Malware

BleepingComputer reports that the U.S. has imposed a five-year prison sentence on Ukrainian national Mark Sokolovsky months after pleading guilty to spearheading the Raccoon Stealer malware-as-a-service operation.

A 32-year-old was sentenced on criminal hacking charges related to a data-stealing malware operation.

Attacks involved impersonation of a user's client through a call on Microsoft Teams that successfully lured targets into downloading AnyDesk following the failed installation of the Microsoft Remote Support app, a report from Trend Micro revealed.

Bitter leveraged phishing emails with foreign investment project lures to spread a RAR archive containing a shortcut link, which when opened prompted PowerShell execution in alternative data streams and a scheduled task that facilitates malicious curl commands, including one that retrieves WmRAT, an analysis from Proofpoint showed.

After targeting the organization with the Microsoft OneDrive-targeting Careto2 and Google Drive-targeting Goreto malware frameworks in 2019, The Mask subjected the entity to yet another attack involving the exploitation of the WorldClient webmail component for persistence three years later, according to a Kaspersky analysis.

Attacks involved the addition of a BeMob URL to the ad management system of the Monetag website monetization platform, also known as Omnatuor or Vane Viper, in an effort to enable TDS redirection to fake CAPTCHA pages hosted on various legitimate services, according to a Guardio Labs report.

More than 300 SMTP servers have been leveraged by yet-to-be-identified threat actors to facilitate the automated distribution of phishing emails purporting to be business proposals, contracts, or promotional materials from widely known brands, according to an analysis from CloudSEK.

Threat actors commenced scanning vulnerable online webcams and DVRs in the U.S., Canada, Australia, New Zealand, and the UK impacted by the CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044, and CVE-2021-36260 flaws, as well as default passwords, which were later compromised through the open-source authentication brute-force tool Medusa.