Malware

Information-stealing malware Lumma, also known as LummaC2, had its infrastructure disrupted following an international law enforcement operation led by the U.S., EU, and Microsoft, reports The Record, a news site by cybersecurity firm Recorded Future.

Intrusions with spear-phishing emails and geofenced payloads have been deployed by suspected Indian state-sponsored advanced persistent threat operation Sidewinder to compromise various government entities in Bangladesh, Pakistan, and Sri Lanka with the StealerBot malware, reports The Hacker News.

Chinese advanced persistent threat group UnsolicitedBooker which overlaps with the Space Pirates and the still-unnamed Zardoor backdoor-using hacking operation has launched an attack with the new MarsSnake backdoor against an international organization based in Saudi Arabia, according to Security Affairs.

Vulnerable Redis servers targeted for cryptojacking Internet-exposed Redis servers have been subjected to attacks deploying the XMRig cryptocurrency mining malware as part of the new RedisRaider Linux cryptojacking campaign, The Hacker News reports.

Malware exported the victims' KeePass password databases to drop ransomware on VMWare ESXi datastores.

TechCrunch reports that operations of the almost identical mobile surveillance apps Cocospy, Spyzie, and Spyic have been halted.

New DBatLoader campaign sets sights on Turkey Turkish Windows users have been subjected to a new phishing campaign spreading the ModiLoader malware, also known as DBatLoader, reports GBHackers News.