Month: May 2025
-
Part 2: Compromised WordPress Pages and Malware Campaigns
This analysis focuses on malware campaigns linked to Proton66, particularly those targeting Android devices through compromised WordPress websites. The threat…
-
Actionable threat hunting with Threat Intelligence (I) Hunting malicious desktop files
This analysis explores the detection of malicious .desktop files used by threat actors to infect Linux systems. It explains the…
-
Actionable threat hunting with Threat Intelligence (I) Hunting malicious desktop files
This analysis explores the detection of malicious .desktop files used by threat actors to infect Linux systems. It explains the…
-
Web Scanning SonicWall for CVE202120016 Update
There has been a significant increase in scanning activity targeting SonicWall devices, specifically looking for CVE-2021-20016 vulnerability. The activity has…
-
Newly Registered Domains Distributing SpyNote Malware
Cybercriminals are employing deceptive websites on newly registered domains to distribute AndroidOS SpyNote malware. These sites imitate the Google Chrome…
-
Inside the DPRK: Spotting Malicious Remote IT Applicants
The Democratic People’s Republic of Korea (DPRK) deploys skilled IT workers remotely to organizations globally funding its weapons of mass…
-
Modern Incident Response: Tackling Malicious ML Artifacts
This analysis explores the emerging threat of machine learning model-based breaches, detailing their anatomy, detection methods, and real-world examples. It…
-
Modern Incident Response: Tackling Malicious ML Artifacts
This analysis explores the emerging threat of machine learning model-based breaches, detailing their anatomy, detection methods, and real-world examples. It…
-
DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt
In January 2025, researchers identified attacks distributing DarkCloud Stealer, an information stealer that has been active since 2022. The latest…
-
CVE202532756: FortiVoice ZeroDay Exploit Alert
A critical zero-day vulnerability (CVE-2025-32756) in multiple Fortinet products, including FortiVoice, has been actively exploited. The flaw is a stack-based…