Bookworm Malware and PlugX RATs Target Asian Networks

Pulse ID: 68d8208d01f0822bb2affc1e
Pulse Link: https://otx.alienvault.com/pulse/68d8208d01f0822bb2affc1e
Pulse Author: cryptocti
Created: 2025-09-27 17:36:13

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #PlugX #RAT #Worm #bot #cryptocti

Bookworm Malware and PlugX RATs Target Asian Networks

Pulse ID: 68d8209726f669c4eb1de314
Pulse Link: https://otx.alienvault.com/pulse/68d8209726f669c4eb1de314
Pulse Author: cryptocti
Created: 2025-09-27 17:36:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #PlugX #RAT #Worm #bot #cryptocti

North Korean Threat Actor Group Launches Proxy Interview Schemes

Malware operators aligned with North Korea have forged a sophisticated partnership with covert IT workers to target corporate organizations worldwide.

Pulse ID: 68d6f956b7615bdda6c86bbe
Pulse Link: https://otx.alienvault.com/pulse/68d6f956b7615bdda6c86bbe
Pulse Author: cryptocti
Created: 2025-09-26 20:36:38

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Korea #Malware #NorthKorea #OTX #OpenThreatExchange #Proxy #RAT #bot #cryptocti

Botnet Loader-as-a-Service Infrastructure Distributing RondoDoX and Mirai Payloads

A sophisticated botnet operation employing a Loader-as-a-Service model was uncovered through exposed command and control logs spanning six months. The campaign systematically targets SOHO routers, IoT devices, and enterprise applications through command injection vulnerabilities in web interfaces. Key attack vectors include exploiting unsanitized POST parameters, leveraging default credentials, and targeting known CVEs in various systems. The operation showed a 230% attack spike from July-August 2025, deploying multi-architecture malware including Morte binaries and cryptomining payloads. With rapid infrastructure rotation and diverse malware, the threat is evolving rapidly, necessitating early detection and robust defense measures.

Pulse ID: 68d5ce6bb2658315c0cc3890
Pulse Link: https://otx.alienvault.com/pulse/68d5ce6bb2658315c0cc3890
Pulse Author: AlienVault
Created: 2025-09-25 23:21:15

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CryptoMining #CyberSecurity #InfoSec #IoT #Malware #Mirai #OTX #OpenThreatExchange #RAT #bot #botnet #AlienVault

Beyond Signatures: Detecting Lumma Stealer with an ML-Powered Sandbox

This analysis focuses on a new variant of Lumma Stealer, a malware that reemerged after a brief hiatus following a law enforcement operation. The article details the malware's code obfuscation, evasion techniques, and persistence mechanisms. It describes Netskope's machine learning-based detection approach, which utilizes a Cloud Sandbox enhanced with ML models to analyze runtime behavior, process trees, and other features. The specific sample analyzed is an NSIS installer file that abuses AutoIt for malicious purposes. The malware employs various anti-analysis techniques and establishes persistence through the Windows Startup folder. Netskope's multi-layered threat protection system successfully detected this Lumma Stealer variant.

Pulse ID: 68d5ce750be50aef2715a20b
Pulse Link: https://otx.alienvault.com/pulse/68d5ce750be50aef2715a20b
Pulse Author: AlienVault
Created: 2025-09-25 23:21:25

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Autoit #Cloud #CyberSecurity #InfoSec #LawEnforcement #LummaStealer #Mac #Malware #Netskope #OTX #OpenThreatExchange #RAT #RCE #SMS #Windows #bot #AlienVault

🐀 Ratmageddon: Why rats are overrunning cities

Rats are multiplying at speed in urban areas in the UK and North America. So, what's really behind the boom - and is it now unstoppable?

https://www.bbc.com/news/articles/c4gvk397j80o

#animal #rat

Banking Trojan Campaign Targets Android Users Mimicking Legitimate Apps

The following is a full list of comments on the subject of research by the University of California, Los Angeles, and the International Institute of Strategic Studies (IISS).- the first of its kind.

Pulse ID: 68d5b707731ac54186cf6ad1
Pulse Link: https://otx.alienvault.com/pulse/68d5b707731ac54186cf6ad1
Pulse Author: cryptocti
Created: 2025-09-25 21:41:27

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Android #Bank #BankingTrojan #CyberSecurity #IISS #InfoSec #LosAngeles #Mimic #OTX #OpenThreatExchange #RAT #Trojan #UniversityofCalifornia #bot #cryptocti