Malware

Threat actors leveraged smishing campaigns to deploy BingoMod in the guise of mobile security tools, such as APP Protection, AVG AntiVirus & Security, and WebSecurity.

New DEV#POPPER attacks involved the utilization of interview lures to developers aimed at distributing a ZIP archive file, which when executed triggers the BeaverTail malware.

Intrusions involved the delivery of phishing emails with malicious RAR or ISO attachments, with the former triggering direct DBatLoader execution and the latter obscuring a Windows batch script with a PEM-encoded certificate revocation list-masquerading DBatLoader executable.

Attackers leveraged agreement-spoofing phishing emails to deliver a RAR archive with a malicious DLL, which would execute DSDownloader.

Intrusions commence with the delivery of phishing emails with an HTML file, which when clicked prompts a OneDrive connection failure notice that includes "How to fix" and "Details" options, according to a Trellix analysis.

Malicious Android APKs with the stealer malware have been spread not only via malvertising but also through 2,600 Telegram bots that seek targets' phone numbers in exchange for the APK file.

Organizations across Ukraine were noted by the country's Computer Emergency Response Team to have been targeted by Belarus-linked advanced persistent threat operation GhostWriter, also known as UAC-0057, in attacks distributing the PicassoLoader malware, Security Affairs reports.