The Cybersecurity and Infrastructure Security Agency (CISA) has published a Malware Analysis Report (MAR) with analysis and associated detection signatures on a new malware variant CISA has identified as RESURGE. RESURGE contains capabilities of the SPAWNCHIMERA malware variant.
The NJCCIC’s email security solution identified a fake CAPTCHA malware campaign sent to New Jersey State employees in an attempt to deliver the SectopRAT infostealer. The emails contain links directing targets to malicious or compromised websites and prompting deceptive CAPTCHA...
Cybercriminals use information-stealing malware, also known as infostealers, to gather data about users, their devices, and their networks. This information can include personal information, account information like online passwords, and other sensitive data.
First discovered in 2022, XWorm malware is a remote access trojan (RAT) capable of evading detection and collecting sensitive information, including financial details, browsing history, saved passwords, and cryptocurrency wallet data. XWorm tracks keystrokes, captures webcam...
Last week, the NJCCIC reported increased phishing attempts targeting NJ state employees by impersonating the IRS. Proofpoint analysts noted a rise in tax-themed phishing campaigns, particularly as tax deadlines approach in the US and the UK.
The North Korean (DPRK)-linked Lazarus Group recently shifted its focus to the nuclear industry, indicating a concerning shift from its previous tactics of primarily targeting defense, aerospace, and cryptocurrency, among others. The Lazarus Group has historically...
Python Package Index (PyPI) has recently observed several malicious packages hidden in its repository. PyPI hosts almost 600,000 projects written in the Python programming language. The original aiocpa package, self-described as a “synchronous & asynchronous Crypto Pay API Client”...
Threat actors actively seek methods to conceal their identities in information-stealing campaigns, aiming to lure individuals into downloading malicious software or revealing sensitive information. One recent campaign infects Windows devices with Lumma Stealer...
The NJCCIC email security system has uncovered a new campaign spreading XLoader and GuLoader malware. XLoader is a successor to Formbook infostealing malware and is categorized as malware-as-a-service (MaaS). XLoader has several capabilities...
The NJCCIC detected a campaign linked to TA544, also referred to as Bamboo Spider and Zeus Panda, which has reemerged after a period of inactivity since their last campaign. Similar to open-source reporting, this new campaign attempts to distribute the WarmCookie backdoor.
