Threats Tagged 't1525'

A new payload in the TeamPCP arsenal has been discovered, capable of wiping entire Kubernetes clusters. The script uses the same ICP canister as the CanisterWorm campaign, with consistent lateral movement via DaemonSets. However, this variant introduces a geopolitically targeted destructive payload aimed specifically at Iranian systems. The malware checks timezone and locale to identify Iranian systems, deploying privileged DaemonSets across every node in Kubernetes environments. Iranian nodes are wiped and force-rebooted, while non-Iranian nodes receive the CanisterWorm backdoor. The latest variant adds network-based lateral movement, exploiting exposed Docker APIs and using SSH for spread. This development shows TeamPCP's ability to operate at supply chain scale and their willingness to engage in destructive actions.

MediumMalwareIranUnited StatesChina+7#docker api#canisterworm#kubernetes

This article explores the misuse of QR codes in phishing attacks, focusing on three key areas: QR codes with URL shorteners concealing malicious destinations, in-app deep links used to steal credentials and control victims' apps, and QR codes bypassing app store security via direct malicious app downloads. The research reveals an average of 11,000 daily detections of malicious QR codes, with financial services being the most targeted industry. Attackers are leveraging QR code shorteners, in-app deep links, and direct downloads to evade security controls and exploit users' trust in QR codes. The article highlights specific attack scenarios, including account takeovers through messaging apps and distribution of suspicious gambling apps.

MediumMalwareUkraine#phishing#mobile security#url shorteners

A large-scale attack infrastructure dubbed TruffleNet has been identified, built around the open-source tool TruffleHog. This infrastructure is used to systematically test compromised credentials and perform reconnaissance across AWS environments. The campaign involves over 800 unique hosts across 57 distinct Class C networks, characterized by consistent configurations and the use of Portainer. Alongside TruffleNet, adversaries are exploiting Amazon Simple Email Service (SES) to facilitate Business Email Compromise (BEC) campaigns. The attackers create email identities using compromised WordPress sites and conduct aggressive cloud reconnaissance. This activity highlights the evolving tactics of threat actors in exploiting cloud infrastructure at scale, combining credential theft, reconnaissance automation, and SES abuse to conduct high-volume fraud with minimal detection.

MediumMalwareGermanyUnited KingdomFrance+7#identity compromise#trufflehog#credential abuse

A new tech support scam campaign exploits Microsoft's trusted brand to deceive users. It starts with phishing emails promising payments, leading victims to fake CAPTCHA challenges. After completion, users are redirected to a browser-locked landing page mimicking ransomware, with multiple pop-ups resembling Microsoft security alerts. These pop-ups urge victims to call a fraudulent support number, enabling phone-based social engineering. The scam combines browser manipulation, phishing, and social engineering to potentially gain system access. No direct malware or exploits are involved, but the psychological manipulation can lead to financial loss or unauthorized access. The campaign underscores the risks of trusting familiar branding without verification and highlights the need for user awareness and layered defenses. Indicators include multiple malicious URLs and domains used in the campaign. The threat is medium severity due to its social engineering nature and potential impact on confidentiality and integrity.

MediumCampaignGermanyFranceItaly+7#microsoft impersonation#browser manipulation#tech support scam