Malware

Intrusions involved the exploitation of an enterprise resource planning system's SQL injection vulnerability to facilitate the deployment of China Chopper and Behinder web shells, reconnaissance and lateral movement efforts, and the distribution of updated Winnti malware.

Mustang Panda commences intrusions with the delivery of spear-phishing emails with a malicious attachment that deploys malware components and legitimate files, as well as a PDF lure, according to an analysis from Trend Micro.

Attackers stole data from U.S. military and Lockheed Martin, Boeing and Honeywell employees for as little as $10 per computer.

Execution of the payload, dubbed Trojan.Generic.37477095, triggers the "installSelf" function that ensures operation from the intended location before establishing C2 through a Telegram-interacting open-source package, according to an analysis from Netskope.

Aside from adopting enhanced base64- and hexdump-based obfuscation techniques, the updated XCSSET malware has been modified to support the zshrc and dock persistence mechanisms, according to the Microsoft Threat Intelligence team.

Cryptocurrency scams netted cyber criminals $9.9 billion last year.

Attackers with valid network credentials leveraged Microsoft's certutil app and Windows Remote Management's Remote Shell plugin to facilitate the distribution of the PATHLOADER malware, which then executes the C++-based FINALDRAFT remote administration tool, according to a report from Elastic Security Labs.

After initially focusing on cyberespionage in an attack against a Southeastern European country's foreign ministry in July, threat actors aimed to compromise the Asian firm by exploiting a Palo Alto Networks PAN-OS flaw and pilfering Amazon AWS S3 bucket data and credentials before launching RA World ransomware.