Blog

A recent campaign drops Cobalt Strike Beacons, the RedLine Infostealer, and the Amadey Botnet with malicious scripts using two distinct methods. Context On September 28, 2022, Talos security researchers reported a campaign delivering Cobalt Strike beacons, the RedLine Infostealer, and Amadey botnet executables active since at least August 2022. Cobalt Strike is by far the…

A new dropper named “NullMixer” is spreading multiple malware families, including some seen regularly by the RH-ISAC community. Context On September 26, 2022, researchers at SecureList reported a new dropper they named “NullMixer” which spreads multiple malware families via malicious websites impersonating legitimate software downloads. According to SecureList, in addition to multiple malware families, NullMixer…

According to the 2022 Imperva Bad Bot Report, 27.7% of online traffic came from bad bots. For retail websites, it’s 23.6%. Bots routinely target retail sites with scalping and denial of inventory attacks, as well as fraud, gift card fraud, and account takeovers. The problem that many organizations are facing today is how to distinguish…

On September 21, 2022, the LockBit 3.0 ransomware builder named “Black” was leaked online by a developer working for the LockBit threat group. On September 22, 2022, security researchers Yang HuiSeong and Jeong Hyunsik released a technical analysis of the code. The leaked code is currently available on GitHub. Threat Actor Details LockBit is a…

The RH-ISAC awards are an annual opportunity to honor the individuals and member companies who have gone above and beyond in their commitment to the RH-ISAC community. The recipients of these awards have displayed extraordinary dedication to the culture of sharing and have gone out of their way to assist RH-ISAC in fulfilling our mission…

Mobile apps can serve as a convenient way for your customers to do business with you from their smartphones, but just like criminals can attempt to spoof your domains, they can also spoof your mobile app, even if you don’t have one. Rogue mobile apps are applications that use a trusted brand name to steal…

Context On September 6, 2022, researchers at AT&T Alien Labs reported technical details of a new malware, “Shikitega,” that targets endpoints and internet of things (IoT) devices running Linux operating systems. Once delivered, Shikitega allows actors full remote access to the infected system and installs a cryptominer with persistence. Key takeaways from the report include:…

APIs have become increasingly prevalent in the last few years as companies have begun to focus on digital transformation and migration to the cloud. APIs are a large part of what makes the cloud possible. They’re used to access and manage our cloud resources and connect microservices to build our applications. As developers grew to…

The threat actors behind the BianLian Ransomware are rapidly expanding infrastructure, and it has been observed targeting manufacturing organizations. Context On September 1, 2022, researchers at the cybersecurity firm Redacted published a technical analysis of the BianLian ransomware. In the past month, BianLian has been observed being deployed against numerous sectors, including manufacturing, healthcare, and…

After two years of being virtual due to pandemic-related precautions, RH-ISAC’s Cyber Intelligence Summit is back in person this year! We’ll be in Dallas on September 20-21 to host the premier event for cybersecurity practitioners in the retail, hospitality, and travel industries.  Here are just a few of the many reasons that our members are…