Malware

Attacks commenced with the download of malicious ZIP files purporting to be pirated movies that contain an LNK file, which links with a memory-only JavaScript dropper-hosting content delivery network to execute PEAKLIGHT, according to an analysis from Mandiant.

The malware-as-a-service is based on Atomic Stealer, charges half the price and imitates legitimate software.

According to ESET researchers who discovered the campaign, the malware, which they named NGate, mimicked legitimate banking apps, convincing victims to download a malicious app via phishing messages that claimed their devices were compromised.

Intrusions commence with brute-force attempts to guess the PostgreSQL database's credentials, which when achieved would be followed by the establishment of a superuser role that would ensure database access even after modifications to the original credentials.

UAT-5394 — which has been suspected to be Kimsuky, its subgroup, or a separate operation leveraging Kimsuky's toolkit — established updated test virtual machines, payload-hosting sites, and command-and-control servers to support the creation of new MoonPeak RAT variants as part of the attack campaign.

Location history, contacts and customer data of the Styx Stealer MaaS operator were uncovered by researchers.

New AnvilEcho PowerShell trojan distribution has been sought by Iranian state-backed threat operation TA453 in a spear phishing attack campaign against a major Jewish personality that commenced late last month.