Malware

After engaging in cyberespionage attacks that involved the distribution of RAR archive lures to deploy the IronWind downloader and Havoc post-exploitation framework, WIRTE proceeded to target numerous Israeli entities with the updated SameCoin Wiper malware in a phishing campaign impersonating an Israeli partner of cybersecurity firm ESET.

Researchers say the Iranian threat actors impersonated the North Koreans to hide their activities.

One such spyware firm, RCS Labs, gained attention after its spyware, Hermit, was discovered on devices in Kazakhstan following protests.

Attackers leveraged the cross-platform app development framework Flutter to create the Minesweeper-emulating "New Updates in Crypto Exchange" app, which when executed prompts a Dart-based primary payload to facilitate AppleScript code execution, according to a report from Jamf Threat Labs.

Threat actors leveraged search results for the query 'Are Bengal Cats legal in Australia?' which when clicked enabled the download of a malicious ZIP archive installing the GootKit information-stealing payload and remote access trojan, according to a Sophos report.

Numerous systems have been initially targeted with the RustyStealer credential-harvesting tool to facilitate high-privilege account compromise and lateral movement prior to the execution of SystemBC malware-related scripts and exfiltration of data over two days, an analysis from Kaspersky researchers showed.

Research underscores that many systems remain unpatched and are vulnerable to bugs that were patched several years ago.

Socket researchers say malicious package "Fabrice" has been live on PyPI since 2021.