57
57
57
57
60
60
57
57
57
57
60
60
60
60
Researchers warn of a surge in cyber attacks against Microsoft Exchange
60
57
60
57
57
57
60
57
45
57
60
60
New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims
Zimperium uncovered Mantax Otax, an Android ransomware that encrypts files, records screens, steals OTPs, and secretly photographs victims.
Zimperium reported a new Android threat, Mantax Otax, that combines ransomware with surveillance: it encrypts files with AES and adds a .enc extension on Android 9 and older, while abusing MediaProjection for screenshots and MP4 screen recording and using hidden camera previews to photograph victims. The malware intercepts SMS one-time passwords, WhatsApp and Telegram data, and lock-screen PINs through Accessibility abuse and a fake system-lock overlay, and can negotiate ransoms via an on-screen chat. Malicious APKs are hosted on third-party file-sharing services, and researchers linked the activity to Indonesian threat actors, with C2 dynamically retrieved from a GitHub repository (apimantax[.]otax[.]fun). A second variant adds WebSocket communications, app blocking, full-screen overlays, and remote text-to-speech messages.
45
Threat Assessment: Ryuk Ransomware
Unit 42 assesses Ryuk ransomware amid a CISA/FBI/HHS alert on threats to U.S. healthcare, including the UHS attack that disrupted hospital operations.
A joint CISA, FBI, and HHS alert on October 28, 2020 warned of an imminent threat to U.S. healthcare from operators deploying Trickbot and Ryuk ransomware. Universal Health Services reported a Ryuk attack that disrupted all U.S. UHS sites for weeks, with similar incidents at hospitals in Oregon and New York. Ryuk typically arrives after Trickbot or BazaLoader infections delivered via malicious email, and operators enumerate networks with PowerShell and WMI before encryption. The Trickbot Anchor_DNS module performs DNS tunneling for C2, using connectivity checks to benign domains like ipinfo.io and checkip.amazonaws.com.
68
Threat Assessment: Egregor Ransomware
Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.
Since September 2020, Unit 42 observed Egregor ransomware attacks across the U.S., Europe, Asia-Pacific, and Latin America, coinciding with the Maze team's shutdown announcement. Egregor, a variant of the Sekhmet family, uses commodity malware such as Qakbot, IcedID, and Ursnif for initial access, followed by scripts that modify firewalls, enable RDP, and deploy Cobalt Strike for reconnaissance and exfiltration. A PowerShell script uninstalls the McAfee agent and downloads the Egregor DLL via BITS, executed with the -passegregor10 key. Victims face a three-day ransom deadline before exfiltrated data is published on the Egregor Hall of Shame leak site.
55
⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply
60
60
57
57
57
60
45
60
60
60
57