Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant

Almost a year after Void Rabisu shifted its targeting from opportunistic ransomware attacks with an emphasis on cyberespionage, the threat actor is still developing its main malware, the ROMCOM backdoor.

https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html


🎖@malwr

Unlucky Kamran: Android malware spying on Urdu-speaking residents of Gilgit-Baltistan

ESET researchers discovered Kamran, previously unknown malware, which spies on Urdu-speaking readers of Hunza News

https://www.welivesecurity.com/en/eset-research/unlucky-kamran-android-malware-spying-urdu-speaking-residents-gilgit-baltistan/


🎖@malwr

Improving Automation and Accessibility Drive $100 Billion in Projected Ad Fraud Losses

Ad fraud, amplified by automation and accessible bot software, inflates ad metrics for personal gain, lowering entry barriers and escalating its threat.

https://www.recordedfuture.com/improving-automation-accessibility-drive-ad-fraud-losses


🎖@malwr

We all just need to agree that ad blockers are good

YouTube’s new rules may not be around for long anyway, because they might run afoul of European Union regulations

https://blog.talosintelligence.com/threat-source-newsletter-nov-16-23/


🎖@malwr

FBI Takedown: IPStorm Botnet Infrastructure Dismantled

UPDATE NOVEMBER 2023: IPStorm Infrastructure Dismantled by FBI The FBI today revealed US law enforcement’s dismantlement of a botnet proxy network, along with a guilty plea for the individual responsible for the botnet infrastructure which was associated with the IPStorm malware. This achievement is a significant milestone in ongoing efforts to combat cyber threats. The...

https://intezer.com/blog/research/a-storm-is-brewing-ipstorm-now-has-linux-malware/


🎖@malwr

Zimbra 0-day used to target international government organizations

a blue box that reads "Threat Analysis Group"

https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/


🎖@malwr

A Closer Look at ChatGPT's Role in Automated Malware Creation

This blog entry explores the effectiveness of ChatGPT's safety measures, the potential for AI technologies to be misused by criminal actors, and the limitations of current AI models.

https://www.trendmicro.com/en_us/research/23/k/a-closer-look-at-chatgpt-s-role-in-automated-malware-creation.html


🎖@malwr

CapLoader 1.9.6 Released

CapLoader now detects even more malicious protocols and includes several new features such as JA4 fingerprints, API support for sharing IOCs to ThreatFox and OSINT lookups of malware families on Malpedia. The new CapLoader 1.9.6 release also comes with several improvements of the user interface, for...

https://www.netresec.com/?page=Blog&month=2023-11&post=CapLoader-1-9-6-Released


🎖@malwr

A deep dive into Phobos ransomware, recently deployed by 8Base group

Cisco Talos has recently observed an increase in activity conducted by 8Base, a ransomware group that uses a variant of the Phobos ransomware and other publicly available tools to facilitate their operations.

https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/


🎖@malwr

Understanding the Phobos affiliate structure and activity

Cisco Talos identified the most prolific Phobos variants, TTPs and affiliate structure, based on their activity and analysis of over 1,000 samples from VirusTotal dating back to 2019. We assess with moderate confidence Eking, Eight, Elbie, Devos and Faust are the most common variants

https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/


🎖@malwr

CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits

We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner.

https://www.trendmicro.com/en_us/research/23/k/cve-2023-46604-exploited-by-kinsing.html


🎖@malwr