1.23	Vidar	Vidar Malware is one of the activRaspberry Robine Infostealers, and its distribution has been significantly increasing. Its characteristics include the use of famous platforms such as Telegram and Mastodon as an intermediary C2.	Malware	Stealer
9.1.23	Shc Linux Malware	The ASEC analysis team recently discovered that a Linux malware developed with Shc has been installing a CoinMiner. It is presumed that after successful authentication through a dictionary attack on inadequately managed Linux SSH servers, various malware were installed on the target system.	Malware	Malware Linux
9.1.23	Raspberry Robin	Recent attacks documented in previous months seem to be orchestrated by hacking groups using a framework called Raspberry Robin.	Malware	Worm
9.1.23	Linux.BackDoor.WordPressExploit.1	is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices.	Malware	Backdoor Linux
9.1.23	Linux.BackDoor.WordPressExploit.2	is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming language and executes attackers’ commands.	Malware	Backdoor Linux
22.1.23	Wroba	Wroba to infiltrate Wi-Fi routers and undertake Domain Name System (DNS) hijacking.	Malware	Android