Rhadamanthys Stealer has it's own web, had missed that completely.

Yet one more sign that the Stealer market is growing, maturing and getting increasingly professional and important part of the ecosystem.

#ThreatIntelligence #Stealer #CredentialStealer #Malware

#HappyFriday everyone! This week I will wrap up with a #readoftheday from ThreatMon and their coverage of the #ZarazaBot. They provide technical analysis of the #credentialstealer and describes some of its behaviors! Enjoy and Happy Hunting!

Zaraza Bot: The New Russian Credential Stealer
https://threatmon.io/wp-content/uploads/2023/05/Zaraza-Bot_-The-New-Russian-Credential-Stealer.pdf

Notable MITRE ATT&CK TTPs:
TA0009 - Collection:
T1005 - Data from Local System
T1113 - Screen Capture
T1119 - Automated Collection
T1074.001 - Data Staged: Local Data Staging

TA0011 - Command And Control
T1071 - Application layer Protocol
T1537 - Encrypted Channel

#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting

Any thoughts on how many Credential Stealer families rely on using the Telegram API Bot endpoint for exfiltrating / copying information from infected devices?

Trying to assess the potential for leveraging that observation for some simple detection rules of potential stealer infections.

Any hot takes?

[ #ThreatIntel #DetectionEngineering #CredentialStealer ]

Noterade för några dagar sedan att en cyber kriminell marknadsplats har börjat inkludera inloggningsuppgifter från Android appar.

Inte hunnit gräva i det särskilt mycket men oroväckande med tanke på hur många långlivade sessioner som finns där i våra företagsappar.

Vad tänker ni?

#CredentialStealer #Android #ThreatIntel @threatintel

Threat Spotlight: Solarmarker - By Andrew Windsor, with contributions from Chris Neal.

Executive summaryCisco Tal... http://feedproxy.google.com/~r/feedburner/Talos/~3/QZanLZERCHk/threat-spotlight-solarmarker.html #credentialstealer #securex #threats

Loda RAT Grows Up - By Chris Neal.Over the past several months, Cisco Talos has observed a malware campaign that utilize... more: http://feedproxy.google.com/~r/feedburner/Talos/~3/FP1Tfj2Deww/loda-rat-grows-up.html #credentialstealer #threatresearch #malware #autoit #rats #rat