Top 10 last week's threats by uploads 
#Lumma 524 (557)
#Tofsee 347 (333) #Neconyd 286 (264) #Amadey 185 (150) #Snake 182 (252) #Asyncrat 165 (285) #Xworm 163 (305) #Remcos 130 (227) #Agenttesla 119 (113) #Stealc 103 (84)
Track them all: https://any.run/malware-trends/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=050525
Top 10 last week's threats by uploads #Lumma 569 (1077) #Tofsee 363 (263) #Xworm 309 (1099) #Asyncrat 290 (395) #Neconyd 283 (169) #Snake 254 (379) #Remcos 232 (566) #Amadey 156 (380) #Formbook 134 (78) #Agenttesla 114 (271)
Track them all: https://any.run/malware-trends/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=280425
Our new report describes one of the latest observed infection chains (delivering #AsyncRAT) relying on the #Cloudflare tunnel infrastructure and the attacker’s #TTPs with a principal focus on detection opportunities.
https://blog.sekoia.io/detecting-multi-stage-infection-chains-madness/
Detecting Multi-Stage Infection Chains Madness
This analysis examines a complex multi-stage attack exploiting a resilient network infrastructure known as 'Cloudflare tunnel infrastructure to deliver multiple RATs' since February 2024. The infection chain involves multiple steps, including phishing emails with malicious attachments, execution of various file types (LNK, HTA, BAT, Python scripts), and eventual delivery of AsyncRAT. The attackers employ various evasion techniques and leverage public services like TryCloudflare and DynDNS. The report highlights the importance of combining cyber threat intelligence with detection rules to enhance security capabilities against evolving threats. It also provides detailed information on the attack stages, detection opportunities, and associated indicators of compromise.
Pulse ID: 68076448a507880b9128c2a6
Pulse Link: https://otx.alienvault.com/pulse/68076448a507880b9128c2a6
Pulse Author: AlienVault
Created: 2025-04-22 09:41:28
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
Booking.com Phishing Scam Uses Fake CAPTCHA to Install AsyncRAT – Source:hackread.com https://ciso2ciso.com/booking-com-phishing-scam-uses-fake-captcha-to-install-asyncrat-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #PhishingScam #CyberAttack #0CISO2CISO #Bookingcom #AsyncRAT #Hackread #security #Captcha #malware #Fraud #Scam
Booking.com Phishing Scam Uses Fake CAPTCHA to Install AsyncRAT https://hackread.com/booking-com-phishing-scam-fake-captcha-asyncrat/ #Cybersecurity #PhishingScam #CyberAttack #Bookingcom #Security #AsyncRAT #Captcha #Malware #Fraud #Scam
Watch Out!
New phishing scam targets hotel staff with fake #Booking.com emails. A fake CAPTCHA leads to AsyncRAT malware via a Windows Run trick.
Read more: https://hackread.com/booking-com-phishing-scam-fake-captcha-asyncrat/
Top 10 last week's threats by uploads #Lumma 592 (644) #Snake 306 (513) #Xworm 281 (341) #Asyncrat 277 (303) #Tofsee 264 (194) #Remcos 240 (203) #Agenttesla 195 (326) #Neconyd 169 (154) #Amadey 108 (95) #Quasar 91 (82)
Track them all: https://any.run/malware-trends/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_content=tracker&utm_term=210425
Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware
A phishing campaign targeting organizations in the hospitality industry has been identified, impersonating Booking.com and using the ClickFix social engineering technique to deliver multiple credential-stealing malware. The campaign, tracked as Storm-1865, targets individuals likely to work with Booking.com in North America, Oceania, Asia, and Europe. The attack uses fake emails and webpages to trick users into executing malicious commands, leading to the download of various malware families including XWorm, Lumma stealer, VenomRAT, AsyncRAT, Danabot, and NetSupport RAT. The campaign aims to steal financial data and credentials for fraudulent use, showing an evolution in the threat actor's tactics to bypass conventional security measures.
Pulse ID: 67fb93e8ebc93d6ded395f39
Pulse Link: https://otx.alienvault.com/pulse/67fb93e8ebc93d6ded395f39
Pulse Author: AlienVault
Created: 2025-04-13 10:37:28
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#ESETresearch has uncovered the #MirrorFace Operation AkaiRyū, which extends the group’s usual focus beyond Japan into Europe. The initial lure centered around Expo 2025 in Japan, compromising a Central European diplomatic institute.
https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/
Surprisingly, #MirrorFace used #ANEL – a backdoor historically linked only to #APT10 – highlighting a shift in the group’s tactics and reinforcing suspicions that MirrorFace could be part of the APT10 umbrella.
Operation AkaiRyū began with targeted spearphishing emails referencing the victim’s past correspondence and Expo 2025 , persuading recipients to download malicious attachments.
Once the files were opened, a layered compromise chain ensued . Collaborating with the victim allowed us to perform in-depth analysis, shedding light on MirrorFace’s post-compromise behavior – from credential harvesting to dropping additional tools for lateral movement.
#MirrorFace used an intricate execution chain to stealthily run a highly tweaked #AsyncRAT within #WindowsSandbox, hampering detection efforts. This is the first time we’ve seen MirrorFace employ AsyncRAT.
