An intrusion began with a user downloading and executing a malicious file impersonating DeskSoft's EarthTime application, which deployed SectopRAT malware. The threat actor used multiple malware families, including SystemBC and Betruger, and various tools for reconnaissance and lateral movement. They moved across systems using RDP and Impacket's wmiexec, maintaining persistence through local account creation and startup folder shortcuts. Data was collected using WinRAR and exfiltrated via WinSCP to an FTP server. The discovery of tools linked to Play ransomware, DragonForce ransomware, and RansomHub suggests the threat actor was likely an affiliate operating across multiple ransomware groups.

This security threat involves a sophisticated intrusion campaign initiated by a user downloading and executing a malicious file masquerading as DeskSoft's EarthTime application. This initial infection vector deployed SectopRAT malware, which is known for its capabilities in reconnaissance and persistence. The threat actor leveraged multiple malware families, including SystemBC and Betruger, to facilitate lateral movement and maintain control over compromised systems. The attackers utilized Remote Desktop Protocol (RDP) and Impacket's wmiexec tool to move laterally within the network, demonstrating advanced operational security and evasion techniques. Persistence was maintained through the creation of local user accounts and the use of startup folder shortcuts, ensuring continued access even after system reboots. Data collection was performed using WinRAR to archive sensitive information, which was then exfiltrated via WinSCP to an external FTP server. Notably, the presence of tools and indicators linked to three major ransomware groups—Play ransomware, DragonForce ransomware, and RansomHub—suggests that the threat actor is likely an affiliate operating across multiple ransomware gangs. This multi-affiliation blurs traditional lines between ransomware groups and complicates attribution and defense efforts. The campaign demonstrates a high level of operational sophistication, combining multiple malware families and tools to achieve reconnaissance, lateral movement, persistence, data exfiltration, and potential ransomware deployment.

AlienVault OTX General

Detailed information about Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs. Get real-time updates, technical details, and mitig

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs - Live Threat Intelligence - Threat Radar | OffSeq.com

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

A sophisticated phishing campaign targeting Japanese users employs MostereRAT, a Remote Access Trojan that utilizes advanced evasion techniques. The attack chain involves multiple stages, including an Easy Programming Language (EPL) payload, security tool disabling, and mTLS-secured C2 communications. The malware can deploy popular remote access tools like AnyDesk and TightVNC, granting attackers full system control. It employs techniques such as running as TrustedInstaller, blocking AV traffic, and creating hidden administrator accounts. The campaign's complexity and use of legitimate tools make detection and prevention challenging, highlighting the importance of user education and up-to-date security solutions.

MostereRAT is a sophisticated Remote Access Trojan (RAT) actively deployed via a targeted phishing campaign primarily affecting Japanese users. The attack chain is multi-staged and complex, beginning with the delivery of an Easy Programming Language (EPL) payload, which is a less common scripting language that helps evade traditional detection mechanisms. Once executed, the malware employs advanced evasion techniques such as running with the TrustedInstaller account privileges, which is the highest Windows system privilege, allowing it to bypass many security controls and maintain persistence. It also disables security tools and blocks antivirus traffic, further complicating detection and mitigation efforts. Communication with its command and control (C2) servers is secured using mutual TLS (mTLS), ensuring encrypted and authenticated data exchange that hinders network-based detection. MostereRAT can deploy legitimate remote access tools like AnyDesk and TightVNC, which are commonly used for remote support but here are weaponized to grant attackers covert full system control. Additional tactics include creating hidden administrator accounts and using various Windows persistence and execution techniques (such as T1113, T1543, T1053, T1562, T1219, T1055, T1218, T1112, T1059, T1566, T1574, T1027, T1546, T1573, T1056, T1588, T1134, T1136) to maintain long-term access and evade detection. The use of legitimate tools and high privilege escalation makes this threat particularly stealthy and difficult to detect using conventional endpoint detection and response (EDR) solutions. The campaign’s complexity and the use of phishing as the initial infection vector highlight the critical importance of user awareness and robust email security controls.

Detailed information about MostereRAT Deployed AnyDesk/TightVNC for Covert Full Access. Get real-time updates, technical details, and mitigation strategies.

MostereRAT Deployed AnyDesk/TightVNC for Covert Full Access - Live Threat Intelligence - Threat Radar | OffSeq.com

MostereRAT Deployed AnyDesk/TightVNC for Covert Full Access

New Cryptanalysis of the Fiat-Shamir Protocol - Schneier on Security

Source: https://www.schneier.com/blog/archives/2025/09/new-cryptanalysis-of-the-fiat-shamir-protocol.html

