Shuckworm Deploys GammaSteel Malware in Advanced Cyber Espionage Campaign

The Shuckworm group also known as Gamaredon or Armageddon has intensified its cyber espionage efforts focusing on Ukraine and extending its attacks to a Western military mission in Eastern Europe.

Pulse ID: 6818fb9a89b821c4c7636049
Pulse Link: https://otx.alienvault.com/pulse/6818fb9a89b821c4c7636049
Pulse Author: cryptocti
Created: 2025-05-05 17:55:38

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #EasternEurope #Espionage #Europe #Gamaredon #InfoSec #Malware #Military #OTX #OpenThreatExchange #UK #Ukr #Ukraine #Worm #bot #cryptocti

Malware Campaign Uses JScript and PowerShell to Deploy XWorm and Rhadamanthys

Pulse ID: 6818f05fa7df75667b0912a2
Pulse Link: https://otx.alienvault.com/pulse/6818f05fa7df75667b0912a2
Pulse Author: cryptocti
Created: 2025-05-05 17:07:43

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #PowerShell #Rhadamanthys #Worm #XWorm #bot #cryptocti

Why didn't the #worm eat the entire brain of this #stupid #idiot? It would've done us all a huge favor.

https://arstechnica.com/health/2025/04/rfk-jr-s-anti-vaccine-stance-is-rooted-in-a-disbelief-in-germ-theory/

#HHS #antiscience #antivaxxer #government #USPolitics

My 25 years of palaeoart chronology...

Here's a study of Kingnites, commissioned in 2022 for a project I cannot talk about yet. Kingnites, is an exceptionally large (1m long) Silurian polychaete annelid.

#Art #Painting #PaleoArt #PalaeoArt #SciArt #SciComm #DigitalArt #Illustration #Dinosaurs #Palaeontology #Paleontology #Kingnites #Silurian #Polychaete #Annelid #Worm #Fossil

Fried eggs skistomid

#worm #originalspecies #monster

Proton66: Compromised WordPress Pages and Malware Campaigns

This intelligence briefing focuses on malware campaigns linked to Proton66, particularly those targeting Android devices through compromised WordPress websites. It details how these sites were injected with malicious scripts to redirect Android users to fake Google Play Store pages. The report also covers the XWorm campaign targeting Korean-speaking users, the Strela Stealer targeting German-speaking countries, and the WeaXor ransomware. The analysis provides insights into the infection chains, malware configurations, and command-and-control servers used in these campaigns. Additionally, it offers recommendations for blocking associated IP ranges and lists numerous indicators of compromise (IOCs) for each campaign.

Pulse ID: 6802094e89f266c72f83bda4
Pulse Link: https://otx.alienvault.com/pulse/6802094e89f266c72f83bda4
Pulse Author: AlienVault
Created: 2025-04-18 08:11:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Android #CyberSecurity #Google #GooglePlay #InfoSec #Korea #Malware #OTX #OpenThreatExchange #RAT #RDP #RansomWare #Word #Wordpress #Worm #XWorm #bot #AlienVault

JScript to PowerShell: Breaking Down a Loader Delivering XWorm and Rhadamanthys

This analysis examines a sophisticated malware loader that utilizes JScript to launch obfuscated PowerShell code, ultimately delivering payloads such as XWorm and Rhadamanthys. The loader employs geofencing tactics, targeting victims in the United States with XWorm RAT, while deploying Rhadamanthys stealer to users outside the U.S. The attack chain involves multiple stages of obfuscation and deobfuscation, including decimal encoding and string manipulation. The final payload is injected into RegSvcs.exe using reflective loading techniques. The loader also performs various cleanup actions to evade detection and remove traces of its activity. Both XWorm and Rhadamanthys are advanced malware variants with capabilities ranging from DDoS attacks to cryptocurrency theft.

Pulse ID: 67ff46c3697a4976dc919b5d
Pulse Link: https://otx.alienvault.com/pulse/67ff46c3697a4976dc919b5d
Pulse Author: AlienVault
Created: 2025-04-16 05:57:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #DDoS #DoS #ICS #InfoSec #Malware #OTX #OpenThreatExchange #PowerShell #RAT #Rhadamanthys #UnitedStates #Worm #XWorm #bot #cryptocurrency #AlienVault