Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

netskope

PureHVNC RAT Using Fake High-level Job Offers from Fashion and Beauty Brands

May 28, 2025 By Leandro Fróes In Netskope
In recent months, the Netskope Threat Labs team has observed several different campaigns delivering the PureHVNC RAT and its plugins. In 2024, the same malware was observed being delivered via a Python chain, and a few days ago, it was also observed using genAI sites to lure victims. In this blog post, we’ll describe an infection chain using different methods to lure the victim and successfully deliver the PureHVNC RAT.
Read Post
bitsight

What Is a Remote Access Trojan (RAT), and Why Should You Care?

May 28, 2025 By Emma Stevens In BitSight
According to our 2025 State of the Underground report—in which we take a look back at cybercrime on the deep and dark web from the past year—384 unique varieties of malware were sold in 2024, an increase from 349 in 2023. To determine this number, our research team examined malware and hacking tools for sale on the top three criminal forums, and as a result, we found that Remote Access Trojans (RATs) were the second most common form of malware in 2024, just behind stealer malware.
Read Post
Trustwave

PhaaS the Secrets: The Hidden Ties Between Tycoon2FA and Dadsec's Operations

May 28, 2025 By Cris Tomboc and King Orande In Trustwave
Since September 2023, Trustwave’s Threat Intelligence Team has been tracking a large-scale phishing campaign distributed via email, attributed to "Storm-1575". Storm-1575 is known for developing and distributing a PhaaS platform with adversary-in-the-middle (AiTM) capabilities, known as "Dadsec". The team’s recent investigations have revealed that the infrastructure used by Dadsec is also connected to a new campaign leveraging the "Tycoon2FA" Phishing-as-a-Service (PhaaS) platform.
Read Post

May 27, 2025 Cyber Threat Intelligence Briefing

May 27, 2025 By Kroll In Kroll
This week’s briefing covers: Joint Cybersecurity Advisory released on KTA007 (APT28) A joint advisory has been released warning of Russian-attributed threat actors targeting western logistics entities and technology companies since 2022. Microsoft leads global action to disrupt LUMMASTEALER Microsoft’s Digital Crimes Unit has recently seized and facilitated the takedown, suspension, and blocking of approximately 2,300 malicious domains that formed the backbone of LUMMASTEALER infrastructure.
View Video
splunk

What Is Extortionware? Going Beyond Ransomware

May 27, 2025 By Shaun Quarton In Splunk
Extortionware involves stealing sensitive data from an organization and threatening to leak it. It’s become a core tactic in the modern ransomware playbook, and if your business holds valuable or confidential information, it’s a threat you can’t afford to ignore. Today, we’re taking a closer look at what extortionware is, how it works, and why it’s become one of the most difficult cyber threats to defend against.
Read Post
Featured Post
Why Codefinger represents a new stage in the evolution of ransomware

Why Codefinger represents a new stage in the evolution of ransomware

May 27, 2025 By Justin Giardina, Chief Technology Officer In 11:11 Systems
Forget typical ransomware! Codefinger hijacked cloud keys directly, exposing backup flaws and shared responsibility risks. Time to rethink defence. If you didn't pay much attention to news of the recent Codefinger ransomware attack, it's possibly because ransomware has become so prevalent that major incidents no longer feel notable. But Codefinger is not just another ransomware breach to add to the list of incidents where businesses lost sensitive data to attackers. In key respects, Codefinger represents a substantially new type of ransomware attack.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.