Threats tagged 'campaign'

I recently investigated a Red Bull-themed phishing campaign that bypassed all email protections and landed in user inboxes. The attacker used trusted infrastructure via post.xero.com and Mailgun, a classic living off trusted sites tactic. SPF, DKIM and DMARC all passed. TLS certs were valid. This campaign bypassed enterprise grade filters cleanly... By using advanced phishing email analysis including header analysis, JARM fingerprinting, infra mapping - we rolled out KQL detections to customers. Key Takeway: No matter how good your phishing protections are, determined attackers will find ways around them. That's where a human-led analysis makes the difference. Full write-up (with detailed analysis, KQL detections & IOCs) https://evalian.co.uk/inside-a-red-bull-themed-recruitment-phishing-campaign/

Phishing#netsec#redditGermany+6

Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). This new malware, a shift from the previously identified JavaScript-based [Interlock RAT](https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/) (aka [NodeSnake](https://www.quorumcyber.com/wp-content/uploads/2025/06/20250416-Higher-Education-Sector-RAT.pdf)), uses PHP and is being used in a widespread campaign.

Malware#netsec#redditGermany+9

SEO Poisoning Campaign Targets 8,500+ SMB Users with Malware Disguised as AI Tools Source: https://thehackernews.com/2025/07/seo-poisoning-campaign-targets-8500.html

Malware#infosecnews#redditGermany+9

'Batavia' Windows spyware campaign targets dozens of Russian orgs Source: https://www.bleepingcomputer.com/news/security/batavia-windows-spyware-campaign-targets-dozens-of-russian-orgs/

Campaign#infosecnews#redditEstonia+8

TA829 and UNK_GreenSec Share Tactics and Infrastructure in Ongoing Malware Campaigns Source: https://thehackernews.com/2025/07/ta829-and-unkgreensec-share-tactics-and.html

Malware#infosecnews#redditGermany+7

Over 1,000 SOHO Devices Hacked in China-linked LapDogs Cyber Espionage Campaign Source: https://thehackernews.com/2025/06/over-1000-soho-devices-hacked-in-china.html

Campaign#infosecnews#redditGermany+9

New Stealthy Remcos Malware Campaigns Target Businesses and Schools Source: https://hackread.com/remcos-malware-campaigns-hit-businesses-and-schools/

Malware#infosecnews#redditGermany+6

|Reference: [Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails](https://www.varonis.com/blog/direct-send-exploit)| |:-| **Key Points:** * **Phishing Campaign:** Varonis' MDDR Forensics team uncovered a phishing campaign exploiting Microsoft 365's Direct Send feature. * **Direct Send Feature:** Allows internal devices to send emails without authentication, which attackers abuse to spoof internal users. * **Detection:** Look for external IPs in message headers, failures in SPF, DKIM, or DMARC, and unusual email behaviors. * **Prevention:** Enable "Reject Direct Send," implement strict DMARC policies, and educate users on risks. For technical details, please see more in reference (above). Could anyone share samples or real-world experiences about this *(for education and security monitoring)*?

Researchers Find Way to Shut Down Cryptominer Campaigns Using Bad Shares and XMRogue Source: https://thehackernews.com/2025/06/researchers-find-way-to-shut-down.html

Malware#infosecnews#redditGermany+7

China-linked LapDogs Campaign Drops ShortLeash Backdoor with Fake Certs Source: https://hackread.com/china-lapdogs-drops-shortleash-backdoor-fake-certs/

Malware#infosecnews#redditGermany+8

Fake DMV Texts Scam Hit Thousands in Widespread Phishing Campaign Source: https://hackread.com/fake-dmv-texts-scam-widespread-phishing-campaign/

Phishing#infosecnews#redditGermany+9

Akamai Report Warns of Sophisticated DDoS Campaigns Crippling Global Banks Source: https://hackread.com/sophisticated-ddos-campaigns-crippling-global-banks/

Botnet#infosecnews#redditUnited Kingdom+7

Russian APT29 Exploits Gmail App Passwords to Bypass 2FA in Targeted Phishing Campaign Source: https://thehackernews.com/2025/06/russian-apt29-exploits-gmail-app.html

Phishing#infosecnews#redditGermany+9

Discord flaw lets hackers reuse expired invites in malware campaign Source: https://www.bleepingcomputer.com/news/security/discord-flaw-lets-hackers-reuse-expired-invites-in-malware-campaign/

Malware#infosecnews#redditGermany+7

Cryptojacking campaign relies on DevOps tools

Campaign#infosecnews#redditGermany+5

From Infection to Access: A 24-Hour Timeline of a Modern Stealer Campaign

Campaign#infosecnews#redditGermany+7

Phishing Campaign: DBatLoader Delivers Remcos via UAC Bypass

Phishing#infosecnews#redditGermany+9