CircleID: Industry Updates

Glupteba, an advanced piece of malware, has been used in several cybercriminal attacks for more than a decade now. But Palo Alto's Unit 42 only brought to light one of the features that made it s...

https://circleid.com/posts/20240425-digging-deep-to-examine-the-roots-of-the-glupteba-uefi-bootkit

A new info-stealing malware called "TimbreStealer" is in town. Cisco Talos detected its distribution through a phishing campaign targeting Mexico.

https://circleid.com/posts/20240421-hunting-for-timbrestealer-malware-artifacts-in-the-dns

After analyzing 21+ million newly registered domains (NRDs) added from 1 January to 31 March 2024, our researchers found that the new domain registration volume declined by about 32% from the pre...

https://circleid.com/posts/20240416-a-glimpse-into-the-global-domain-registration-trends-seen-in-q1-2024

Threat actors have been abusing App Installer, a Windows 10 feature that makes installing applications more convenient. The abuse could lead to ransomware distribution and was likely carried out ...

https://circleid.com/posts/20240409-uncovering-suspicious-download-pages-linked-to-app-installer-abuse

macOS has been gaining the unwanted attention of more and more backdoor operators since late 2023. In February 2024, Bitdefender uncovered RustDoor, which was written in Rust and possibly has tie...

https://circleid.com/posts/20240402-on-the-dns-trail-of-the-rise-of-macos-backdoors

Group-IB uncovered ResumeLooters, a threat actor group specializing in victimizing job hunters to steal their personally identifiable information (PII).

https://circleid.com/posts/20240322-checking-out-the-dns-for-more-signs-of-resumelooters

In the past two decades, at least 41 advanced persistent threat (APT) groups have launched attacks on entities and organizations based in North America.

https://circleid.com/posts/20240319-whoisxml-api-publishes-a-new-study-of-7-apt-groups-that-have-targeted-north-america

The Citizen Lab recently uncovered an ongoing online propaganda campaign they have dubbed "PAPERWALL" that has been targeting local news outlets across 30 countries in Europe, Asia, and Latin Ame...

https://circleid.com/posts/20240316-searching-for-potential-propaganda-vehicle-presence-in-the-dns

The passage provided features an interview with Chad Silverstein and Jack Hazan, who is the Executive Vice President at Hilco Streambank. Hazan oversees the operations of Hilco’s IPv4.Global bu...

https://circleid.com/posts/20240313-navigating-change-and-unlocking-value-the-strategic-journey-of-jack-hazan-and-ipv4-global

VexTrio, a traffic distribution system (TDS) provider believed to be an affiliate of ClearFake and SocGholish, among other threat actors, has been active since 2017.

https://circleid.com/posts/20240313-following-the-vextrio-dns-trail

In the past, DarkGate attacks were either lumped together with or classified as BattleRoyal remote access Trojan (RAT) attacks. Recent evidence, however, showed the two malware are not one and th...

https://circleid.com/posts/20240308-darkgate-rat-comes-into-the-dns-spotlight

Among the latest to suffer from zero-day exploitation is Ivanti, a software company providing endpoint management and remote access solutions to various organizations, including U.S. federal agen...

https://circleid.com/posts/20240306-tracing-ivanti-zero-day-exploitation-iocs-in-the-dns

Law enforcement agencies shut down xDedic, a cybercrime-as-a-service (CaaS) marketplace specifically providing web servers to cybercriminals, back in 2019. However, WhoisXML API threat researcher...

https://circleid.com/posts/20240304-dns-investigation-is-xdedic-truly-done-for-after-its-takedown

New kids on the cybercrime block, pig butchering scams, have been making waves lately, and it is not surprising why. Scammers have been earning tons from them by being able to trick users into in...

https://circleid.com/posts/20240228-dns-deep-diving-into-pig-butchering-scams

In the digital age, where every device, from smartphones to fridges, connects to the Internet, the topic of IP addresses becomes increasingly relevant. An IP address, a unique identifier for devi...

https://circleid.com/posts/20240226-ipv4-addresses-dormant-assets-or-untapped-digital-gold