OTX BotHacktivists are broadening their scope beyond political motivation
Kaspersky researchers uncovered interconnected hacktivist campaigns attributed to groups including 4BID, Hakerskii Kit, and C.A.S., targeting organizations primarily in Russia and Belarus, but expanding to Kazakhstan, UAE, Syria, and Egypt. Attackers exploited ProxyShell vulnerabilities in Microsoft Exchange servers to deploy fd.aspx web shells and various post-exploitation frameworks including Sliver, Havoc, Mythic Apollo, AdaptixC2, and a custom BlackSalt backdoor. The campaigns deployed ransomware including ClearWater and updated versions of Blackout Locker, alongside EDR killers using BYOVD techniques. Attackers leveraged legitimate RMM tools like AnyDesk, Panorama9, and Tactical RMM for persistence, with AI-generated scripts showing varying quality. The geographical expansion and increased use of ransomware suggest a shift from purely political motivation toward financial gain.
Pulse ID: 6a2699c629b0ddee8d84e7b6
Pulse Link: https://otx.alienvault.com/pulse/6a2699c629b0ddee8d84e7b6
Pulse Author: AlienVault
Created: 2026-06-08 10:30:30
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AnyDesk #BackDoor #Belarus #CyberSecurity #EDR #Hacktivist #InfoSec #Kaspersky #Kazakhstan #Microsoft #Mythic #OTX #OpenThreatExchange #Proxy #RAT #RansomWare #Russia #Sliver #Syria #UAE #bot #AlienVault
Satori Yakamura
Wulfy—Speaker to the machines
Kallisti
