A previously disclosed China-linked threat cluster, tracked as OP-512, has been observed deploying a purpose-built web shell framework to compromise Internet Information Services (IIS) servers. Identified by ReliaQuest, the espionage operation targeted a Windows Server 2016 environment running an end-of-life .NET Framework 4.0. Telemetry revealed the threat actors established access 75 days prior to the […]

The post China-Linked Espionage Cluster Deploys Custom ASPX/ASHX Shells on IIS appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A sophisticated new malspam campaign is actively exploiting Google’s DoubleClick ad-tracking infrastructure to bypass enterprise email security gateways. Discovered by researchers at Huntress, the attack utilizes highly personalized dynamic lures to initiate a complex, five-stage infection chain that actively dismantles local defenses before deploying process-hollowed payloads. The attack chain begins with a malicious HTML attachment, […]

The post Malspam Campaign Abuses DoubleClick to Deploy Stealthy .NET Loader appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat cluster UNC3753, widely tracked as Silent Ransom Group or Luna Moth, is actively targeting professional, legal, and financial services in the United States. According to Mandiant’s Google Threat Intelligence Group (GTIG), this financially motivated campaign leverages a highly effective combination of voice phishing, remote monitoring and management abuse, and unprecedented physical office intrusions. Attackers […]

The post UNC3753 Targets US Law Firms with Vishing, RMM Tools, and Physical Break-Ins appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.