HexaLocker Ransomware: A Modern Threat Forged for Maximum Pressure
HexaLocker Ransomware: A Modern Threat Forged for Maximum Pressure HexaLocker is a contemporary ransomware strain making waves across cybersecurity circles for its aggressive dual-threat capabilities: data encryption and the threat of public exposure. Once embedded within a target system, it encrypts critical files and simultaneously exfiltrates sensitive data. Victims are coerced not only with file […]
Android Phones Preloaded with Trojanized WhatsApp Target User Crypto Wallets
Android Phones Preloaded with Trojanized WhatsApp Target User Crypto Wallets Cheap Android smartphones mainly from Chinese manufacturers have been found preloaded with trojanized versions of WhatsApp and Telegram. These malicious apps contain clipper malware that targets cryptocurrency users by intercepting clipboard data and swapping wallet addresses. The malware also steals mnemonic phrases from images, hijacks […]
Waiting Thread Hijacking Malware Technique Bypasses Modern Defenses
Waiting Thread Hijacking Malware Technique Bypasses Modern Defenses Security researchers have uncovered a sophisticated new malware technique called Waiting Thread Hijacking (WTH). This stealthy method is an advanced form of classic Thread Execution Hijacking, designed to evade detection by Endpoint Detection and Response (EDR) systems and antivirus solutions. WTH manipulates waiting threads in Windows Thread […]
Beware Fake PDF Converters: Malware Stealing Passwords
Beware Fake PDF Converters: Malware Stealing Passwords A highly targeted malware campaign is exploiting users’ trust in online file conversion services by mimicking the legitimate platform pdfcandy.com. The attack utilizes fake PDF-to-DOCX converters designed to deceive victims into running a malicious PowerShell script, which installs Arechclient2, a variant of the SectopRAT infostealer. This malware is […]
Hackers Exploit Critical Confluence Server Flaw to Deploy LockBit Ransomware
Hackers Exploit Critical Confluence Server Flaw to Deploy LockBit Ransomware A recent cyberattack exposed the risks of unpatched servers, as hackers exploited a critical flaw in an Atlassian Confluence instance to deploy LockBit ransomware. The attack leveraged CVE-2023-22527, a remote code execution vulnerability, enabling attackers to run arbitrary commands on the server. This incident underscores […]
SparkCat Malware: The Next-Gen Crypto Stealer Using OCR to Target Mobile Users
SparkCat Malware: The Next-Gen Crypto Stealer Using OCR to Target Mobile Users SparkCat is a highly sophisticated piece of malware that targets both Android and iOS devices, with the specific aim of stealing sensitive information, particularly cryptocurrency wallet recovery phrases. The malware uses Optical Character Recognition (OCR) technology to scan and extract text from images […]
Akira Ransomware Expands Target to Linux and VMware ESXi
Akira Ransomware Expands Target to Linux and VMware ESXi Akira, a Ransomware-as-a-Service (RaaS) group, has quickly established itself as a major cybersecurity threat since emerging in March 2023. The group has executed over 300 attacks in 2024 alone, amassing more than $42 million in ransom payments as of April. Akira primarily targets critical sectors in […]
Ransomware Actors are Axploiting ESXi Bare-Metal Hypervisors via SSH Tunneling
Ransomware Actors are Exploiting ESXi Bare-Metal Hypervisors via SSH Tunneling Summary Threat actors are targeting VMware ESXi hypervisors by abusing SSH tunneling to establish persistence, facilitate lateral movement, and execute ransomware without detection. These hypervisors, vital to virtualized environments, frequently lack proper monitoring, making them attractive targets. The dispersed logging architecture of ESXi further complicates […]