Malware

Attacks commenced with the distribution of phishing emails with an HTML attachment or malicious link, which would trigger the deployment of the Java-based RAT, which enables not only file system, process, and remote desktop management, but also file uploads or downloads, keylogging, screenshot capturing, and webcam takeovers.

The criminal hackers are behind at least 30 cybercrime scams, including malware, phishing and cryptocurrency fraud.

The tactics used by Vanilla Tempest such as lateral movement via RDP are not novel – but attacks on healthcare by yet another ransomware strain complicates the picture.

After establishing trust with targets via spear-phishing emails purporting to be job openings for senior-/manager-level employees in high-profile companies, UNC2970 proceeded to deliver a malicious ZIP file masquerading as a job description, an analysis from Google Cloud's Mandiant revealed.

Session hijacking is an emerging entry point for ransomware actors but few orgs invalidate open sessions after a malware infection.

Intrusions with the malicious payload, which compromises cryptocurrency wallet addresses by intercepting clipboard data, peaked in late August, according to a new advisory from Binance, which noted clipper malware distribution via unofficial Android and web apps and plugins.

BleepingComputer reports that information-stealing malware attacks have been conducted by advanced persistent threat operation Void Banshee through the exploitation of the recently addressed Windows MSHTML spoofing zero-day vulnerability, tracked as CVE-2024-43461.

Numerous social engineering tactics have been leveraged by threat actors to deploy Ajina.Banker, including fake banking, government, and utility apps, as well as malicious links purporting to be for promotions or offers spread via Telegram, a report from Group-IB revealed.