Malware

The malware retrieves C2 addresses from Ethereum smart contracts to avoid takedowns.

According to industry data, the trojan accounted for 15.78% of all detected malware infections in Android devices in the third quarter of this year.

BleepingComputer reports that initial access broker Storm-0249 has moved to exploiting SentinelOne endpoint detection and response to facilitate stealthier attacks after initially launching widespread phishing intrusions.

The Broadside botnet, a modification of the decade-old Mirai, employs a custom command and control protocol and unique modules for stealth and evasion.

Attacks with the new UDPGangster backdoor exploiting User Datagram Protocol for command-and-control have been launched by Iranian state-backed threat operation MuddyWater against Azerbaijan, Israel, and Turkey as part of a cyberespionage campaign, The Hacker News reports.

The JS#SMUGGLER campaign begins when a user visits a compromised website, triggering an obfuscated JavaScript loader.

ChimeraWire operates by automating searches, loading target websites, and simulating clicks using a hidden instance of Chrome downloaded and run in debug mode.