G-Data Security Blog

Printer company provided infected software downloads for half a year

This investigation revealed that the vendor's official software downloads were infected with multiple strains of malware, including the XRed backdoor and a new clipbanker virus called SnipVex.

Chihuahua Stealer: A new Breed of Infostealer

Chihuahua Stealer is a newly identified .NET-based infostealer that employs a multi-stage infection chain, advanced obfuscation, and stealth techniques to exfiltrate sensitive browser and cryptocurrency wallet data.

New I2PRAT Communicates via Anonymous Peer-to-Peer Network

I2P is an encrypted peer-to-peer overlay network that enables encrypted peer- to-peer communication. An observer cannot access the content of messages, nor can they identify the source or destination.

Malware by the (Bit)Bucket: Uncovering AsyncRAT

G DATA Security Lab discovered a malware campaign using Bitbucket to deploy AsyncRAT, a remote access trojan. The attackers employed multi-stage attacks to host and distribute malicious payloads, hiding their activities with Base64 encoding.

BBTok Targeting Brazil Using the AppDomain Manager Injection Technique

The Brazilian-targeted threat BBTok has a complex infection chain that starts with an email containing an ISO image. The malware compiles C# code directly on the infected machine and uses the AppDomain Manager Injection technique.

SocGholish: Fake Update Puts Visitors at Risk

The recent developments in SocGholish infection tactics target WordPress-based websites. The attack sequence involves initial access through compromised websites with vulnerable WordPress plugins.

Turla: A Master of Deception

The Turla malware has been found using weaponized LNK files to infect computers. The malware leverages a compromised website to distribute malicious packages through phishing emails.

New JScript-based RAT Uses Cobalt Strike Server for Command & Control

A new JScript-based Remote Access Trojan (RAT) has been discovered, likely distributed through phishing campaigns. The attack involves an initial loader script that contacts a command and control (C&C) server to receive a new malicious script.

GoTo Meeting Software Abused to Deploy Remcos RAT via Rust Shellcode Loader

A recent malware campaign was found exploiting the GoTo Meeting software to deploy the Remcos RAT by using DLL sideloading to execute a malicious DLL file named g2m.dll through a Rust-based shellcode loader.

Sharp Stealer: New Info-stealer Malware Targets Gamers, Crypto Enthusiasts

The malware does not try to hide its presence in the system from antivirus programs and has not gained much popularity in the underground yet, indicating that it is a new player in the market.

Defend Against Threats with Cyber Fusion

Cyware is the leading provider of cyber fusion solutions that power threat intelligence sharing , end-to-end automation and 360-degree threat response.

Trending Tags