Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The complete source code for ERMAC V3.0, an advanced banking trojan, was discovered and analyzed, providing rare insight into this active Malware-as-a-Service platform. ERMAC has evolved to target over 700 financial and cryptocurrency apps, employing sophisticated form injection techniques and encrypted communications. The analysis revealed critical vulnerabilities, including hardcoded credentials and default tokens, which could be exploited to disrupt operations. The malware's infrastructure consists of a Laravel-based C2 backend, React control panel, Golang exfiltration service, and an obfuscated Android backdoor. This comprehensive examination exposes the operational risks of the MaaS model and equips defenders with concrete methods to track, detect, and disrupt active ERMAC campaigns.

ERMAC V3.0 is an advanced banking trojan whose complete source code was leaked and subsequently analyzed, providing rare insight into its Malware-as-a-Service (MaaS) operational model. This trojan targets over 700 financial and cryptocurrency applications, leveraging sophisticated form injection techniques to intercept user credentials and financial data. It employs encrypted communications to evade detection and maintain stealth. The malware infrastructure is complex, consisting of a Laravel-based command and control (C2) backend, a React-based control panel, a Golang exfiltration service, and an obfuscated Android backdoor component. Notably, the source code leak revealed critical operational vulnerabilities such as hardcoded credentials and default tokens within the malware infrastructure, which could be exploited by defenders or attackers to disrupt or hijack the malware operations. ERMAC uses multiple advanced techniques including hooking (T1056.001), encrypted communications (T1071), persistence mechanisms (T1053), credential dumping (T1005), obfuscation (T1027), and user execution (T1204). The MaaS model allows multiple threat actors to deploy customized versions of ERMAC, increasing its threat surface. Although no known exploits are currently active in the wild, the availability of the full source code increases the risk of new variants or attacks emerging. The analysis equips defenders with concrete methods to detect, track, and disrupt ERMAC campaigns by monitoring known indicators such as specific file hashes and IP addresses associated with its infrastructure.

Detailed information about ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis. Get real-time updates, technical details, and mitigatio

ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis

This report examines recent activities attributed to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware since March 2025. The investigation stemmed from analyzing a vulnerability in LNK files, leading to the discovery of a multi-stage infection chain. The report provides analysis of the XDigo implant and its connections to previous XDSpy activities. It also details the exploitation of LNK parsing issues and infrastructure used across different campaigns. The research uncovered additional, more recent XDSpy activity employing an alternative infection chain. Targets include government entities in Eastern Europe, with a confirmed victim in Belarus.

The threat known as SadFuture represents the latest evolution of the XDSpy threat actor's activities, focusing on a sophisticated multi-stage malware campaign targeting governmental entities primarily in Eastern Europe and Russia. The campaign has been active since at least March 2025 and centers around the deployment of the XDigo implant, a malware strain linked to previous XDSpy operations. The infection chain exploits a vulnerability in the parsing of LNK (Windows shortcut) files, enabling initial compromise without requiring user authentication but potentially involving user interaction to trigger the payload. This exploitation leverages Windows' handling of LNK files to execute malicious code, a technique that bypasses some traditional security controls. The campaign infrastructure and tactics have evolved, with recent activity showing an alternative infection chain, indicating adaptability and ongoing development by the threat actor. The attack techniques include a range of tactics and procedures such as etdownloader usage, living-off-the-land binaries (LOLBins) exploitation (e.g., T1218.011), credential dumping, data staging, and command and control communications, reflecting a comprehensive and persistent attack methodology. The confirmed targeting of government entities, including a victim in Belarus, underscores the geopolitical motivations behind the campaign. The threat actor's use of multiple techniques to maintain persistence, evade detection, and exfiltrate data highlights the advanced nature of this threat. No known public exploits are currently reported, but the exploitation of LNK parsing vulnerabilities remains a critical vector. The campaign's complexity and targeted nature suggest a well-resourced adversary with significant operational capabilities.

Detailed information about SadFuture: Mapping XDSpy latest evolution. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'infrastructure analysis'

Filter Threats

Threats Tagged 'infrastructure analysis'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility