Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Matanbuchus 3.0, a malware loader available as Malware-as-a-Service, has evolved with significant updates. It now employs sophisticated techniques including improved communication protocols, in-memory stealth capabilities, enhanced obfuscation, and support for WQL queries, CMD, and PowerShell reverse shells. The loader collects detailed system data, including information on EDR security controls, to tailor subsequent attacks. It can execute various commands through regsvr32, rundll32, msiexec, or process hollowing. The malware establishes persistence through scheduled tasks and registry modifications. Recent campaigns have targeted victims through external Microsoft Teams calls impersonating IT helpdesks, leading to potential ransomware compromises.

Matanbuchus 3.0 is an advanced malware loader offered as Malware-as-a-Service (MaaS) that has recently undergone significant enhancements, making it a more potent threat in the cybercrime landscape. This loader is designed to facilitate ransomware attacks by first compromising victim systems through sophisticated infection chains. Notably, recent campaigns have leveraged social engineering via external Microsoft Teams calls, impersonating IT helpdesk personnel to gain initial access. Once deployed, Matanbuchus 3.0 employs multiple sophisticated techniques to evade detection and maintain persistence. It uses improved communication protocols for command and control (C2) interactions and incorporates in-memory stealth capabilities to avoid traditional endpoint detection and response (EDR) tools. The malware supports execution of Windows Management Instrumentation Query Language (WQL) queries, CMD, and PowerShell reverse shells, enabling flexible and stealthy command execution. It collects detailed system information, including the presence and configuration of EDR security controls, allowing attackers to tailor subsequent payloads and attack strategies. Execution techniques include leveraging legitimate Windows utilities such as regsvr32, rundll32, msiexec, and process hollowing, which further complicate detection efforts. Persistence is established through scheduled tasks and registry modifications, ensuring the malware remains active across reboots. The combination of social engineering via Microsoft Teams and the technical sophistication of the loader increases the likelihood of successful infiltration and ransomware deployment, posing a significant risk to targeted organizations.

MD5 of da9585d578f367cd6cd4b0e6821e67ff02eab731ae78593ab69674f649514872

MD5 of 211cea7a5fe12205fee4e72837279409ace663567c5b8c36828a3818aabef456

MD5 of 19fb41244558f3a7d469b79b9d91cd7d321b6c82d1660738256ecf39fe3c8421

MD5 of 0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c

SHA1 of da9585d578f367cd6cd4b0e6821e67ff02eab731ae78593ab69674f649514872

SHA1 of 0f41536cd9982a5c1d6993fac8cd5eb4e7f8304627f2019a17e1aa283ac3f47c

SHA1 of 19fb41244558f3a7d469b79b9d91cd7d321b6c82d1660738256ecf39fe3c8421

SHA1 of 211cea7a5fe12205fee4e72837279409ace663567c5b8c36828a3818aabef456

Detailed information about From a Teams Call to a Ransomware Threat: Matanbuchus 3.0 MaaS Levels Up. Get real-time updates, technical details, and mitigation st

Title	Severity	Type	Source	Date

Threats Tagged 'microsoft teams'

Filter Threats

Threats Tagged 'microsoft teams'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility