• Iron Tiger group creates Linux version of its custom malware

    According to research recently published by cybersecurity firm Trend Micro, Iron Tiger, a Chinese-speaking threat group known for targeting organisations in East Asia, has created a Linux version of its custom malware known as SysUpdate. The malware is designed to… read more »
  • Blind Eagle has reappeared with a refined toolset

    Blind Eagle, a financially motivated threat actor also known as APT-C-36, has launched attacks targeting organizations in Colombia and Ecuador since at least 2018. According to a recent report by cybersecurity firm CheckPoint, the group employs government-themed lures and sophisticated… read more »
  • Latest PureCrypter campaign targets government organisations

    Researchers at Menlo Security have discovered that a threat actor is targeting government agencies in the Asia-Pacific and North American regions with the PureCrypter malware downloader. The campaign has been seen delivering several types of malware, including Redline Stealer, AgentTesla,… read more »
  • StealC: a new advanced infostealer

    Analysts at cybersecurity firm Sekoia have uncovered a new strain of malware called StealC, an advanced infostealer designed to steal sensitive data from victims. The malware, which is currently being sold on Dark Web forums, is spread through phishing campaigns,… read more »
  • How to detect Brute Ratel activities

    Brute Ratel (BRc4) is a Command and Control (C2) framework designed to help attackers evade defence systems and remain undetected while executing malicious commands. Used in simulations of real-world attacks, this tool helps red team members deploy badgers on remote… read more »
  • Many threat actors begin to adopt Havoc Framework

    A recent research by security company ZScaler, reports that threat actors are increasingly using the Havoc Framework for their malicious activities. Havoc is a toolkit that provides attackers with a wide range of capabilities, such as creating malware, exploiting vulnerabilities,… read more »
  • WIP26: a new threat actor targeting telecom service providers

    A new threat actor, dubbed WIP26 by security firm Sentinel One, has recently been identified that is targeting government agencies and telecommunication service providers in the United States. WIP26 is known to use multiple tactics, techniques and procedures (TTPs) to… read more »
  • Frebniis: new malware targets Microsoft IIS

    Recent research by security firm Symantec has uncovered a new strain of malware called FrebniiS that is specifically designed to target servers running Microsoft Internet Information Services (IIS) software. This malware is designed to steal sensitive data from the servers,… read more »
  • Some thoughts on MLOps security

    MLOps, which stands for Machine Learning Operations, is a relatively new field that focuses on the integration of machine learning models into the development and deployment processes of software applications. MLOps can bring significant benefits to organizations, such as improving… read more »
  • Beep, a new highly evasive malware

    Analysis by MinervaLabs has revealed a new type of malware called BEEP, a highly stealthy malware that can evade detection by most antivirus software. It uses a variety of techniques to hide itself, including encrypting its code and only decrypting… read more »
  • Clipboard malware found in 450+ PyPI Packages

    A new cybersecurity threat for Python developers has been reported, where malicious actors have published over 451 unique Python packages to the official Python Package Index (PyPI) repository. The aim is to infect developer systems with a clipboard-based crypto wallet… read more »
  • How to build a Security Operations Center on a budget

    As organizations continue to face increasingly sophisticated cyber threats, the importance of having a robust security operations center (SOC) has become clear. However, for many organizations, the cost of setting up a SOC can be prohibitive, especially for small to… read more »
  • How to detect Sliver C2 framework activities

    Sliver is an open source cross-platform adversary emulation/red team framework, developed for penetration testing purposes but, as other similar softwares like Cobalt Strike, is also used by cybercriminals to malicious activities. It is becoming increasingly popular among cybercrime gangs due… read more »
  • Most hi-end Android devices sold in China have pre-installed malware

    A recent study by researchers at the University of Edinburgh and Trinity College Dublin has revealed that most of top-of-the-range Android devices sold in China are being shipped with spyware. According to the research, a large number of devices are… read more »
  • Russian threat group steal screenshots from victims devices

    A Russian threat group, dubbed TA866 by Proofpoint, is suspected of using a new technique to steal sensitive information. The group has been taking screenshots of infected devices and uploading them to a remote server. The use of screenshots is… read more »
  • First Linux version of Clop ransomware has flaw in encryption algorithm

    The first Linux version of the Clop ransomware has been discovered, with a flaw in its encryption algorithm that allows it to be decrypted without paying the ransom. Cybersecurity firm SentinelOne discovered the ELF version on 26 December 2022, and… read more »
  • GuLoader: new version uses Nullsoft Scriptable Install System

    Several e-commerce industries in South Korea and the United States are being targeted by a GuLoader malware campaign, according to a report from cybersecurity firm Trellix. The attack is notable for its transition from using malware-laden Microsoft Word documents to… read more »
  • When the sunlight shines through the leaves of trees

    I have released my new musical work, Komorebi: a 4-track album that explores the world of electronic, lo-fi music, with each track designed to create a relaxing and peaceful atmosphere. The title of the album, Komorebi, is a Japanese word… read more »
  • Prilex malware evolves to target NFC-enabled POS

    Kaspersky Lab cybersecurity experts have discovered a new version of the Prilex point-of-sale (PoS) malware that has been enhanced to target transactions using NFC technology and is believed to be the most advanced PoS threat to date. The Prilex malware… read more »
  • NIST releases new framework for responsible use and development of AI

    The National Institute of Standards and Technology (NIST) has released the Artificial Intelligence Risk Management Framework (AI RMF 1.0) which provides guidelines for organizations to manage risks and promote responsible use of AI systems. The framework outlines the characteristics of… read more »