Malware

Malicious GitHub pages and YouTube videos containing links for purported cracked office software, automated trading bots, and game cheats, have been leveraged to facilitate the download of self-extracting password-protected archives.

While threat actors continued to impersonate employers on job search platforms to lure software developers into participating in an online interview that would be followed by BeaverTail malware compromise, more recent attacks entailed the deployment of a new Qt-based BeaverTail version that enabled browser credential and cryptocurrency wallet data exfiltration.

The U.S. Department of Justice announced that Ukrainian national Mark Sokolovsky, also known as raccoon-stealer, black21jack77777, and Photix, has admitted guilt in operating the Raccoon Infostealer malware-as-a-service operation.

Awaken Likho's new intrusions involved the stealthy deployment of UltraVNC for breached host takeovers through a 7-Zip-based self-extracting archive file that executes an AutoIT script-unpacking file before launching the MeshAgent remote management tool.

The “BabyLockerKZ” variant has been in use by an unnamed threat actor since late 2023.

Malicious spear-phishing emails may have been leveraged by APT37 to spread a ZIP archive with an LNK file, which when executed launches a PowerShell code containing a DLL file that facilitates the retrieval of VeilShell.