Threat Intelligence

Gitpaste-12 is a wormable malware which has the ability to form a network of bots for crypto-mining which is now targeting Multiple Known Vulnerabilities.

CloudSEK researchers reveal the names of users who dumped the data and the timestamps of the files that confirms the data is old.

Upgraded version of Generaly OTP bot advertised on a cybercrime forum. The bot has a dedicated Telegram channel to capture & display information. Captured OTP can be used to bypass 2FA and gain complete access to bank accounts.

The email orders organizations to review the attachment and submit their plan of action to combat Coronavirus, much similar to APT36's pattern of attack.

BlackMatter ransomware operators claim that it combines the best aspects of REvil, Darkside, and Lockbit ransomware. They target a variety of industries with revenue higher than USD 1 million, with the exception of organizations in the healthcare, government, oil and gas, and non-profit sectors.

CloudSEK threat intelligence advisory on VMware vCenter RCE Bug, allows unauthorized actors to execute arbitrary code on a vCenter Server instance.

CloudSEK Threat Intelligence Advisory on Firestarter, created by DoNot APT, Android malware that abuses Google's Firebase Cloud Messaging

Nordic Market, a new dark web drugs marketplace hosted on Microsoft IIS server, sells Cannabis, Hashish, Weed, among other drugs.