Viewing profile — 6mile

DPRK has created a new leaner technique to obfuscate its C2 payloads with NullReceiver. The NPM packages call the Ethereum blockchain directly to find hidden addresses in the desti…

Because the Go and Packagist registries don't require additional publishing credentials like NPM and PyPI North Korean threat actors have been able to compromise legitimate package…

NPM attack targeting Mastro targets browser extensions other than crypto wallets. - Credential managers and MFA authenticators from LastPass, Bitwarden, 1Password, Deloitte, Dashla…

Signs point to the Miasma worm, but this is unconfirmed yet.

The same threat actor that compromised Axios published three additional NPM packages within 18 hours. Unfortunately, these packages are still alive on NPM and compromising victims.…

If you are a Kubernetes shop, you will want to check whether you are using the Antrea project. Nothing malicious has been deployed yet, as we caught this one early, but the threat …

TeamPCP claims another victim and this time they call it "Shai-Hulud: The Third Coming"

We have helped several orgs with incident response and this is the playbook that we used.

The bash script for checking for infection? is that what you are talking about?

Hi, I'm one of the researchers that identified this threat and I blogged about it back in November ( https://opensourcemalware.com/blog/contagious-interview-vsco... ) First, @Tyria…

This malware is a full-featured RAT that uses Telegram for C2 and is only 143 lines of code. It's "RAT-as-a-library" design means that we are already seeing criminals build more co…