The reported security news concerns a new cryptanalysis of the Fiat-Shamir protocol, as discussed on the Schneier on Security blog and referenced from a Reddit InfoSec News post. The Fiat-Shamir protocol is a widely used cryptographic technique that transforms interactive proof systems into non-interactive ones by replacing the verifier's random challenges with a hash function, enabling efficient digital signatures and zero-knowledge proofs. This protocol underpins many cryptographic schemes and blockchain technologies. The new cryptanalysis suggests that there may be previously unknown weaknesses or vulnerabilities in the Fiat-Shamir transformation, potentially undermining the security assumptions of systems relying on it. However, the information provided does not specify the exact nature of the cryptanalysis, such as whether it leads to practical attacks, theoretical weaknesses, or conditions under which the protocol fails. There are no affected versions or patches indicated, and no known exploits in the wild have been reported. The discussion level is minimal, and the severity is assessed as medium by the source. Given the foundational role of Fiat-Shamir in cryptographic constructions, any significant cryptanalysis could have broad implications, but without concrete exploit details or affected implementations, the immediate threat remains theoretical. Organizations using cryptographic protocols based on Fiat-Shamir should monitor developments closely and prepare for potential updates or mitigations once more technical details and patches become available.

Reddit InfoSec News

Detailed information about New Cryptanalysis of the Fiat-Shamir Protocol - Schneier on Security. Get real-time updates, technical details, and mitigation strate

New Cryptanalysis of the Fiat-Shamir Protocol - Schneier on Security - Live Threat Intelligence - Threat Radar | OffSeq.com

New Cryptanalysis of the Fiat-Shamir Protocol - Schneier on Security

Reddit Discussion: New Cryptanalysis of the Fiat-Shamir Protocol - Schneier on Security

TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs

Source: https://thehackernews.com/2025/09/tor-based-cryptojacking-attack-expands.html

The reported threat involves a cryptojacking campaign leveraging the TOR network to obfuscate attacker infrastructure and activities. The attack specifically targets misconfigured Docker APIs that are exposed without proper authentication or access controls. Docker, a widely used containerization platform, exposes an API that, if left unsecured, allows remote attackers to execute arbitrary commands on the host system. In this campaign, attackers scan for Docker hosts with open APIs and deploy cryptojacking malware containers that mine cryptocurrency using the compromised system's resources. The use of TOR adds a layer of anonymity and complicates attribution and mitigation efforts by routing command and control traffic through the TOR network, making it difficult to trace back to the attacker. Although no known exploits are currently reported in the wild, the campaign is considered high priority due to the ease of exploitation of misconfigured Docker APIs and the potential for widespread resource abuse. The threat exploits common operational security oversights in containerized environments, where Docker APIs are unintentionally exposed to the internet or internal networks without authentication or firewall restrictions. This attack vector is particularly dangerous because it can lead to significant resource consumption, degraded system performance, increased operational costs, and potential lateral movement within compromised networks. The campaign's reliance on TOR for communication also complicates detection and response, as traffic may blend with legitimate TOR usage. The lack of specific affected versions suggests that any Docker deployment with an exposed API is at risk, emphasizing the importance of secure configuration and network segmentation.

Detailed information about TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs. Get real-time updates, technical details, and mitigation st

TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs - Live Threat Intelligence - Threat Radar | OffSeq.com

TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs

Reddit Discussion: TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs

From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks

Source: https://thehackernews.com/2025/09/from-mostererat-to-clickfix-new-malware.html

The reported security threat involves new malware campaigns identified under the names MostereRAT and ClickFix, which highlight an increasing trend in the use of artificial intelligence (AI) and phishing techniques by threat actors. MostereRAT is a type of Remote Access Trojan (RAT) that enables attackers to gain persistent, covert access to compromised systems, allowing data exfiltration, credential theft, and remote control. ClickFix appears to be another malware strain or campaign leveraging AI-driven phishing methods to increase the success rate of social engineering attacks. These campaigns represent an evolution in malware tactics, combining traditional malware capabilities with AI-enhanced phishing to bypass conventional security controls and deceive users more effectively. The technical details are limited, but the campaigns are recent and have been flagged as high priority due to their potential to exploit human factors and technological vulnerabilities simultaneously. Although no specific affected software versions or exploits in the wild have been documented, the campaigns' emphasis on AI-assisted phishing suggests a sophisticated approach that could adapt dynamically to evade detection and target a broad range of victims. The use of AI in phishing can automate the creation of highly personalized and convincing messages, increasing the likelihood of user interaction and subsequent malware deployment. This threat underscores the growing complexity of malware campaigns that blend technical exploits with psychological manipulation, posing significant challenges for detection and mitigation.

Detailed information about From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks. Get real-time updates, technical details, 

From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks - Live Threat Intelligence - Threat Radar | OffSeq.com

From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks

Reddit Discussion: From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks

High boy gadget for hackers

Source: https://highboy.com.br/

This content has been identified as promotional or non-threat material.

Reddit NetSec

Detailed information about High boy gadget for hackers. Get real-time updates, technical details, and mitigation strategies.

High boy gadget for hackers

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

High boy gadget for hackers

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Related Threats

New Cryptanalysis of the Fiat-Shamir Protocol - Schneier on Security

TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs

From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks

45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage

Surge in networks scans targeting Cisco ASA devices raise concerns

Actions

External Links

Need enhanced features?

Latest Threats

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility