Blogs e artigos

CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams.

A Russian-speaking Gentlemen ransomware affiliate called Azazel robbed two dozen victims across six countries, then double-crossed his own gang by publishing the loot on a private leak site and pocketing every dollar. CloudSEK traced 50TB of exposed infrastructure and a live AI-driven attack chain. Read how "Caught in 4K" cracked the operation.

CloudSEK uncovered MALFEX, a long-running npm supply-chain campaign linked to a single operator, using malicious packages to deploy RATs and credential stealers. Two packages remain installable, including one malicious postinstall that evaded advisories for 14 months.

CloudSEK found an attacker's control panel targeting vast.ai, a GPU rental marketplace. It rents containers beside victims to scan their networks. It reached one unprotected notebook and planted no miners. The panel exposed its own source code.

CloudSEK found 85 malicious npm packages, published in three minutes, likely named to surface in search when developers mistype popular libraries. They give attackers remote command access. The same server hosts a GPU-hijacking panel. No victims confirmed.

Pesquisadores da CloudSEK descobriram o GHAPPIER, uma operação de carregador (loader) anteriormente não relatada que abrange pelo menos 65 repositórios públicos, 73 arquivos infectados e 22 contas. A investigação começou com um pacote npm legítimo comprometido, cujo lançamento malicioso possuía procedência válida por meio de publicação confiável. O relatório mapeia a infraestrutura mais ampla, vincula partes da atividade à campanha PolinRider e detalha indicadores, fluxo de ataque e ações defensivas.

Pesquisadores da CloudSEK descobriram o BigBear 2.0, uma operação global de phishing-as-a-service voltada ao Microsoft 365 que atinge centenas de organizações em mais de 40 países. A investigação expôs o painel administrativo do atacante, a rede de afiliados, a infraestrutura de phishing e milhares de credenciais e cookies de sessão roubados, revelando como os ataques modernos de AiTM podem sequestrar sessões autenticadas mesmo após o uso de MFA.

The first in CloudSEK's "Caught in 4K" series, where we pull ransomware operations out of the shadows and show exactly how they work. A misconfigured server opened a window straight into an Aurora ransomware operator's playbook: attacker tools, AI-assisted planning, and a look inside the actual negotiation panel where a victims and the operator settled on payment. In partnership with TRM Labs, we traced that payment on-chain, into a wider laundering network moving money across multiple victims. This is what ransomware looks like from the inside.

A investigação BRIDGEHEAD da CloudSEK expõe uma campanha de typosquatting com 40 pacotes npm que abusa do WSL para atingir hosts Windows e implantar um ladrão de dados oculto baseado em Rust. O malware tem como alvo carteiras de criptomoedas, credenciais de navegadores, cookies e sessões do Telegram, executando-se majoritariamente na memória e utilizando infraestrutura pública para reconhecimento e exfiltração, o que torna a detecção e a remoção significativamente mais difíceis.