article thumbnail

China-linked Budworm APT returns to target a US entity

Security Affairs

The cyber espionage group leverage both readily available tools and custom malware in their operations, many tools are available for years, but in recent attacks, their code was updated. The attackers continue to use the HyperBro backdoor which is often loaded using the dynamic-link library (DLL) side-loading technique.

article thumbnail

Experts attribute WyrmSpy and DragonEgg spyware to the Chinese APT41 group

Security Affairs

. “After it’s installed and launched, WyrmSpy uses known rooting tools to gain escalated privileges to the device and perform surveillance activities specified by commands received from its C2 servers. WyrmSpy uses popular rooting tools such as KingRoot11 and IovyRoot/IvyRoot12. ” reads the report published by Lookout.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

0Patch released unofficial security patch for new DogWalk Windows zero-day

Security Affairs

0patch released an unofficial security patch for a new Windows zero-day vulnerability in the Microsoft Support Diagnostic Tool (MSDT) dubbed DogWalk. “Okay, but who would download and open a silly diagcab file? .” “Okay, but who would download and open a silly diagcab file?

article thumbnail

Malicious npm packages spotted delivering njRAT Trojan

Security Affairs

db-json.js “ Both packages were created by the same author last week who masqueraded them as tools to work with JSON files. The script attempted to download and execute a file named patch.exe that was used to install the njRAT remote access trojan. . “The malicious packages are: jdb.js

Libraries 104
article thumbnail

The North Korean Kimsuky APT threatens South Korea evolving its TTPs

Security Affairs

Hash 757dfeacabf4c2f771147159d26117818354af14050e6ba42cc00f4a3d58e51f Threat Kimsuky loader Brief Description Scr file, initial loader Ssdeep 12288:APWcT1z2aKqkP/mANd2JiEWKZ52zfeCkIAYfLeXcj6uuLl:uhT1z4q030JigZUaULeXc3uLl. Figure 2: Written file (AutoUpdate.dll) in the “%AppData%LocalTemp” path. Table 2: AutoUpdate.dll Information.

IT 137
article thumbnail

Evilnum APT used Python-based RAT PyVil in recent attacks

Security Affairs

Over the years, the group added new tools to its arsenal, including custom and homemade malware along with software purchased from the Golden Chickens malware-as-a-service (MaaS) provider. The second layer of Python code decodes and loads to memory the main RAT and the imported libraries. The PyVil RAT stores the malware settings (i.e.

Phishing 144
article thumbnail

New Gallmaker APT group eschews malware in cyber espionage campaigns

Security Affairs

“This group eschews custom malware and uses living off the land (LotL) tactics and publicly available hack tools to carry out activities that bear all the hallmarks of a cyber espionage campaign,” reads the analysis published by Symantec. ” concluded Symantec. ” concluded Symantec.