Jonathan Care’s Post

A new variant of the GootLoader malware called GootBot has been found to facilitate lateral movement on compromised systems and evade detection. "The GootLoader group's introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2 such as CobaltStrike or RDP," IBM X-Force researchers Golo Mühr and Ole... Read more on the following blog article!

A new variant of the GootLoader malware called GootBot has been found to facilitate lateral movement on compromised systems and evade detection. "The GootLoader group's introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2 such as CobaltStrike or RDP," IBM X-Force researchers Golo Mühr and Ole... Read more on the following blog article!

Trend Microreport elaborates the methodology of threat actor #APT41 In the past month, we investigated a #cyberespionage attack that we have attributed to Earth Freybug (also known as a subset of APT41). #EarthFreybug is a cyberthreat group that has been active since at least 2012 that focuses on #espionage and financially motivated activities. It has been observed to target organizations from various sectors across different countries. Earth Freybug actors use a diverse range of #tools and #techniques, including #LOLBins and custom #malware. This article provides an in-depth look into two techniques used by Earth Freybug actors: dynamic-link library (#DLL) hijacking and application programming interface (#API) unhooking to prevent child processes from being monitored via a new malware we’ve discovered and dubbed #UNAPIMON. #cybersecurity

Dive into an in-depth analysis of #SnakeKeylogger by guest analyst LambdaMamba on ANYRUN blog. Learn the practical applications of using an interactive sandbox in real-world malware forensics. Full breakdown here ⬇️ https://lnkd.in/eBeXcq2G

Researchers recently noted enhancements in the ViperSoftX info-stealing malware initially identified in 2020. The malware has evolved to utilize more advanced evasion strategies by integrating the Common Language Runtime (CLR) to execute PowerShell commands within AutoIt scripts distributed via pirated eBook copies. This innovative approach enables the malware to camouflage itself within authentic system processes, posing challenges for security solutions in detection. https://lnkd.in/eAwcGkHE

Join VMRay Labs in exploring the malicious tactics of DarkGate, a malware family that highlights the lengths to which attackers will go to evade security systems. The complex delivery methods and multitude of evasion tactics that they employ requires a dynamic, behavioral-based approach to detecting and analyzing this type of malware. Try VMRay today!

A new threat activity cluster called Earth Freybug has been discovered using a new malware called UNAPIMON to evade detection. The group has been active since 2012, focusing on espionage and financially motivated activities, and has been observed targeting organizations from various sectors across different countries. According to Trend Micro, Earth Freybug is a subset within APT41, a China-linked cyber espionage group that uses a combination of living-off-the-land binaries (LOLBins) and custom malware to realize its goals. The group also employs techniques like dynamic-link library (DLL) hijacking and application programming interface (API) unhooking. https://lnkd.in/g6HVnuEW

A new variant of the GootLoader malware called GootBot has been found to facilitate lateral movement on compromised systems and evade detection. "The GootLoader group's introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2 such as CobaltStrike or RDP," IBM X-Force researchers Golo Mühr and Ole... Read more on the following blog article!

The Rapid7 blog post outlines the discovery and analysis of a new malware loader, IDAT Loader, used in conjunction with BruteRatel C4 for cyberattacks. It details the malware's distribution through a FakeUpdates campaign, its evasion techniques against analysis tools, and its method of loading additional payloads via PNG file data. https://lnkd.in/dssrFbAM

Dynamic Malware analysis using Elastic leveraging Detonate and chain of Elastic Ingest pipelines!