Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Check Point Research

Kaspersky Security Blog

CVE Database V5

Reddit NetSec

Reddit InfoSec News

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Dark Reading

Threatpost

Exploit-DB RSS Feed

The Hacker News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated phishing campaign has been identified, utilizing carefully crafted emails to deliver malicious URLs linked to convincing phishing pages. These pages entice recipients to download JavaScript files that act as droppers for UpCrypter, a malware that ultimately deploys various remote access tools (RATs). The attack chain begins with obfuscated scripts redirecting victims to spoofed sites personalized with the target's email domain. The campaign uses different lures, including voicemail-themed and purchase order-themed emails. UpCrypter, the central loader framework, stages and deploys multiple RATs, including PureHVNC, DCRat, and Babylon RAT. The malware employs anti-VM and anti-analysis techniques, downloads additional payloads, and establishes persistence. This campaign operates globally, affecting multiple industries, and demonstrates an adaptable threat delivery ecosystem capable of bypassing defenses and maintaining persistence across different environments.

This threat describes a sophisticated phishing campaign leveraging UpCrypter, a malware loader framework, to deliver multiple remote access tools (RATs) such as PureHVNC, DCRat, and Babylon RAT. The attack begins with carefully crafted phishing emails that contain malicious URLs leading to convincing spoofed phishing pages. These pages are personalized with the target's email domain to increase credibility and entice victims to download obfuscated JavaScript files. These scripts act as droppers that initiate the deployment of UpCrypter. UpCrypter then stages and deploys various RATs capable of remote control, data exfiltration, and persistence on infected systems. The malware employs advanced evasion techniques including anti-virtual machine (anti-VM) and anti-analysis methods to avoid detection by security tools and researchers. It also downloads additional payloads dynamically and establishes persistence mechanisms to maintain long-term access. The campaign uses multiple social engineering lures, such as voicemail notifications and purchase order themes, to target a broad range of industries globally. The threat actors behind this campaign have built an adaptable delivery ecosystem that can bypass defenses and maintain footholds across diverse environments. The use of multiple RATs and obfuscation techniques indicates a modular and flexible attack infrastructure designed for stealth and persistence. The campaign is ongoing and global, with no specific affected software versions noted, and no known public exploits beyond the phishing vector. The threat is rated medium severity by the source, reflecting its complexity and potential impact but also the requirement for user interaction and phishing delivery.

Detailed information about Phishing Campaign Targeting Companies via UpCrypter. Get real-time updates, technical details, and mitigation strategies.

Phishing Campaign Targeting Companies via UpCrypter - Live Threat Intelligence - Threat Radar | OffSeq.com

Phishing Campaign Targeting Companies via UpCrypter

Title	Severity	Type	Source	Date

Threats Tagged 'babylon rat'

Filter Threats

Scan a website for live threats in under a minute

Threats Tagged 'babylon rat'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility