“Restricted Area” is born: a new exclusive channel in Italian and English on the latest cyber security researcher JAMESWT hunting, documented with pictures. For the moment it’s open, but soon it will only be visible by subscription.
JAMESWT is the first Virus Total global contributor, with more that 531.227 reputation points. In addition to being a highly experienced Malware and Threat Hunter, he is also IT MANAGER, Data Center manager and Windows System-based administrator for a multinational company.
Cybercrime, double AgentTesla campaign via China and Türkiye
26 April 2023
The “URGENT REQUEST FOR PRICE OFFER” and “Ürün 56787898 için sipariş” email attachments contain an exe: the malware. Data is stolen via SMTP and Telegram API.
Cybercrime, the BlueStealer campaign from the UAE changes its template
7 April 2023
The attachment of the new "Document approval" email contains an exe: the malware. The stolen data is always exfiltrated to the same Telegram API C2.
Cybercrime, the “Hesap hareketleriniz” email carries Remcos
6 April 2023
A new zipped attachment contains an exe: the malware, while the text and C2s do not change from previous campaign waves.
Cybercrime, fake email from Maersk carries Lokibot
5 April 2023
The jar attachment of the email “Cargo Loading, BL : 2082688*** Container - MRKU8781602.” contains an exe: malware.
Cybercrime, Formbook hides in a fake email from Italy
4 April 2023
The IMG attachment of the “QUOTATION OP5000/4-23” message contains an exe: the malware.
Cybercrime, emails with Chinese boxes to hide AgentTesla
14 March 2023
The "Purchase Order 20000963.zip" attachment contains an img file with the "New Prices List" exe inside: the malware. The stolen data is exfiltrated via SMTP.
Cybercrime, AgentTesla uses the Chinese box trick
1 March 2023
The zip attachment of a email about a fake invoice contains an iso file with an exe inside: the malware. The stolen data is exfiltrated via SMTP to an email address.
Cybercrime, SnakeKeylogger passes by invoices in Turkey
28 February 2023
The “854F1E97-5DBB-4A87-A566-33D9012B05E2pdf.lzh” attachment of the “MEPAS E-Arsiv Fatura” email contains an exe: the malware. Stolen data is exfiltrated via Telegram API.
Cybercrime, new SnakeKeylogger campaign from Turkey
27 February 2023
The “854F1E97-5DBB-4A87-A566-33D9012B05E2” attachment of the “MEPAS E-Arsiv Fatura” email contains an exe: the malware. Stolen data is exfiltrated via Telegram API.
Cybercrime, new AgentTesla campaign from Poland
24 February 2023
The “Lista zamówień zakupu.7z” attachment contains the “Lista zamówień zakupu.exe” exe file: the malware. Stolen data is exfiltrated via Telegram API.
Cybercrime, double SnakeKeylogger campaign via couriers
22 February 2023
The 2 rar attachments of the message contain the same exe file: the malware. The stolen data is exfiltrated via smtp to an email address and via the Telegram API.
Cybercrime, HTML phishing campaign from China
17 February 2023
The lure is a fake “Payment from last shipment” image, that points to a false admin login page. The goal is to steal as many credentials as possible.
