Threat reports

XCSSET Shows How Threat Actors Cope with OS Changes, Does Away with Python Like macOS

XCSSET first appeared in 2020.¹ But it fell off cybersecurity researchers’ radar last year after macOS Monterey discontinued its support for Python—the malware’s primary language. Since April this year, however, XCSSET minus Python has resurfaced.²

Matanbuchus with Cobalt Strike: Not Your Favorite Combo

A malware-as-a-service (MaaS) package called “Matanbuchus” was found dropping Cobalt Strike beacons, allowing threat actors to communicate with the compromised network.¹

Phishing Automated through Chatbots, We Found Potentially Connected Domains

There is a new phishing tactic that employs chatbots to automate credential theft and increase the legitimacy of phishing sites. Bleeping Computer¹ mentioned only one IoC, a cybersquatting subdomain targeting DHL.

Don’t Hit That Update Button Just Yet, It Could Lead to Malware Infection

Microsoft regularly pushes out updates, sometimes even upgrades, for its software in an effort to heighten their security and fix bugs. But it’s also usual, too, to see news about threat actors taking advantage of the huge Windows user base by rolling out updates that are actually malware in disguise.

A Look at Actinium/Gamaredon’s Infrastructure: More Artifacts Revealed

Nearly-a-decade-old advanced persistent threat (APT) group Actinium/Gamaredon seemed to have gained a new lease on life as they recently resurfaced to target several Ukrainian organizations.¹

When Safe Doesn’t Mean Threat-Free, Watch Out for Rogue Internet Safety Sites

Threat actors will capitalize on anything, even sites that hint at promoting digital safety, to spread mayhem. We looked at thousands of Internet safety-themed domains and subdomains in commemoration of Safer Internet Day¹ to identify how many of them may not be worth trusting.

Q2 2021 Paypal Phishing & Typosquatting Report

PayPal phishing attacks are highly prevalent and the company remains one of the most impersonated brands. As typosquatting domains are often associated with phishing and impersonation attacks, Threat Intelligence Platform (TIP) prepared the Q2 2021 PayPal Phishing Report. 

In this report, we uncovered PayPal-related domains and subdomains registered or added within the period.