2 mentions in 7 days · 2 in 30 days · 2 total · first seen · last
RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries.
RemControl Android malware steals banking PINs by targeting over 30 banks in multiple countries, using fake TV app delivery and custom crypto.
North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.
SOCRadar reports that North Korea-linked Konni is running Operation Conflict Compass, a cyberespionage campaign against Ukraine-focused diplomatic, policy, NGO, and defense audiences. Spear-phishing ZIP archives contain LNK shortcuts disguised as PDFs; opening one runs PowerShell that downloads a VBScript persistence component and the VelvetCake downloader from GitHub. A scheduled task named OneDriveUpdateScheduler relaunches the lightweight task runner every minute, which fetches PowerShell modules over raw TCP port 12345, collects host and network data plus screenshots, exfiltrates results, and deletes artifacts. A trojanized Zoom installer variant was also used, and SOCRadar assesses a moderate-confidence link to Konni, also known as TA406 and Opal Sleet within the Kimsuky umbrella.