Security Affairs
MARCH 30, 2023
The company started distributing digitally signed Trojanized installers to its customers “The trojanized 3CXDesktopApp is the first stage in a multi-stage attack chain that pulls ICO files appended with base64 data from Github and ultimately leads to a 3rd stage infostealer DLL still being analyzed as of the time of writing.”
Security Affairs
OCTOBER 13, 2022
defense contractors , financial services firms, and a national data center in Central Asia. The attacks aimed at stealing sensitive data from the victims and attempted to launch supply chain attacks targeting their customers. Masqueraded names included securityhealthservice.exe, secu.exe, vfhost.exe, vxhost.exe, vx.exe, and v.exe.”
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Security Affairs
OCTOBER 18, 2022
The Operation CuckooBees had been operating under the radar since at least 2019, threat actors conducted multiple attacks to steal intellectual property and other sensitive data from victims. Like the sample analyzed by Cyberreason, the Spyder Loader sample analyzed by Symantec uses the CryptoPP C++ library.
Security Affairs
DECEMBER 1, 2020
The jdb.js package included a script designed to perform basic reconnaissance of the infected machine and data gathering. The script attempted to download and execute a file named patch.exe that was used to install the njRAT remote access trojan. Npm is the largest package repository for any programming language.
Security Affairs
JULY 20, 2023
Both malware relies on modules that are downloaded after the apps are installed to exfiltrate data from the infected devices. WyrmSpy is able to collect Log files, Photos, Device location, SMS messages (read and write), and Audio recording. Upon installing the two spyware, they request extensive device permissions.
Security Affairs
NOVEMBER 5, 2020
The name KilllSomeOne comes from the phrase ‘KilllSomeOne’ used in the DLL side-loading attacks, the group is using poorly-written English messages relating to political subjects. . Dynamic-link library (DLL) side-loading takes advantage of how Microsoft Windows applications handle DLL files.
Security Affairs
FEBRUARY 13, 2023
This approach allows the attacker to continuously update and eliminates reliance on fixed file names.” The second-stage malware, UpdatTask.dll , is a dynamic-link library (DLL) written in C++ that includes two export functions, DllEntryPoint and Entry. Stolen data are exfiltrated through Telegram.
Expert insights. Personalized for you.
91 
Let's personalize your content