Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated cyberattack campaign targeted the Russian IT industry and other entities globally in late 2024. The attackers used social media profiles and popular websites to deliver payload information, bypassing detection methods. They employed spear phishing emails with malicious RAR archives, exploiting DLL hijacking techniques to deploy Cobalt Strike Beacon. The campaign used profiles on GitHub, Microsoft Learn Challenge, Quora, and Russian social networks to conceal activities. The attacks primarily focused on Russian companies but also affected organizations in China, Japan, Malaysia, and Peru. The complexity of the methods used highlights the evolving tactics of threat actors in concealing well-known tools and emphasizes the need for robust cybersecurity measures.

This threat describes a sophisticated cyberattack campaign identified in late 2024 that primarily targeted the Russian IT industry but also affected organizations in China, Japan, Malaysia, and Peru. The attackers leveraged popular online platforms, including social media profiles and well-known websites such as GitHub, Microsoft Learn Challenge, Quora, and Russian social networks, to serve as command and control (C2) servers. This tactic allowed them to bypass traditional detection mechanisms by hiding C2 communications within legitimate platform traffic, complicating network monitoring and incident response efforts.

The initial infection vector involved spear phishing emails containing malicious RAR archives. Upon extraction, these archives exploited DLL hijacking vulnerabilities (technique T1574.001) to execute malicious payloads. DLL hijacking involves placing a malicious DLL in a location where a legitimate application loads it unknowingly, enabling code execution under the context of trusted processes. The payload deployed was the Cobalt Strike Beacon, a widely used post-exploitation tool that provides remote access, lateral movement capabilities, and payload delivery. The attackers further employed API obfuscation and shellcode techniques to evade detection and maintain persistence.

The use of legitimate online platforms as C2 infrastructure is a notable evolution in attacker tactics, as it leverages trusted domains and encrypted traffic to mask malicious communications. This approach complicates traditional signature-based detection and network filtering. The campaign's complexity and use of well-known tools in novel ways underscore the increasing sophistication of threat actors in targeted attacks. Although the campaign focused on Russian entities, the global footprint indicates a broader threat landscape.

Indicators of compromise include multiple file hashes associated with the malicious payloads and URLs linked to the delivery infrastructure. No CVE identifiers or known exploits in the wild are associated with this campaign, suggesting it relies on social engineering and exploitation of common DLL hijacking weaknesses rather than zero-day vulnerabilities.

Detailed information about Targeted attacks leverage accounts on popular online platforms as C2 servers. Get real-time updates, technical details, and mitigatio

Targeted attacks leverage accounts on popular online platforms as C2 servers - Live Threat Intelligence - Threat Radar | OffSeq.com

Targeted attacks leverage accounts on popular online platforms as C2 servers

A sophisticated malware campaign is targeting financial services in Hong Kong with SquidLoader, a highly evasive malware that deploys Cobalt Strike Beacon for remote access. The malware exhibits advanced anti-analysis, anti-sandbox, and anti-debugging techniques, achieving near-zero detection rates on VirusTotal. The attack chain is complex and poses a significant threat to targeted organizations. The analysis provides detailed technical insights into SquidLoader's features and indicators of compromise, including SHA256 hashes for samples found in Hong Kong, Singapore, China, and Australia. The campaign utilizes multiple command and control servers, primarily mimicking Kubernetes API endpoints.

The SquidLoader malware campaign represents a sophisticated and targeted threat primarily aimed at financial institutions in Hong Kong, with observed samples also in Singapore, China, and Australia. SquidLoader is a highly evasive malware strain that deploys the Cobalt Strike Beacon payload to establish remote access and command-and-control (C2) capabilities. This malware employs advanced anti-analysis, anti-sandbox, and anti-debugging techniques to evade detection, achieving near-zero detection rates on VirusTotal, which indicates its stealth and sophistication. The attack chain is complex, leveraging multiple C2 servers that mimic Kubernetes API endpoints, a tactic designed to blend malicious traffic with legitimate cloud-native infrastructure communications, thereby complicating detection efforts. Indicators of compromise include multiple IP addresses and SHA256 hashes associated with the malware samples. The malware leverages various MITRE ATT&CK techniques such as system information discovery (T1082), file deletion (T1140), process injection (T1055), command execution (T1059), file and directory discovery (T1083), indicator removal on host (T1497), network traffic proxy (T1588.002), obfuscated files or information (T1027), and encrypted communication (T1573). The campaign's focus on financial services highlights its intent to infiltrate high-value targets, potentially for espionage, data theft, or financial fraud. Although no known exploits in the wild are reported, the complexity and stealth of SquidLoader pose a significant threat to organizations that may be unprepared for such advanced persistent threats.

Detailed information about New Wave of SquidLoader Malware Targeting Financial Institutions. Get real-time updates, technical details, and mitigation strategies

New Wave of SquidLoader Malware Targeting Financial Institutions - Live Threat Intelligence - Threat Radar | OffSeq.com

New Wave of SquidLoader Malware Targeting Financial Institutions

The article details malware and tactics used in attacks targeting Ivanti Connect Secure vulnerabilities from December 2024 to July 2025. It describes MDifyLoader, a loader based on libPeConv, which deploys Cobalt Strike Beacon through DLL side-loading. The attackers also utilized vshell, a multi-platform RAT, and Fscan, a network scanning tool. After gaining initial access, the threat actors performed lateral movement using brute-force attacks, exploited vulnerabilities, and used stolen credentials. They established persistence by creating domain accounts and registering malware as services or scheduled tasks. The attackers employed various evasion techniques, including the use of legitimate files and ETW bypasses.

This threat involves a sophisticated malware campaign exploiting vulnerabilities in Ivanti Connect Secure devices, specifically linked to CVE-2025-0282. The attackers use a loader named MDifyLoader, which is based on the libPeConv library, to deploy the Cobalt Strike Beacon payload through DLL side-loading techniques. This approach allows the malware to evade detection by masquerading as legitimate DLL files. Additionally, the attackers employ vshell, a multi-platform remote access Trojan (RAT), and Fscan, a network scanning tool, to facilitate reconnaissance and lateral movement within compromised networks. Initial access is achieved by exploiting the Ivanti Connect Secure vulnerabilities, followed by brute-force attacks and the use of stolen credentials to expand footholds. Persistence mechanisms include creating domain accounts and registering malware as Windows services or scheduled tasks, ensuring long-term access. The attackers also utilize multiple evasion techniques such as leveraging legitimate files and bypassing Event Tracing for Windows (ETW) to avoid detection by security monitoring tools. The tactics align with several MITRE ATT&CK techniques including T1053.005 (Scheduled Task), T1110.001 (Brute Force), T1133 (External Remote Services), T1543.003 (Windows Service), T1140 (Deobfuscate/Decode Files or Information), T1036 (Masquerading), T1021.002 (SMB/Windows Admin Shares), T1087 (Account Discovery), T1136.002 (Create Account), T1210 (Exploitation of Remote Services), T1098 (Account Manipulation), T1562.001 (Disable or Modify Tools), T1573 (Encrypted Channel), T1070.004 (File Deletion), and T1021.001 (Remote Services). Although no known exploits in the wild have been reported yet, the presence of active malware campaigns exploiting these vulnerabilities indicates a credible threat to organizations using Ivanti Connect Secure products.

Detailed information about Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities. Get real-time updates, technical details, and mitigat

Title	Severity	Type	Source	Date

Threats Tagged 'cobalt strike beacon'

Filter Threats

Threats Tagged 'cobalt strike beacon'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility