Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The S2 Group’s intelligence team has identified through adversary tracking a new phishing campaign by Snake Keylogger, a Russian origin stealer programmed in .NET, targeting various types of victims, such as companies, governments or individuals. The campaign has been identified as using spearphishing emails offering oil products.

The Snake Keylogger is a malware strain originating from Russia, identified as a .NET-based stealer primarily used in targeted phishing campaigns. It is designed to capture sensitive information such as credentials and other personal data by logging keystrokes and potentially harvesting system information. The recent campaign tracked by the S2 Group targets a broad spectrum of victims, including companies, government entities, and individuals, using spearphishing emails themed around oil product offers. This thematic choice likely aims to exploit geopolitical interests and economic sectors related to energy, increasing the likelihood of successful compromise. The malware is distributed via spearphishing, a highly targeted form of phishing that uses personalized messages to deceive recipients. The campaign abuses trusted Java utilities, indicating a sophisticated approach to evade detection by leveraging legitimate software components. The malware is categorized under multiple MITRE ATT&CK techniques such as T1027 (Obfuscated Files or Information), T1082 (System Information Discovery), T1555 (Credentials from Password Stores), T1566.001 (Spearphishing Attachment), T1574.002 (Hijack Execution Flow: DLL Side-Loading), and T1588.002 (Obtain Capabilities: Malware-as-a-Service), highlighting its multifaceted attack vectors and capabilities. Although no known exploits in the wild are reported, the malware operates as Malware-as-a-Service (MaaS), suggesting it is accessible to various threat actors, potentially increasing its proliferation. The campaign’s geopolitical context and targeting of strategic sectors underscore its relevance in cybercrime operations linked to geopolitical affairs.

MD5 of fe223090ea59abc54312c48ed89765ea5c8821df78134adc094cd799973dde39

MD5 of b33d93e82b4a964c1306d40b054e6a2703e050357a513ab8873651dd4d669f4b

MD5 of 6d7158bf300a5a8769d106500a60141e63436bfc35cab1d24e047aad1dc880ce

MD5 of f099cb320a26b6284e9ca24b352b19d2109bb3df0beeded3c34377c9b934ed3b

MD5 of 54468a4c1261c1c3f4136854c29a50080be77416d040b083ac51776c957a1182

MD5 of 830703e20378110b1db917fcd498fa731aafed37fb1055c002693662053ad13c

SHA1 of fe223090ea59abc54312c48ed89765ea5c8821df78134adc094cd799973dde39

SHA1 of 830703e20378110b1db917fcd498fa731aafed37fb1055c002693662053ad13c

SHA1 of 54468a4c1261c1c3f4136854c29a50080be77416d040b083ac51776c957a1182

SHA1 of 6d7158bf300a5a8769d106500a60141e63436bfc35cab1d24e047aad1dc880ce

SHA1 of b33d93e82b4a964c1306d40b054e6a2703e050357a513ab8873651dd4d669f4b

SHA1 of f099cb320a26b6284e9ca24b352b19d2109bb3df0beeded3c34377c9b934ed3b

Detailed information about Snake Keylogger in Geopolitical Affairs: Abuse of Trusted Java Utilities in Cybercrime Operations. Get real-time updates, technical d

Snake Keylogger in Geopolitical Affairs: Abuse of Trusted Java Utilities in Cybercrime Operations - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'snake keylogger'

Filter Threats

Threats Tagged 'snake keylogger'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility