Since March 2025 there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. We reveal how bad signing practices allow threat actors to abuse this legitimate software to build and distribute their own signed…
Tag: Security Blog G Data Software AG
ConnectUnwise: Threat actors abuse ConnectWise as builder for signed malware
Since March 2025 there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. We reveal how bad signing practices allow threat actors to abuse this legitimate software to build and distribute their own signed…
Reborn in Rust: AsyncRAT
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Security Blog G Data Software AG Read the original article: Reborn in Rust: AsyncRAT
Printer company provided infected software downloads for half a year
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Security Blog G Data Software AG Read the original article: Printer company provided infected software downloads for…
Sit, Fetch, Steal – Chihuahua Stealer: A new Breed of Infostealer
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Security Blog G Data Software AG Read the original article: Sit, Fetch, Steal – Chihuahua Stealer: A…
Sit, Fetch, Steal – Chihuahua Stealer: A new Breed of Infostealer
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Security Blog G Data Software AG Read the original article: Sit, Fetch, Steal – Chihuahua Stealer: A…
100 Days of YARA: Writing Signatures for .NET Malware
If YARA signatures for .NET assemblies only rely on strings, they are very limited. We explore more detection opportunities, including IL code, method signature definitions and specific custom attributes. Knowledge about the underlying .NET metadata structures, tokens and streams helps…
100 Days of YARA: Writing Signatures for .NET Malware
If YARA signatures for .NET assemblies only rely on strings, they are very limited. We explore more detection opportunities, including IL code, method signature definitions and specific custom attributes. Knowledge about the underlying .NET metadata structures, tokens and streams helps…
Vidar Stealer: Revealing A New Deception Strategy
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Security Blog G Data Software AG Read the original article: Vidar Stealer: Revealing A New Deception Strategy
Smoked out – Emmenhtal spreads SmokeLoader malware
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Security Blog G Data Software AG Read the original article: Smoked out – Emmenhtal spreads SmokeLoader malware
Smoked out – Emmenhtal spreads SmokeLoader malware
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from Security Blog G Data Software AG Read the original article: Smoked out – Emmenhtal spreads SmokeLoader malware
Unboxing Anubis: Exploring the Stealthy Tactics of FIN7’s Latest Backdoor
In the ever-evolving landscape of advanced persistent threats (APTs), the notorious financial cybercrime group FIN7 has added another sophisticated tool to their arsenal. We have recently discovered a new Python-based backdoor, called “AnubisBackdoor”, being deployed in their latest campaigns. This…
Unboxing Anubis: Exploring the Stealthy Tactics of FIN7’s Latest Backdoor
In the ever-evolving landscape of advanced persistent threats (APTs), the notorious financial cybercrime group FIN7 has added another sophisticated tool to their arsenal. We have recently discovered a new Python-based backdoor, called “AnubisBackdoor”, being deployed in their latest campaigns. This…
Booking a Threat: Inside LummaStealer’s Fake reCAPTCHA
Cybercriminals are taking advantage of the increased demand in travel by setting up fake booking sites, phishing scams and fraudulent listings to trick unsuspecting travelers. This article has been indexed from Security Blog G Data Software AG Read the original…
Malware from fake recruiters
Fake recruiters are currently on the hunt for CVs – and also your data. Reports have emerged about malware being put into work assignments that supposedly test a candidate’s technical skills. This article has been indexed from Security Blog G…
Malware from fake recruiters
Fake recruiters are currently on the hunt for CVs – and also your data. Reports have emerged about malware being put into work assignments that supposedly test a candidate’s technical skills. This article has been indexed from Security Blog G…
An honest mistake – and a cautionary tale
We all make mistakes. That is only natural. However, there are cases in which these mistakes can have unexpected consequences. A Twitter user recently found this out the hard way. The ingredients: a cheap USB-C adapter with a network connection,…
New I2PRAT communicates via anonymous peer-to-peer network
Criminals try to cover their tracks as best they can. This also includes hiding any activities that control the machines they have compromised. Using I2P is one way of doing that, but until recently this has rarely been used. This…
Malware Analysis: A Kernel Land Rootkit Loader for FK_Undead
We discovered a Windows rootkit loader [F1] for the malware family FK_Undead. The malware family is known for intercepting user network traffic through manipulation of proxy configurations. To the best of our knowledge the rootkit loader hasn’t been officially analyzed…
Malware Analysis: A Kernel Land Rootkit Loader for FK_Undead
We discovered a Windows rootkit loader [F1] for the malware family FK_Undead. The malware family is known for intercepting user network traffic through manipulation of proxy configurations. To the best of our knowledge the rootkit loader hasn’t been officially analyzed…