GhostPoster: Browser Extension Malware Campaign
GhostPoster is a browser extension malware campaign associated with DarkSpectre. It uses steganography to hide malicious code in extension icons, similar to…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
DarkSpectre: Chinese Threat Actor Behind Browser Extension Malware
DarkSpectre is a Chinese threat actor linked by Koi Security to the StegoAd campaign. It has been active since at least 2021,…
Fake Font: Malicious npm and Go Packages Disguised as Font Files
A cluster of malicious packages that use fake .woff2 font files to conceal JavaScript payloads. Tactically overlaps with TaskJacker and PolinRider, using…
North Korean Cyber Operations Linked to NullReceiver
North Korean threat actors have been linked to the NullReceiver campaign, which uses trojanized npm packages to deploy malware that decodes C2…
Ukraine and FBI Uncover Russian Intelligence Campaign Using Fake Support Texts to Steal Messaging Credentials
The Security Service of Ukraine (SSU), in coordination with the U.S. Federal Bureau of Investigation (FBI), has uncovered a long-running cyber espionage…
Star Blizzard: Russian Threat Actor Targeting Messaging Platforms
Star Blizzard is a Russian threat activity cluster known for phishing campaigns targeting messaging app users, including Signal and WhatsApp, to steal…
UNC1151 (Ghostwriter, UAC-0057): Belarus-Aligned Threat Actor
UNC1151, also known as Ghostwriter and UAC-0057, is a Belarus-aligned threat actor that conducted spear-phishing campaigns targeting Ukrainian government organizations, delivering the…
Ghostwriter — Attack group profile
Ghostwriter was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys
The FBI and CISA have updated their March warning about Russian intelligence phishing Signal accounts, adding a new tactic where attackers coax…
UNC5792 (UAC-0195): Russian Cyber Espionage Group
UNC5792, also tracked as UAC-0195, is a Russian threat cluster involved in credential theft campaigns against messaging platforms, targeting government and military…