New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
Afghan telecom providers and South Asian critical infrastructure organizations are the targets of a new campaign delivering a previously undocumented backdoor called…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
PATCHCORD Backdoor: New Implant Targets Afghan Telecom and Indian Energy Sector
PATCHCORD is a previously undocumented C/C++ backdoor delivered via fake VPN installers and telecom management tools. It establishes persistence by hijacking browser…
SHEETCORD: Go-Based Backdoor Uses Google Sheets for C2
SHEETCORD is a Go-based backdoor that uses Google Sheets API for command-and-control. It is delivered via a fake NIC website and combines…
SHEETCREEP: Malware Family with Google Sheets C2
SHEETCREEP is a malware family that uses Google Sheets for C2 communications. It is referenced as a predecessor to SHEETCORD, which combines…
AmnesiaStealer: New Rust-Based macOS Malware Hijacks Chromium Sessions for Live Browser Control
Cybersecurity researchers have uncovered a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that hijacks Chromium web browsers to steal session data and…
AmnesiaStealer: macOS Malware with Hidden Browser Control
AmnesiaStealer is a malware strain targeting macOS users, featuring a stream_module that grants operators hidden, interactive control over a Chromium browser via…
WindRelay Android Malware Turns Phones into NFC Relays for Payment Fraud
Cybersecurity researchers at Group-IB have uncovered a new Android malware family called WindRelay that turns victims' smartphones into NFC relays for contactless…
WindRelay: New Android NFC Relay Malware
WindRelay is a previously unseen Android NFC relay malware family documented by Group-IB. It is deployed alongside the SpyNote RAT in live-call…
Troy Backdoor: New Malware Used by Lazarus Group
Troy is a previously unseen backdoor deployed by the Lazarus Group in Operation Dream Job attacks. It is loaded directly into memory…
MISTPEN Downloader: Lightweight Malware Loader
MISTPEN is a lightweight downloader used by Lazarus Group to communicate with C2 servers via Microsoft Graph API and OneDrive. It retrieves…