APT10: Tracking down LODEINFO 2022, part II
In the second part of this report, we discuss improvements made to the LODEINFO backdoor shellcode in 2022. Continue reading APT10: Tracking down LODEINFO 2022, part II
Category Archives: Malware Technologies
APT10: Tracking down LODEINFO 2022, part I
The first part of this report will provide technical analysis of the new infection methods such as SFX files and DOWNIISSA, a new downloader shellcode used to deploy the LODEINFO backdoor. Continue reading APT10: Tracking down LODEINFO 2022, part I
DiceyF deploys GamePlayerFramework in online casino development studio
In this report we provide technical analysis of the GamePlayerFramework deployed by an APT we call DiceyF, which is targeting online casinos in Southeast Asia. Continue reading DiceyF deploys GamePlayerFramework in online casino development studio
Ongoing exploitation of CVE-2022-41352 (Zimbra 0-day)
We investigated CVE-2022-41352 and were able to confirm that unknown APT groups have actively been exploiting this vulnerability in the wild, one of which is systematically infecting servers in Central Asia. Continue reading Ongoing exploitation of CVE-2022-41352 (Zimbra 0-day)
Uncommon infection and malware propagation methods
In this report, Kaspersky researchers discuss uncommon infection and propagation methods observed in certain crimeware families. Continue reading Uncommon infection and malware propagation methods
DeftTorero: tactics, techniques and procedures of intrusions revealed
In this report we focus on tactics, techniques, and procedures (TTPs) of the DeftTorero (aka Lebanese Cedar or Volatile Cedar) threat actor, which targets Middle East countries. Continue reading DeftTorero: tactics, techniques and procedures of intrusions revealed
Prilex: the pricey prickle credit card complex
Prilex is a Brazilian threat actor focusing on ATM and PoS attacks. In this report, we provide an overview of its PoS malware. Continue reading Prilex: the pricey prickle credit card complex
NullMixer: oodles of Trojans in a single dropper
NullMixer is a dropper delivering a number of Trojans, such as RedLine Stealer, SmokeLoader, Satacom, and others. Continue reading NullMixer: oodles of Trojans in a single dropper
Self-spreading stealer attacks gamers via YouTube
A malicious bundle containing the RedLine stealer and a miner is distributed on YouTube through cheats and cracks ads for popular games. Continue reading Self-spreading stealer attacks gamers via YouTube
VileRAT: DeathStalker’s continuous strike at foreign and cryptocurrency exchanges
VileRAT is a Python implant, part of an evasive and highly intricate attack campaign against foreign exchange and cryptocurrency trading companies. Continue reading VileRAT: DeathStalker’s continuous strike at foreign and cryptocurrency exchanges