Tag: tactics
-
XWorm campaign shows a shift toward fileless malware and in-memory evasion tactics
Tags: api, control, detection, edr, encryption, injection, malware, monitoring, office, open-source, powershell, software, tacticsDodging sandboxes and scanners: The attackers relied on well-known evasion techniques throughout the chain, including API hashing to hide intent, API calls that bypass user-mode hooks installed by security software, and multiple encryption layers inside .NET DLLs.”The DLL file uses several encryption techniques for analysis to be difficult, such as RSACryptor, Virtualization, Fake.cctor, and many…
-
XWorm campaign shows a shift toward fileless malware and in-memory evasion tactics
Tags: api, control, detection, edr, encryption, injection, malware, monitoring, office, open-source, powershell, software, tacticsDodging sandboxes and scanners: The attackers relied on well-known evasion techniques throughout the chain, including API hashing to hide intent, API calls that bypass user-mode hooks installed by security software, and multiple encryption layers inside .NET DLLs.”The DLL file uses several encryption techniques for analysis to be difficult, such as RSACryptor, Virtualization, Fake.cctor, and many…
-
Hackers Exploit Weaponized Microsoft Teams Installer to Deploy Oyster Malware
A sophisticated malvertising campaign has been targeting organizations through a weaponized Microsoft Teams installer that delivers the dangerous Oyster malware, according to a recent investigation by cybersecurity experts. The attack demonstrates an alarming evolution in threat actor tactics, combining SEO poisoning, certificate abuse, and living-off-the-land techniques to evade traditional security measures. The attack was first…
-
Hackers Exploit Weaponized Microsoft Teams Installer to Deploy Oyster Malware
A sophisticated malvertising campaign has been targeting organizations through a weaponized Microsoft Teams installer that delivers the dangerous Oyster malware, according to a recent investigation by cybersecurity experts. The attack demonstrates an alarming evolution in threat actor tactics, combining SEO poisoning, certificate abuse, and living-off-the-land techniques to evade traditional security measures. The attack was first…
-
Cybersecurity Snapshot: CISA Highlights Vulnerability Management Importance in Breach Analysis, as Orgs Are Urged To Patch Cisco Zero-Days
Tags: 2fa, access, advisory, api, attack, authentication, breach, business, cisa, cisco, cloud, control, credentials, crime, cve, cyber, cybersecurity, data, defense, endpoint, exploit, fido, finance, firewall, framework, github, grc, guide, identity, incident response, infrastructure, Internet, ISO-27001, kev, law, lessons-learned, malicious, malware, mfa, mitigation, monitoring, network, open-source, phishing, privacy, ransomware, risk, saas, scam, security-incident, service, soc, software, supply-chain, tactics, threat, update, vpn, vulnerability, vulnerability-management, worm, zero-dayCISA’s takeaways of an agency hack include a call for timely vulnerability patching. Plus, Cisco zero-day bugs are under attack, patch now. Meanwhile, the CSA issued a framework for SaaS security. And get the latest on the npm breach, the ransomware attack that disrupted air travel and more! Here are six things you need to…
-
The Complete Guide to B2B SaaS TopFunnel Growth Strategies: AI-Powered Growth in 2025
Master B2B SaaS lead generation with proven top-of-funnel strategies. From Google Ads to content marketing, discover tools and tactics that successful companies use to fill their sales funnels with qualified prospects and drive sustainable growth. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/the-complete-guide-to-b2b-saas-top-of-funnel-growth-strategies-ai-powered-growth-in-2025/
-
Ransom Tales: Volume IV Emulating Rhysida, Charon and Dire Wolf Ransomware
AttackIQ presents the fourth volume of Ransom Tales, an initiative focused on emulating the Tactics, Techniques, and Procedures (TTPs) exhibited by sophisticated and prominent ransomware families with the objective of empowering defenders to rigorously challenge their security controls and enhance resilience against disruptive and extortive threats. In this release, AttackIQ presents three new attack graphs…
-
Evolved PXA Stealer wraps PureRAT in multi-layer obfuscation
Telegram and the Vietnamese infrastructure led to attribution: Metadata within exfiltrated ZIP archives pointed to @LoneNone, a Telegram handle previously associated with PXA Stealer. That same alias had appeared in earlier Cisco and SentinelOne reporting, and Validin also tied PureRAT infrastructure to Vietnamese actors, researchers noted.James Northey, SOC analyst and lead author of the report,…
-
Hackers Use GitHub Notifications to Impersonate Y Combinator and Steal Wallet Funds
A recent wave of sophisticated phishing attacks has targeted developers and startups by impersonating Y Combinator through GitHub notifications. Victims are being tricked into believing they’ve been selected for startup funding, only to face financial theft via fake verification schemes. This incident spotlights the new tactics phishers use to exploit trusted online platforms and reputable…
-
Hackers Use GitHub Notifications to Impersonate Y Combinator and Steal Wallet Funds
A recent wave of sophisticated phishing attacks has targeted developers and startups by impersonating Y Combinator through GitHub notifications. Victims are being tricked into believing they’ve been selected for startup funding, only to face financial theft via fake verification schemes. This incident spotlights the new tactics phishers use to exploit trusted online platforms and reputable…
-
Malware Deployment via Copyright Takedown Claims by Threat Actors
Threat actors from the Lone None group are exploiting copyright takedown notices to distribute sophisticated malware, including Pure Logs Stealer and a newly identified information stealer dubbed Lone None Stealer (also known as PXA Stealer). This analysis examines the campaign’s tactics, techniques, and procedures (TTPs), highlights key indicators of compromise (IOCs), and underscores how Lone…
-
Hackers Deploy Stealthy Malware on WordPress Sites to Gain Admin Access
Attackers have stepped up their tactics by deploying stealthy backdoors disguised as legitimate WordPress components, ensuring persistent administrative access even after other malware is discovered and removed. Their deceptive appearances belied their dangerous functions: one impersonated a plugin, the other camouflaged itself as a core file. Together, they formed a resilient system that gave hackers…
-
6 novel ways to use AI in cybersecurity
Tags: access, ai, attack, authentication, business, ceo, cloud, cyberattack, cybersecurity, data, defense, detection, email, infrastructure, intelligence, malicious, malware, network, phishing, risk, service, tactics, technology, threat, tool, training2. Machine-learning generative adversarial networks: Michel Sahyoun, chief solutions architect with cybersecurity technology firm NopalCyber, recommends using generative adversarial networks (GANs) to create, as well as protect against, highly sophisticated previously unseen cyberattacks. “This technique enables cybersecurity systems to learn and adapt by training against a very large number of simulated threats,” he says.GANs allow…
-
6 novel ways to use AI in cybersecurity
Tags: access, ai, attack, authentication, business, ceo, cloud, cyberattack, cybersecurity, data, defense, detection, email, infrastructure, intelligence, malicious, malware, network, phishing, risk, service, tactics, technology, threat, tool, training2. Machine-learning generative adversarial networks: Michel Sahyoun, chief solutions architect with cybersecurity technology firm NopalCyber, recommends using generative adversarial networks (GANs) to create, as well as protect against, highly sophisticated previously unseen cyberattacks. “This technique enables cybersecurity systems to learn and adapt by training against a very large number of simulated threats,” he says.GANs allow…
-
Organizations Must Update Defenses to Scattered Spider Tactics, Experts Urge
Experts at a Gartner event highlighted areas of focus in identity, processes and third-party risk management to tackle the novel tactics employed by Scattered Spider First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/update-defenses-scattered-spider/
-
Why attackers are moving beyond email-based phishing attacks
Phishing isn’t just email anymore. Attackers now use social media, chat apps & malicious ads to steal credentials. Push Security explains the latest tactics and shows how to stop multi-channel phishing where it happens, inside the browser. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/why-attackers-are-moving-beyond-email-based-phishing-attacks/
-
Subtle Snail Impersonation Tactics: How HR Representatives Can Engage Employees to Steal Login Credentials
Subtle Snail, an Iran-linked espionage group also tracked as UNC1549 under the Unyielding Wasp (Tortoiseshell) umbrella of the Charming Kitten network, has shifted its focus to European telecom, aerospace, and defense firms since June 2022. In a recent wave of attacks, the group compromised 34 devices across 11 organizations by masquerading as human resources representatives…
-
Hackers Abuse GitHub Pages to Spread Stealer Malware to macOS Users
A sophisticated malware campaign is targeting Mac users through fraudulent GitHub repositories that masquerade as legitimate software downloads, with threat actors exploiting search engine optimization tactics to deliver malicious links directly to unsuspecting victims. The LastPass Threat Intelligence, Mitigation, and Escalation team has identified an ongoing widespread infostealer operation that specifically targets macOS users through…
-
Hackers Abuse GitHub Pages to Spread Stealer Malware to macOS Users
A sophisticated malware campaign is targeting Mac users through fraudulent GitHub repositories that masquerade as legitimate software downloads, with threat actors exploiting search engine optimization tactics to deliver malicious links directly to unsuspecting victims. The LastPass Threat Intelligence, Mitigation, and Escalation team has identified an ongoing widespread infostealer operation that specifically targets macOS users through…
-
AI-Driven Phishing Attacks: Deceptive Tactics to Bypass Security Systems
Since January, Trend Micro has tracked a surge in phishing campaigns using AI-powered platforms (Lovable, Netlify, Vercel) to host fake captcha pages that lead to phishing websites. This ploy misleads users and evades security tools. Victims are first shown a captcha, lowering suspicion, while automated scanners only detect the challenge page, missing the hidden credential-harvesting…
-
MuddyWater APT Shifts Tactics to Custom Malware
The post MuddyWater APT Shifts Tactics to Custom Malware appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/muddywater-apt-shifts-tactics-to-custom-malware/
-
Stealth in Plain Sight: Cryptojackers Hijack PowerShell and Windows Processes to Evade Detection
Darktrace researchers uncovered a sophisticated cryptojacking attempt using PowerShell scripts to inject NBMiner into Windows processes. Experts warn that modern cryptomining malware is more than a nuisance”, posing risks to productivity, data security, and energy costs while exploiting “living off the land” tactics to evade detection. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/stealth-in-plain-sight-cryptojackers-hijack-powershell-and-windows-processes-to-evade-detection/
-
Where CISOs need to see Splunk go next
Tags: ai, api, automation, cisco, ciso, cloud, communications, compliance, conference, crowdstrike, cybersecurity, data, data-breach, detection, finance, framework, google, incident response, intelligence, jobs, metric, microsoft, open-source, RedTeam, resilience, risk, router, siem, soar, strategy, tactics, threat, tool, vulnerabilityResilience resides at the confluence of security and observability: There was also a clear message around resilience, the ability to maintain availability and recover quickly from any IT or security event.From a Cisco/Splunk perspective, this means a more tightly coupled relationship between security and observability.I’m reminded of a chat I had with the chief risk…
-
MuddyWater Deploys Custom Multi-Stage Malware Hidden Behind Cloudflare
Since early 2025, cybersecurity analysts have witnessed a marked evolution in the tactics and tooling of MuddyWater, the Iranian state-sponsored Advanced Persistent Threat (APT) group. Historically known for broad Remote Monitoring and Management (RMM) campaigns, MuddyWater has pivoted to highly targeted spearphishing operations and bespoke backdoors. This shift underscores the group’s growing sophistication and its…
-
FBI warns about 2 campaigns targeting Salesforce instances
The threat groups, identified as UNC6040 and UNC6395, have used different tactics to gain access to data. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-warns-campaigns-salesforce-instances/760129/