Malware

Intrusions involved the distribution of an obfuscated backdoor in the guise of a GTM and Google Analytics script for web analytics and advertising, which when executed from a Magento database table facilitates the exfiltration of credit card details, according to a report from Sucuri.

Attacks — which are believed to have been conducted by Group 9-linked Chinese hacking operation DragonRank — involved payloads with SEO fraud and malicious JavaScript code injections resembling those utilized by Group 11, according to an analysis from Trend Micro.

In 2024, 1 in 10 ransomware incidents struck a medical organization.

According to security researchers at web security firm c/side, the attack is widespread, with over 10,000 websites reportedly compromised.

Over 1,000 malicious apps and nearly 1,000 phone numbers have been leveraged by a single threat actor to facilitate the deployment of about 900 malware samples with similar code and user interface that were primarily aimed at banking app users, a Zimperium report showed.

Both Android and iOS versions of SparkCat exploit the Google ML Kit library's optical character recognition model to facilitate the exfiltration of crypto wallet recovery phrase-containing images to attackers' command-and-control server via Rust, a report from Kaspersky revealed.

Initial exploitation of SimpleHelp RMM vulnerabilities to link with a targeted endpoint is followed by the execution of several discovery commands obtaining system and network data, domain controller details, and CrowdStrike Falcon information, according to an analysis from cybersecurity provider Field Effect.

The North Korean APT group has leveraged a custom RDP Wrapper and new malware called forceCopy in recent campaigns.