Cyber Incidents · IntelFusions threat intelligence

Cybercriminals are using a fake GTA 6 ISO to lure eager fans into installing a bundle of old but dangerous malware, including RATs, an infostealer, and destructive ransomware. Huntress found that the fake installer hides the payload while suggesting Russian-speaking users may be among the intended targets, and Windows Defender should detect the threat. #GrandTheftAutoVI #GTA6 #Huntress #NJRAT #DCRAT #MercurialGrabber #Chaos #YandexBrowser #ASHAHAckerTeam

A consumer infostealer accidentally infected a threat actor's workstation, leaking browser history, local folders, credentials, and a 'Rats' directory containing AsyncRAT, DcRat, Remcos, and XWorm builds. LevelBlue's investigation, published today, traced a GitHub commit email to public stealer logs

The investigation traced a GitHub staging account to an email address that also appeared in a stealer log, confirming the operator’s workstation was compromised and exposing its files, browser history, and build artifacts. Those artifacts revealed a broader Blind Eagle-style operation involving RATs, phishing templates, bulk email tooling, crypters, and infrastructure across GitHub, DuckDNS, Bitbucket, AWS S3, and related services. #BlindEagle #AsyncRAT #DcRat #Remcos #XWorm #GitHub #DuckDNS #Bitbucket #AWS_S3

At a Glance Malware family DCRat (DarkCrystal RAT) Threat actor Not attributed by Trellix; DCRat is a malware-as-a-service tool Target Users lured with a Colombian judicial theme Delivery vector Phishing email with a malicious SVG attachment Key capabilities Remote access, DLL sideloading, process hollowing, encrypted C2 Source Trellix Advanced Research Center (ARC) TL;DR Trellix analysts uncovered an active DCRat campaign that starts with a booby-trapped SVG file.

A sophisticated ClickFix campaign is targeting entities in the hospitality sector to infect them with the DCRat remote access trojan.

A RAR file, a fake summons, and a Nietzsche quote—all part of a multi-stage malware chain delivering DCRat & Rhadamanthys. Acronis TRU breaks down how attackers use VBS, batch, and PowerShell scripts ...

Threat actors are using the social engineering technique to deploy the DCRat remote access Trojan against targets in the hospitality sector.

A RAR file, a fake summons, and a Nietzsche quote—all part of a multi-stage malware chain delivering DCRat & Rhadamanthys. Acronis TRU breaks down how attackers use VBS, batch, and PowerShell scripts to slip past defenses. [...]

En mêlant phishing imitant Booking.com et la technique ClickFix, des pirates s'attaquent au secteur de l'hôtellerie en Europe pour déployer le malware DCRat.

Urgent: Hackers using compromised Signal accounts to deliver malware to Ukrainian military targets. #UkraineCyberattack #SignalCompromised #DCRAT

Researchers from ANY.RUN reported a new wave of DCRat malware, known for its wide array of harmful functions, selling the membership for the low cost of $5.

Russian cybersecurity researchers identified and dismantled a network of domains operated by the hacker group NyashTeam.

Learn about the distribution and ecosystem of DCRat and study a detailed dynamic analysis of DCRat using the ANY.RUN sandbox.

Source: Securonix Cybersecurity researchers have disclosed details of a new campaign dubbed PHALT#BLYX that has leveraged ClickFix-style lures to display fixes for fake blue screen of death (BSoD) errors in attacks targeting the European hospitality sector. The end goal of the multi-stage campaign is to deliver a remote access trojan known as DCRat, according to cybersecurity company Securonix.