Posts under the Malware Intelligence

Articles in Blog Posts

April 4, 2023

Technical Analysis of Files Used in 3CX Desktop App Malware Campaign

On 29th March 2023, reports emerged of malicious activities originating from a signed 3CX desktop application. Trojanized versions of the 3CX desktop app load a DLL with malicious content. The DLL launches a multi-staged attack on the victim machine, the final stage being the deployment of an unidentified info stealer.

Written by

Mehardeep Singh Sawhney

March 27, 2023

How Threat Actors are Exploiting ChatGPT's Popularity to Spread Malware via Compromised Facebook Accounts Putting Over 500,000 People at Risk

CloudSEK's investigation has revealed the presence of 13 Facebook pages/accounts (totaling over 500K followers) that have been compromised and are being used to disseminate the malware via Facebook ads.

Written by

Bablu Kumar

March 13, 2023

Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware

Since November 2022 there has been a 200-300% month-on-month increase in Youtube videos containing links to stealer malware such as Vidar, RedLine, and Raccoon in their descriptions. The videos lure users by pretending to be tutorials on how to download cracked versions of software such as Photoshop, Premiere Pro, Autodesk 3ds Max, AutoCAD, and other products that are licensed products available only to paid users.

Written by

Pavan Karthick M

September 16, 2022

Recordbreaker: The Resurgence of Raccoon

Written by

September 29, 2022

Technical Analysis of MedusaLocker Ransomware

Written by

April 30, 2020

Combating data breaches caused by misconfigured apps

Written by

Malware Intelligence

Articles in Blog Posts

Technical Analysis of Files Used in 3CX Desktop App Malware Campaign

How Threat Actors are Exploiting ChatGPT's Popularity to Spread Malware via Compromised Facebook Accounts Putting Over 500,000 People at Risk

Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware

Recordbreaker: The Resurgence of Raccoon

Technical Analysis of MedusaLocker Ransomware

Combating data breaches caused by misconfigured apps

Articles in Threat Intelligence

Critical CSRF Vulnerability in IBM CICS TX - CVE-2023-42027 Demands Immediate Action

CVE-2023-43792 baserCMS is a website development framework vulnerable to Code Injection attacks

CVE-2023-4197 Vulnerability in Dolibarr ERP CRM 18.0.1 Allows PHP Code Injection

Hoze shell script dropped along with XMRig miners on misconfigured SSH Servers by Brute Forcing

3,20,000+ Patient Records From Ayush Jharkhand Gov. In Shared On Dark Web Hacking Forums

Rogue Scripts Are Exploiting OTP Verification APIs To Send Heaps of OTP SMSes, Hold The Potential Of Triggering Service Disruptions.

Join 10,000+ subscribers