Cybersecurity

Security researchers have uncovered a phishing campaign targeting energy and other infrastructure companies by exploiting HTML attachments that contain credential stealing forms. In this specific campaign, the threat actor portrays the phishing email as a being from an internal source by leveraging the “Shared-Files via” feature of Microsoft 365 and masquerades as a transcript being sent to the victim. However, the email address, with a Japanese domain, is clearly visible. After downloading the HTML file, users are prompted to enter their Microsoft email password to access a fake invoice.

Security researchers have uncovered a malicious cyber campaign that employs a novel anti-detection technique to deliver a trojan onto a targeted device. The campaign, first observed by Kaspersky, writes shellcode into Windows event logs that allows for a “fileless” last stage trojan to be hidden in a computer’s random-access memory. Injecting malware directly into system memory is what classifies as “fileless” and this technique allows threat actors to hide malicious payloads from traditional security and detection tools.

While Coveware’s recent quarterly report, Ransomware Threat Actors Pivot from Big Game to Big Shame Hunting analyzes the broader ransomware threat picture, Dragos’ quarterly report, ICS/OT Ransomware Analysis: Q1 2022 looks at ICS/OT impacting ransomware.

Security researchers have detected a new malware loader dubbed Bumblebee. The sophisticated malware appears to be a replacement for BazarLoader and is likely being used to gain initial access for follow on ransomware attacks and other malicious activity. Bumblebee is a highly sophisticated malware loader “that integrates intricate elaborate evasion techniques and anti-analysis tricks,” according to BleepingComputer. Researchers have detected a number of email campaigns distributing Bumblebee within ISO attachments.