Malware

Initial access brokerage becomes increasingly lucrative Access to 576 corporate networks around the world has been sold by initial access brokers during the third quarter, which was similar to the first two quarters of 2022, but total cumulative sales price reached $4 million, compared with only $660,000 during the second quarter, reports BleepingComputer.

BleepingComputer reports that Chinese state-sponsored advanced persistent threat group Cicada, also known as APT10, has launched new attacks targeting Japanese entities with a novel LODEINFO malware version through the exploitation of legitimate K7Security Suite software.

ThreatFabric researchers discovered that 231 banking and cryptocurrency wallet apps from U.S., Australian, French, Dutch, Spanish, German, Polish, Italian, Austrian, and U.K. financial entities are being targeted by five malicious dropper Android apps that have been downloaded more than 130,000 times in the Google Play Store, reports The Hacker News.

BleepingComputer reports that popular security researchers are being incriminated by the novel and widely distributed data wiper dubbed "Azov Ransomware."

VMware's Threat Analysis Unit says it has observed up to 85 command-and-control servers supported by ShadowPad malware variants since September 2021, according to The Hacker News.

“We have never seen this technique used to date in real-world attacks. It could, in theory, be used to deliver different types of malware if leveraged by threat actors with different goals,” Brigid O Gorman, senior intelligence analyst at Symantec threat hunter team, told SC Media.

Ukrainian military entities are being targeted by a spear-phishing campaign spreading the RomCom remote access trojan since Oct. 21, The Hacker News reports.

North Korean state-sponsored threat operation Kimsuky also known as Thallium, Velvet Chollima, and Black Banshee has been using the FastFire, FastSpy, and FastViewer Android malware strains in attacks against South Korean individuals, according to The Hacker News.