Collaborate Disseminate
In 2016, a sophisticated malware campaign targeting Pakistani nationals made headlines. Dubbed Bitter, the Advanced Persistent Threat group (also known as APT-C-08) has been active both in desktop and mobile malware campaigns for quite a long time, as … Continue reading BitterAPT Revisited: the Untold Evolution of an Android Espionage Tool
In early 2020 we identified a new, highly sophisticated Android espionage platform that had been active in the wild for at least 4 years. We named the threat Mandrake as the actor(s) behind it used names of toxic plants, or other botanical references, … Continue reading Mandrake – owning Android devices since 2016
No longer a simple Android banker, Cerberus is now a full-fledged RAT that can take complete control of devices and automatically spread via mobile device management servers. Continue reading Upgraded Cerberus Spyware Spreads Rapidly via MDM
The second report in a week has analysed phishing attacks that are attempting – and probably succeeding – in bypassing older forms of two-factor authentication (2FA). Continue reading More phishing attacks on Yahoo and Gmail SMS 2FA authentication
A ransomware threat called SamSam that’s known for crippling IT systems in hospitals, schools and government organizations has made many more victims than previously believed. Security researchers from Sophos worked with cryptocurrency tracking … Continue reading Highly Targeted Ransomware SamSam Earned Its Creator $6 Million
With a nest full of spy capabilities and good hiding techniques, the InvisiMole was able to tunnel under the radar for at least five years.” Continue reading InvisiMole Burrows into Targets with Rich Espionage Tools
This report by Kaspersky Lab ICS CERT presents information on identified servers that have been infected and used by the Energetic Bear/Crouching Yeti group. The report also includes the findings of an analysis of several webservers compromised by the group during 2016 and in early 2017. Continue reading Energetic Bear/Crouching Yeti: attacks on servers
Around February this year, we came across a piece of malware that had previously gone unnoticed. Buried in the malware zoo, the threat seems to have been operational since at least 2015, undocumented by the research community. Our interest was sti… Continue reading RadRAT: An all-in-one toolkit for complex espionage ops
Kaspersky Lab has been tracking a series of attacks utilizing unknown malware since early 2017. The attacks appear to be geopolitically motivated and target high profile organizations. The objective of the attacks is clearly espionage – they involve gaining access to top legislative, executive and judicial bodies around the world. Continue reading Operation Parliament, who is doing what?
Sofacy, also known as APT28, Fancy Bear, and Tsar Team, is a prolific, well resourced, and persistent adversary. They are sometimes portrayed as wild and reckless, but as seen under our visibility, the group can be pragmatic, measured, and agile. Continue reading Masha and these Bears