Malware

Deployed in an attack against a South American government's foreign ministry, the latest iteration of BITSLOTH has been integrated with 35 handler functions, as well as other enumeration, command-line execution, and discovery capabilities.

Attackers have been deploying BlankBot in the guise of utility apps, which when installed seek accessibility permissions for proper execution before performing an update that enables the acquisition of permissions for total device takeovers.

After conducting a DNS poisoning attack against the ISP, StormBamboo leveraged vulnerable HTTP software update mechanisms without digital signature validation to facilitate the installation of MACMA and MgBot malware to Windows and macOS systems.

Threat actors who created StackExchange accounts commented on popular threads with high-quality answers that included links to the packages, including 'spl-types,' 'sol-structs,' 'sol-instruct,' 'raydium,' and 'raydium-sdk,' which facilitated the download of scripts enabling browser, messaging app, and cryptocurrency wallet data exfiltration.

Intrusions commenced with the delivery of tax-themed phishing emails with attachments or links redirecting to an LNK payload, which executes either BAT or CMD scripts that result in the PowerShell and Python installer deployment before installing the RATs.

Security pros caution users to download apps only from official app stores and websites.

Attacks by Cuckoo Spear may have involved the utilization of LODEINFO, which allows file theft, arbitrary shellcode execution, keystroke logging, process termination, and screenshot capturing, as an initial payload.