Malware

Both campaigns involved the distribution of malicious emails purporting to be invoices, purchase orders, or quotation requests with attachments, which when opened triggers a PowerShell script fetching the trojanized image and executing a .NET-based loader to launch the payloads.

If you find yourself being the default IT technician for your friends and family, here’s what you can do to keep them safe online.

The backdoor spread laterally after initial access via a suspected SocGholish malware download.

Attacks part of the campaign involved the delivery of phishing emails purporting to be freight invoices from DHL Express, which included a ZIP archive with a JavaScript file that facilitated the execution of a PowerShell script communicating with the attacker-controlled command-and-control server, according to an analysis from Infoblox.

Threat actors impersonating recruiters on LinkedIn provide targeted software developers with project tests and code reviews that redirect to malicious GitLab repositories that facilitate the distribution of modular information-stealing malware compatible with Windows, macOS, and Linux systems, a report from SecurityScorecard showed.

Attacks by North Korean state-backed attackers have not only resulted in the theft of $235 million from major Indian cryptocurrency exchange WazirX in July but also led to losses of $308 million for DMM Bitcoin, $100 million for Radiant Capital and Upbit combined, and $16.13 million for Rain Management.

Impacted websites, whose initial means of compromise remains uncertain, had a script retrieved from the wp3[.]xyz domain enabling the establishment of a deceptive admin account before installing an information-stealing plugin targeting admin credentials, logs, and other sensitive details, a report from c/side, a webscript security firm, revealed.

Acquisition of warrants in August enabled the U.S. Department of Justice and FBI to remotely target PlugX-impacted systems with a self-destruct command that not only removed malware files and registry keys but also established a temporary script to remove the PlugX app following the cessation of its operations.