Malware

Intrusions leveraging the vulnerability have facilitated the distribution of not only the GOREVERSE reverse proxy server but also the Condi malware, the Mirai botnet variant Jenx, and four other cryptocurrency mining payloads.

Developers have been subjected to intrusions involving the exploitation of LinkedIn to deliver a ZIP file purporting to be a Python coding challenge but contains the novel COVERTCATCH malware.

More than 50 Alibaba-hosted command-and-control servers have been leveraged to facilitate the distribution of the backdoor, which impersonates the Java, bash, sshd, SQLite, and edr-agent utilities.

A crop of hackers were caught trying to steal money from the oldest profession in society.

Attacks from a China-based command-and-control server involved MacroPack-based documents uploaded from China-, Taiwan-, and Pakistan-based IP addresses that ordered the installation of macros that facilitated Brute Ratel and Havoc distribution between May and July.

Aside from leveraging Telegram bot API to facilitate stealthier exfiltration of targeted devices' sensitive and personal data, Angry Stealer has also been enhanced with the "MotherRussia.exe" payload, which could enable further malicious activity.

Aside from facilitating the comprehensive gathering and exfiltration of device information ManticoraLoader, which could be rented for $500 a month, also features extensive obfuscation capabilities enabling evasion of the 360 Total Security sandboxing tool, a report from Cyble Research and Intelligence Labs showed.

After obtaining initial network access through the exploitation of the VMware vulnerability, tracked as CVE-2023-38831, Head Mare proceeds with the deployment of the PhantomDL and PhantomCore backdoors that facilitate additional payload delivery.