I recently learned that the great folks from The DFIR Report have done a writeup covering the Latrodectus backdoor. Their report is titled From a Single Click: How Lunar Spider Enabled a Near Two-Mont...

New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malware for post-exploitation access to corporate networks.

New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malwar...

Phishing attack exploits social engineering techniques alongside Microsoft Teams and remote access software to deploy BackConnect malware

Cybersecurity researchers have disclosed details of a new BackConnect (BC) malware that has been developed by threat actors linked to the infamous QakBot loader. "BackConnect is a common feature or module utilized by threat actors to maintain persistence and perform tasks," Walmart's Cyber Intelligence team told The Hacker News. "The BackConnect(s) in use were 'DarkVNC' alongside the IcedID

Das BTF-Ökosystem wächst. Mit dem ROG Crosshair X870E Hero BTF listet Asus nun sein zweites AM5-Mainboard mit versteckten Anschlüssen.

Latest findings reveal that the IcedID malware is getting even more dangerous with updates to its BackConnect module for post-compromise activity.

Black Basta and CACTUS ransomware groups share the BackConnect module, suggesting a shift in affiliations.

SpyCloud Labs uncovers how LummaC2 uses GhostSocks to enable stealthy backconnect proxy access, helping attackers bypass controls and refresh tokens.

At a glance Factor Details Malware Family SynkLoader Threat Actor Suspected initial access broker or ransomware affiliate (Low-to-medium confidence) Target or Victims Corporate networks and enterprise employees Delivery Vector Microsoft Teams spear-phishing messages posing as IT helpdesk staff Key Capabilities Multi-language execution, fake lock-screen phishing, and backconnect proxy tunneling Source Expel Incident Response TL;DR Security researchers at Expel recently identified a novel threat called SynkLoader…

Learn about QBACKCONNECT and its role in the tactics of Black Basta and Cactus ransomware groups for cyber threats.

New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social engineering attacks and the BackConnect proxy malwar...

Malware disfarçado de suporte: BackConnect explora confiança em ferramentas Microsoft para se infiltrar e roubar dados corporativos e pessoais