Indonesian Cybercriminals Exploit AWS for Profitable Crypto Mining Operations

A financially motivated threat actor of Indonesian origin has been observed leveraging Amazon Web Services AWS Elastic Compute Cloud EC2 instances to carry out illicit crypto mining operations. Cloud security company's Permiso P0 Labs, which first detected the group in November 2021, has assigned...

Unveiling the Minas Miner’s Deceptive Tactics

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Minas is a multi-stage cryptocurrency miner with a concealed presence. It evades detection through encryption, randomization, and persistence techniques, showcasing determined network compromise. To...

New Strain of Sotdas Malware Discovered

Introduction There are numerous malicious codes that are currently active on smart devices, such as Ddosf, Dofloo, Gafgyt, MrBlack, Persirai, Sotdas, Tsunami, Triddy, Mirai, Moose, and Satori, among others. These malicious codes and their variants can intrude into and control smart devices throug...

China's Mustang Panda Hackers Exploit TP-Link Routers for Persistent Attacks

The Chinese nation-state actor known as Mustang Panda has been linked to a new set of sophisticated and targeted attacks aimed at European foreign affairs entities since January 2023. An analysis of these intrusions, per Check Point researchers Itay Cohen and Radoslaw Madej, has revealed a custom...

Malicious code in buffer-ex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 279833dce3a99cfad24c4d603dda5c3b4ed443d44d280456c73eee2a270a3f5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Variant of BPFDoor Linux Malware Features Enhanced Encryption and Stealthy Communication

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new variant of the Linux malware BPFDoor has been discovered, featuring more robust encryption and reverse shell communication. It uses the BPF to bypass firewall restrictions, allowing threat actors t...

Malicious code in wagyu-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef98b86deb0d82a3874d3caaafddc65b5389ca664ff9bc949a3c3c8ee43a8b83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in little-heaven-by-nick-cutter-on-kindle-new-pages- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1118eac8c0f8eef839cf2daade621df7e1fc982faf90314a0bbb38622add51c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in get-your-sht-together-how-to-stop-worrying-about-what-you-should-do-so-you-can-finish-what-you-need- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a43ef9bfe905e77cc298a953b9bfb8a983e8a2838808ad9b94f595a8d76ddb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in homo-deus-a-brief-history-of-tomorrow-by-yuval-noah-harari-on-audible-new-version- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7113f20e74d21a481eb7e3c7305184685724e0e05de2bbbcb9ce76e2df4fdb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dow-load-stepping-stone-the-stone-series-2-by-dakota-willink-on-mac-full-volumes- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0f0204307cd5527d985b8b4ac7acbb11c80f489f7cb9f6765cf4c5e6cf2de20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in conversations-with-friends-by-sally-rooney-on-audible-new-volumes- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43a3c0ad8210a979fccfd7f614cae9493219922b5e13d2a02d9a84a2beda365d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in designer-relationships-a-guide-to-happy-monogamy-positive-polyamory-and-optimistic-open-relationship (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fead2d10a8030f59632981c85f922b207a5f18b86fa7f92dce82b68cf925beae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hit-makers-the-science-of-popularity-in-an-age-of-distraction-by-derek-thompson-on-ipad-new-version- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 076db454192ff726a44259a97efbfa7696d32887045af6be417937ffc98f5537 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in the-duke-and-i-bridgertons-1-by-julia-quinn-on-iphone-new-format- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d95f77039a648f1daa5e32c0d804ced9a1480d90f1165f41639bb01de4da6c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in managed-vip-2-by-kristen-callihan-on-iphone-full-volumes- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9488572be5c3f73c9703b24b7739fc80fc8f178aedc148a91565e1985e2ea3e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in the-ashes-of-london-marwood-and-lovett-1-by-andrew-taylor-on-ipad-full-volumes- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 097c2145981a125fa3f3ad898d922ad32b2760f65e716e2adea2192c7738eae7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dark-warriors-promise-the-children-of-the-gods-8-by-it-lucas-on-audible-new-edition- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d8775886a3d9648305bf330fb02cd6f1fdb7ccb78a5bd3a67441d1e40fd9004 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tranny-confessions-of-punk-rocks-most-infamous-anarchist-sellout-by-laura-jane-grace-on-audible-full (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c43dfa8095c3a0fc1ce7b9367b543b5421e7a34e5345e8b4eb5d83e57f29326b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in this-is-war-travis--viola-1-checkmate-duet-1-by-kennedy-fox-on-audible-full-edition- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cd292ce105e032e6f95f8e798f41f1c13fa41e2e1b118e6e63075e73e32e7f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...