In another twist, #MirrorFace utilized #VSCode remote tunnels, a tactic enabling covert access and command execution on compromised machines. This approach has also been seen with other China-aligned cyberespionage groups.
The group primarily leveraged #ANEL as a first-stage backdoor, #HiddenFace – MirrorFace’s flagship backdoor – was dropped later in the attack to bolster persistence . Notably absent this time was #LODEINFO, which #MirrorFace typically employs.
We presented our findings about Operation AkaiRyū conducted by #MirrorFace at @jpcert_ac on January 22, 2025: https://jsac.jpcert.or.jp.
IoCs available in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/mirrorface
A new campaign, dubbed Desert Dexter, is targeting the Middle East & North Africa, impacting ~900 victims since fall '24! 
They're using social media & altered AsyncRAT malware to steal data & crypto. Watch out for malicious ads & file-sharing links! 
#cybersecurity #malware #AsyncRAT #DesertDexter #newz
https://thehackernews.com/2025/03/desert-dexter-targets-900-victims-using.html
Happy Friday everyone!
I feel like this has become a weekly PSA but Kaspersky Securelist researchers have identified hundreds of #GitHub projects that are serving up malicious code designed to steal saved credentials, cryptocurrency wallets, and browsing history. Sometimes this execution of code leads to the #ASyncRAT or #Quasar Backdoor, but the threat remains the same: blindly executing code from GitHub. I hope you enjoy and Happy Hunting!
The GitVenom campaign: cryptocurrency theft using GitHub
https://securelist.com/gitvenom-campaign/115694/
Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
Ghost in the Shell: Null-AMSI Bypasses Security to Deploy AsyncRAT https://thecyberexpress.com/asyncrat-attack/ #TheCyberExpressNews #remoteaccesstrojan #TheCyberExpress #FirewallDaily #ItachiUchiha #SasukeUchiha #DarkWebNews #CyberNews #Null-AMSI #AsyncRAT
Ghost in the Shell: Null-AMSI Bypasses Security to Deploy AsyncRAT https://thecyberexpress.com/asyncrat-attack/ #TheCyberExpressNews #remoteaccesstrojan #TheCyberExpress #FirewallDaily #ItachiUchiha #SasukeUchiha #DarkWebNews #CyberNews #Null-AMSI #AsyncRAT
Happy Wednesday everyone!
The #AsyncRAT is made headlines in a report published by the Forcepoint X-Labs research team. A significant finding was that the malware leveraged payloads delivered through suspicious TryCloudflare quick tunnels and Python packages. While I am familiar with Python packages being weaponized during a supply chain attack, the topic of quick tunnels eluded me. So, I looked it up and found that "Developers can use the TryCloudflare tool to experiment with Cloudflare Tunnel without adding a site to Cloudflare's DNS. TryCloudflare will launch a process that generates a random subdomain on trycloudflare.com. Requests to that subdomain will be proxied through the Cloudflare network to your web server running on localhost." [https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/]
This was interesting as it seemed to be a workaround or possibly a replacement for domain generating algorithms (DGAs). And if I am misunderstanding this technology, someone please enlighten me!
Behaviors:
Initial Access:
Phishing: Spearphising Link - T1566.002
Execution:
Command And Scripting Interpreter: JavaScript - T1059.007
- A javascript was executed after an LNK file was delivered and executed and links to a .BAT file.
Command And Scripting Interpreter: Windows Command Shell - T1059.003
- A .BAT file is executed that leads to another zip file that contains a python script used to execute the AsyncRAT malware.
Command And Scripting Interpreter: Python - T1059.006
- A python file is used to execute the AsyncRAT malware.
As usual, go show the authors some love and check out the details I excluded and get hunting on those behaviors! Enjoy and Happy Hunting!
AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again
https://www.forcepoint.com/blog/x-labs/asyncrat-reloaded-python-trycloudflare-malware
Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
"標的型攻撃グループDarkPlumが使用するAsyncRATの亜種について" published by NTTSecurity. #AsyncRAT, #DarkPlum, #DPRK, #CTI https://jp.security.ntt/tech_blog/darkplum-asyncrat
AsyncRAT’s Infection Tactics via Open Directories: Technical Analysis
#AsyncRAT
https://any.run/cybersecurity-blog/asyncrat-open-directories-infection-analysis/
Did you know that cybercriminals are now using Bitbucket to distribute Remote Access Trojans like AsyncRAT?
Attackers are exploiting trusted code-sharing platforms to hide their malicious payloads in plain sight. By hosting malware on Bitbucket, they leverage its legitimacy to bypass security defenses!
Cybersecurity Tip: Monitor unexpected downloads from code repositories like Bitbucket. Even reputable platforms can harbor threats if used maliciously.
What are your thoughts on attackers misusing legitimate platforms for cybercrime? Have you ever encountered suspicious repositories?
Learn how AsyncRAT is exploiting Bitbucket and what you can do to protect yourself: https://guardiansofcyber.com/cybersecurity-news/unveiling-asyncrat-how-cybercriminals-exploit-bitbucket-for-remote-access-trojans-and-persistence-mechanisms/
