Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

It’s a dark and stormy night in cyberspace. Ransomware monsters lurk in the shadows, ready to encrypt and extort unsuspecting businesses.

This post will describe a long-running spam campaign from a Brazilian group known for using the Lampion stealer. We’ll detail the latest updates on the infection chain and its components, share previously undescribed indicators, and cover key takeaways, including.

Famous Chollima combines BeaverTail and OtterCookie, COLDRIVER deploys three new malware families, and Vidar Stealer 2.0 demonstrates upgraded capabilities.

Kroll has recently seen a widespread installation of an application called Calendaromatic, that Kroll Threat Intelligence (TI) is currently classifying as a potentially unwanted program (adware) but displays some functionality that gives it the potential to conduct more malicious behaviors.

In my ongoing monitoring of cyber threats in South Asia, I’ve encountered a series of advanced persistent threat (APT) activities. This region has long been a hotspot for sophisticated cyberattacks, with various groups ramping up their operations in terms of frequency and technical complexity. Starting from early July, I’ve captured multiple new malware samples targeting both Windows and Linux platforms.

Modern breaches rarely begin with a brute-force attack on a firewall, they now start with a user login. Valid account credentials are now a top initial access vector, responsible for 30% of all intrusions. In this post, we address a common misconception surrounding the inforstealer malware that may be putting you at risk of a data breach.