Malware

Syria-based developer and malware-as-a-service operator "EVLF DEV" has been identified to be behind the CraxsRAT and CypherRAT remote access trojans, according to SecurityWeek.

New reconnaissance attacks against a U.S. Department of Defense server involved in defense contracts and Taiwan-based semiconductor and chemical firms have been deployed by threat operation behind the HiatusRAT malware, which has reemerged months after a cyberespionage campaign against European and Latin American organizations that involved the exploitation of business-grade routers, The Hacker News reports.

Threat actors behind the sophisticated fingerprinting and redirection toolkit WoofLocker, also known as 404Browlock, which uses site-embedded JavaScript to facilitate redirections to a browser locker in tech support scams have updated its infrastructure to better avert attempted takedowns, reports The Hacker News.

BleepingComputer reports that over 100 firms across 18 sectors had their network access peddled by initial access brokers on the Russian hacking forum Exploit between May 1 and July 27, with companies in the U.S., Australia, and the UK dominating.

Southeast Asia's gambling industry has been subjected to cyberattacks by Chinese threat actors involving the exploitation of Microsoft Edge, McAfee VirusScan, and Adobe Creative Cloud executables to facilitate malware infections, according to The Record, a news site by cybersecurity firm Recorded Future.

Newly emergent threat operation LABRAT has exploited an already addressed GitLab security vulnerability in a cryptojacking and proxyjacking campaign that also involved the utilization of stealthy malware and command-and-control tools, as well as the TryCloudflare service to conceal malicious activity, reports The Hacker News.

NATO-aligned countries' foreign affairs ministries have been targeted by a new phishing campaign deploying a Duke malware variant, which has been linked to Russian state-backed cyberespionage operation APT29, also known as Cozy Bear, BlueBravo, Cloaked Ursa, The Dukes, Midnight Blizzard, and Iron Hemlock, The Hacker News reports.

BleepingComputer reports that malware has been used by threat actors to distribute and install proxy server apps on at least 400,000 Windows systems to create a massive botnet that used the compromised systems as residential exit nodes.