Profiles of criminal groups, nation-state operators and emerging clusters: motivations, targeting, tradecraft and ATT&CK mappings.
62 reports
In the ever-evolving landscape of cyber threats, the UAC-0006 threat actor group has recently resurfaced with a new wave of attacks. This time, they're deploying the SmokeLoader malware through a…
In a recent report, the Computer Emergency Response Team of Ukraine (CERT-UA) has highlighted a significant increase in cyberattacks against the country's civil infrastructure websites,…
The notorious APT41 hacking group, known for their extensive cyber-espionage operations, has turned their attention to Android devices, deploying two newly discovered spyware strains, WyrmSpy and…
In a recent series of campaigns identified by Proofpoint, university students have been targeted with fraudulent job offers purportedly related to bioscience and health entities. These campaigns,…
Anonymous Sudan, a threat actor group that emerged in January 2023, has been making headlines with its global cyberattacks. The group has targeted a wide range of countries and sectors, including…
In a fascinating turn of events, a threat actor known by the online moniker 'La_Citrix' inadvertently exposed their real identity by infecting their own computer with an information stealer. This…
In the ever-evolving landscape of cyber threats, the financially motivated cybercrime group known as FIN8 continues to make waves. Known for their sporadic yet impactful attacks, FIN8 has been…
"Welcome to New York: Exploring TA453's Foray into LNKs and Mac Malware" published by Proofpoint discusses the evolving tactics of TA453, also known as Charming Kitten, APT42, Mint Sandstorm, and…
In the ever-evolving landscape of cybersecurity, threat actors continue to innovate and adapt their methods to exploit new technologies and platforms. One such group, known as TeamTNT, has been…
Black Basta is a Russian-speaking group that was first spotted in early 2022. It is known for its double extortion attack, where it not only executes ransomware but also exfiltrates sensitive…
SmokeLoader, also known as Dofoil, is a modular bot used primarily to download other malware onto a compromised system. It has been in operation since at least 2011 and has been used in various…
