Threats Tagged 'supper'

Multiple ClickFix malware campaigns have been identified using three delivery methods: MSI packages with DLL sideloading, NodeJS-executed JavaScript, and Python 3.5 payload execution. These campaigns use aggressive social engineering, including phone calls directing victims to compromised WordPress sites. Post-compromise activities include extensive system discovery and Active Directory enumeration. The campaigns share infrastructure and tactics linked to the Lorem Ipsum malware family and Vanilla Tempest adversary, with potential ransomware deployment as a final goal.

The report details a malware attack on a large Polish organization involving fake CAPTCHA techniques. It describes the initial infection vector, where users were tricked into running malicious code through a Windows+R shortcut. The analysis covers two main malware families: Latrodectus (version 2.3) and Supper. The report provides technical details on the malware's functionality, communication protocols, and persistence mechanisms. It also includes indicators of compromise, such as C2 server IP addresses and file hashes. The authors emphasize the importance of employee education and monitoring for unusual events to mitigate such threats.

MediumMalwarePolandGermanyUnited Kingdom+7#fake captcha#latrodectus#c2 communication