Topic: sandbox evasion
-
Cyber-Espionage Attack Mimics Sandworm Hits Russian, Belarusian Forces
A sophisticated spear-phishing campaign targets Russian and Belarusian military personnel using weaponized documents disguised as legitimate military correspondence to deliver malware. The attack deploys a malicious LNK file that executes PowerShell scripts, establishes persistence, and sets up O...
Read More » -
Digital Parasites: Why Stealth Is the New Ransomware
Modern cyberattacks prioritize stealth and long-term access over disruption, with adversaries focusing on defense evasion and persistence to operate undetected within a target's environment. Identity compromise is a primary attack vector, enabling undetected access, while malware increasingly use...
Read More » -
Unmasking FileFix: Steganography & Multistage Payloads Exposed
A cyberattack campaign called FileFix uses steganography to hide malicious code in JPG images, delivered via a phishing site that mimics Meta's support portal. The attack employs advanced techniques like multilingual phishing pages, obfuscated PowerShell scripts, and RC4 decryption to deploy the ...
Read More » -
Hackers Exploit Microsoft ClickOnce & AWS for Stealth Attacks
The OneClik cyberattack campaign exploits Microsoft ClickOnce and custom Golang malware to target energy sector organizations, disguising malicious traffic within legitimate AWS cloud services. Attackers use phishing emails with fraudulent Azure-hosted sites to distribute malicious ClickOnce file...
Read More » -
LummaStealer Surges Following CastleLoader Malware Campaigns
A major resurgence of LummaStealer malware is being driven by sophisticated social engineering campaigns that use a technique called ClickFix to deploy the CastleLoader. The attacks rely on CastleLoader, a highly obfuscated and modular malware loader that checks for security software and sandboxe...
Read More » -
DeadLock Ransomware Evades Security with BYOVD Attack
The DeadLock ransomware campaign uses a BYOVD technique, exploiting a known vulnerability (CVE-2024-51324) in a Baidu Antivirus driver to disable security software and delete recovery options before deploying its payload. The ransomware itself, written in C++, uses process hollowing and a custom ...
Read More »