No one knows how many old shims can still bypass UEFI Secure Boot 2026-07-14 at 13:26 By Mirko Zorz The vast majority of UEFI computers carry a Microsoft certificate that will trust a small first-stage loader called a shim, a program Microsoft signs so that Linux and assorted boot tools can run with Secure Boot […]
No one knows how many old shims can still bypass UEFI Secure Boot Read More »
Cargo theft malware actor spent a month inside a decoy network before researchers pulled the plug 2026-04-16 at 13:34 By Mirko Zorz Proofpoint researchers executed a malicious payload from a threat actor known to target trucking and logistics companies in late February 2026, doing so inside a decoy environment. The environment stayed compromised for more
Attackers use Windows App-V scripts to slip infostealer past enterprise defenses 2026-01-27 at 17:17 By Zeljka Zorz A malware delivery campaign detailed by Blackpoint researchers employs an impressive array of tricks to deliver an infostealer to employees without triggering enterprise defenses or close examination by security researchers. The attackers aim to get the Amatera Stealer
Attackers use Windows App-V scripts to slip infostealer past enterprise defenses Read More »
North Korean hackers spotted using ClickFix tactic to deliver malware 2025-02-13 at 18:34 By Zeljka Zorz North Korean state-sponsored group Kimsuky (aka Emerald Sleet, aka VELVET CHOLLIMA) is attempting to deliver malware to South Korean targets by leveraging the so-called “ClickFix” tactic. A relatively new tactic The ClickFix social engineering tactic has been dubbed thus
North Korean hackers spotted using ClickFix tactic to deliver malware Read More »
PurpleFox Resurfaces Via Spam Emails: A Look Into Its Recent Campaign 29/09/2023 at 17:32 By cybleinc Cyble Research and Intelligence Labs analyzes PurpleFox’s recent campaign that resurfaces via spam emails. The post PurpleFox Resurfaces Via Spam Emails: A Look Into Its Recent Campaign appeared first on Cyble. This article is an excerpt from Cyble View
PurpleFox Resurfaces Via Spam Emails: A Look Into Its Recent Campaign Read More »
Covert Delivery of Cobalt Strike Beacon via Sophos Phishing Website 15/09/2023 at 17:31 By rohansinhacyblecom Key Takeaways Overview Cyble Research & Intelligence Labs (CRIL) came across a typosquatted domain of Sophos, “sopbos[.]com”, using a VirusTotal search. The phishing site impersonates the installation of the Sophos Home. The initial infection vector is unclear at this time
Covert Delivery of Cobalt Strike Beacon via Sophos Phishing Website Read More »
Tatar-Language Users in the Crosshairs of Python Screenshotter 14/09/2023 at 20:17 By rohansinhacyblecom Key Takeaways • Cyble Research and Intelligence Labs (CRIL) came across Python malware capturing screenshots and sending them over FTP to remote attackers.• Proofpoint has observed similar campaigns in the recent past targeting the United States and Germany, with the perpetrator tracked
Tatar-Language Users in the Crosshairs of Python Screenshotter Read More »
Mallox Ransomware Implements New Infection Strategy 22/06/2023 at 14:12 By cybleinc Cyble analyzes Mallox Ransomware’s new infection chain, leveraging BatLoader to execute ransomware payloads. The post Mallox Ransomware Implements New Infection Strategy appeared first on Cyble. This article is an excerpt from Cyble View Original Source
Mallox Ransomware Implements New Infection Strategy Read More »
Unraveling Akira Ransomware 10/05/2023 at 12:33 By cybleinc CRIL analyzes Akira, a Ransomware variant that is rapidly expanding its list of targets, primarily focused on the United States and Canada. The post Unraveling Akira Ransomware appeared first on Cyble. This article is an excerpt from Cyble View Original Source
Unraveling Akira Ransomware Read More »