Acquisition of warrants in August enabled the U.S. Department of Justice and FBI to remotely target PlugX-impacted systems with a self-destruct command that not only removed malware files and registry keys but also established a temporary script to remove the PlugX app following the cessation of its operations.
The last ShmooCon hacker conference showcased new ways to turn the tables on attackers and new ways to entertain your kids with computer-controlled light wands.
UAC-0063 leveraged trojanized legitimate documents from Kazakhstan's Ministry of Foreign Affairs tackling the country's diplomatic cooperation with other nations between 2021 and 2024 to facilitate the distribution of the Hatvibe and Cherryspy payloads, a report from Sekoia revealed.
Attacks by RedDelta commence with spear-phishing emails using Mongolian flood protection, Taiwanese presidential candidate Terry Gou, and an Association of Southeast Asian Nations meeting as lures that contain malicious MSI, MSC, and LNK files to facilitate PlugX malware compromise, according to an analysis from Recorded Future's Insikt Group.
Executing the bogus exploit — which is based on the legitimate PoC created by SafeBreach Labs but contains the UPX-packed poc.exe file — launches a PowerShell script in the targeted system's %Temp% folder that establishes a script-executing scheduled job to facilitate the eventual retrieval of the infostealing payload, according to a Trend Micro analysis.
Intrusions discovered earlier this week commenced with the delivery of a malicious email purporting to be from a CrowdStrike employment agent that includes a link for downloading an employee CRM app, which when clicked redirected to a CrowdStrike-spoofing website offering Windows and macOS versions of the app, according to CrowdStrike.
