Intrusions by Gama Copy also closely resembled those of the advanced persistent threat operation Core Werewolf with both groups’ utilization of 7-ZIP self-extracting archive files for UltraVNC execution, port 443 for server connections, and the EnableDelayedExpansion command, an analysis from the Knownsec 404 Advanced Threat Intelligence team revealed.
Related Posts
390,000 WordPress credentials compromised via phishing, GitHub repos
More than 390,000 credentials to WordPress sites were compromised in a year-long supply chain attack that leveraged a phishing campaign…
Over 3M Builder.ai records leaked by unprotected database
SiliconAngle reports that major UK-based artificial intelligence startup Builder.ai had nearly 1.3 TB of data containing over 3 million records, including…
Novel PLAYFULGHOST infostealer emerges | SC Media
Phishing and SEO poisoning attacks have been leveraged to distribute the new PLAYFULGHOST information-stealing malware, which is similar to the Gh0st…