Threats Tagged 't1560'

A spear-phishing campaign attributed to the Rare Werewolf group targets Russian aerospace and aviation organizations. The attack uses fraudulent emails impersonating a Russian aerospace research institute, delivering password-protected archives with malicious installers. It abuses legitimate tools such as AnyDesk, Blat, WinRAR, and Tray Minimizer to establish persistent remote access. The campaign configures portable AnyDesk for unattended access with a predefined password, exfiltrates configuration data via SMTP, and maintains persistence through scheduled tasks. The operators conceal their presence by minimizing the AnyDesk interface and removing forensic artifacts. This campaign aligns with previous Rare Werewolf activity targeting strategic sectors in Russia, Belarus, and Kazakhstan.

MediumCampaignRussia#scheduled task persistence#remote access tool#aerospace targeting

An active malware campaign is targeting Thailand's healthcare sector, including Ministry of Health personnel and affiliated organizations. The operation leverages healthcare-themed spear-phishing lures distributed through malicious RAR archives containing obfuscated batch scripts and executable payloads. The infection chain employs multiple stages of obfuscation, GitHub-hosted payload delivery, and persistence mechanisms. The final payload is a Python-based information stealer designed to harvest browser credentials, session data, and cookies, with exfiltration attempts through Telegram Bot API. The campaign demonstrates sophisticated tradecraft including Rouki-obfuscated batch loaders, Startup folder persistence, and bundled Python interpreters. Active operational window spans from April to June 2026, with all samples uploaded from Thailand.

MediumMalwareThailand#batch script obfuscation#github payload hosting#python stealer

Since late 2025, cybercriminals have been exploiting Wallpaper Engine, a popular live wallpaper application on Steam, to distribute malware through Steam Workshop. Attackers target primarily Chinese and Russian gamers by embedding malicious code within application wallpapers shared on the platform. These compromised wallpapers deliver various malware types including infostealers, backdoors, crypto miners, and ransomware. One analyzed sample dropped DarkKomet backdoor while hijacking Steam sessions to steal account credentials. The malware modifies system libraries to locate Steam installations and exfiltrate data to attacker-controlled servers. Compromised accounts are then used to upload additional malicious wallpapers. The diverse malware families suggest multiple independent hacking groups are exploiting this distribution method. Infected wallpapers received thousands of downloads before removal, with 89% of infections occurring in China.

MediumMalwareBritish Indian Ocean TerritoryCanadaChina+5#account hijacking#vidar#wallpaper engine