Leveling Up with NightSpire Ransomware

NightSpire ransomware, first discovered in February 2025, presents a categorization challenge regarding whether it operates as Ransomware-as-a-Service (RaaS). Analysis of two incidents from December 2025 and March 2026 reveals significant variations in tactics, techniques, and procedures between attacks. The March 2026 incident involved threat actors installing Chrome Remoting Desktop and AnyDesk for persistence, using Everything and 7Zip for data staging, MEGASync for exfiltration, and deploying VMWare Workstation and WPS Office. The attacker accessed systems via RDP days before detection. Comparison with the December 2025 incident shows evolution in the ransomware encryptor, including modified ransom note filenames and contents. These variations in TTPs and indicators suggest either operational evolution or involvement of multiple affiliates, demonstrating that ransomware indicators aren't consistent across campaigns.

Pulse ID: 69d61cc749755c1135d6faa9
Pulse Link: https://otx.alienvault.com/pulse/69d61cc749755c1135d6faa9
Pulse Author: AlienVault
Created: 2026-04-08 09:15:51

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#7Zip #AnyDesk #Chrome #CyberSecurity #ICS #InfoSec #OTX #Office #OpenThreatExchange #RAT #RDP #RaaS #RansomWare #RansomwareAsAService #VMware #ZIP #bot #AlienVault

North Korea's Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

A North Korean threat operation has published malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist, impersonating legitimate developer tooling. The campaign uses GitHub aliases including golangorg and aokisasakidev to distribute staged malware loaders that contact actor-controlled infrastructure, retrieve payloads from Google Drive, and deliver platform-specific second-stage malware. The loaders are hidden behind normal-looking API functions in logging and utility libraries. Windows variants include full remote access trojans with capabilities for shell execution, keylogging, browser and wallet theft, sensitive file collection, and AnyDesk deployment. The operation demonstrates coordinated cross-ecosystem supply chain attacks with shared infrastructure patterns, reused extraction directories, and consistent staging logic across multiple programming languages.

Pulse ID: 69d61d25c472b8eb580c2996
Pulse Link: https://otx.alienvault.com/pulse/69d61d25c472b8eb580c2996
Pulse Author: AlienVault
Created: 2026-04-08 09:17:25

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AnyDesk #Browser #CyberSecurity #GitHub #Golang #Google #InfoSec #Korea #Malware #NPM #NorthKorea #OTX #OpenThreatExchange #PyPI #RAT #RemoteAccessTrojan #SupplyChain #Trojan #Troll #Windows #bot #AlienVault

📢 The Gentlemen : analyse complète des TTPs du nouveau groupe RaaS issu de Qilin
📝 ## 🔍 Contexte

Publié le 22 mars 2026 par Group-IB, ce rapport analyse en profondeur les tactiques, techniques et procédures (TTPs) du groupe **The Gent...
📖 cyberveille : https://cyberveille.ch/posts/2026-03-22-the-gentlemen-analyse-complete-des-ttps-du-nouveau-groupe-raas-issu-de-qilin/
🌐 source : https://www.group-ib.com/blog/hastalamuerte-gentlemen-raas-ttps/
#AntSword #AnyDesk #Cyberveille

Ich bekomme einen Scam-Anruf:

"Ihr Konto mit 1,[…] BTC ist gesperrt. Möchten Sie das Geld abheben?"
"Ja!"
"Wann und bei welcher Bank haben Sie investiert?"
"Ähm, weiß ich gar nicht mehr, ähm, bei der #Sparkasse?"
"Wie viel haben Sie investiert?"
"Fünf."
…
[Schweigen]
…
"Haben Sie #AnyDesk auf Ihrem Computer?"

🤣 🤣 🤣

#scam #telefonbetrug #betrüger