Malware

Two campaigns use legitimate websites and spam emails to spread infostealers and backdoors.

Indian government organizations have been subjected to a cyberespionage campaign by suspected Pakistan-based threat operation UTA0137 that involved the targeting of Linux systems with the DISGOMOJI malware that uses emojis for command-and-control communications via Discord, The Hacker News reports.

Malicious Android apps have been leveraged by suspected Hamas-linked threat operation Arid Viper — also known as APT-C-23, Grey Karkadann, Two-tailed Scorpion, Desert Falcon, and Mantis — to facilitate the deployment of the AridSpy spyware as part of five mobile espionage campaigns, three of which remain active, The Hacker News reports.

Organizations and individuals in the government, defense, and technology sectors across India have been targeted by Pakistan-linked threat group Cosmic Leopard, also known as SpaceCobra, in attacks with the GravityRAT Android malware and HeavyLift Windows malware loader as part of Operation Celestial Force, which has been ongoing since 2018, reports The Hacker News.

BleepingComputer reports that threat actors have launched phishing campaigns involving phony job and recruitment offers to facilitate the spread of the new advanced Warmcookie malware that enables screenshot capturing, machine fingerprinting, and further payload delivery on Windows machines.

Chinese-linked ValleyRAT trojan has been updated to include screenshot capturing, process filtering, Windows event log deletion, and forced shutdown capabilities as part of a new malware attack campaign, The Hacker News reports.