windows Archives - Recon Bee

Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

28May

By RBNo Comments

News

Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

Two banking trojan campaigns that aim to infect Windows and Android devices with Grandoreiro and BTMOB malware, respectively, target Latin America and Europe. According to recent research by WatchGuard and ESET, the two malware families are being used to target mobile individuals in Brazil as well as businesses in Spain, Portugal, and Mexico. The Grandoreiro campaign "uses the DLL Side-Loading technique abusing four different software, targeting banks in Portugal," according to Euler Neto, a WatchGuard researcher. Grandoreiro is a banking trojan that has been active since 2016 and has the ability to steal login credentials from thousands of financial institutions in 45 different countries and territories read more about Grandoreiro Malware and BTMOB RAT Campaigns Target Windows a...

Windows PowerShell now warns when running Invoke-WebRequest scripts

10Dec

By RBNo Comments

News

Windows PowerShell now warns when running Invoke-WebRequest scripts

In an effort to stop potentially dangerous code from running, Microsoft claims that Windows PowerShell now issues warnings when executing scripts that utilize the Invoke-WebRequest cmdlet to get web content. According to Microsoft, this mitigates a high-severity PowerShell remote code execution vulnerability (CVE-2025-54100), which mainly affects enterprise or IT-managed environments that use PowerShell scripts for automation. This is because PowerShell scripts are not as frequently used outside of these environments. The warning has been introduced to Windows PowerShell 5.1, which is the version of PowerShell that comes pre-installed on Windows 10 and Windows 11 PCs. It is intended to add the same safe web parsing procedure as is present in PowerShell 7. If you download web page...

30Oct

By RBNo Comments

News

Malicious NPM packages fetch infostealer for Windows, Linux, macOS

An information-stealing component that gathers private information from Windows, Linux, and macOS systems is downloaded by ten malicious packages that imitate genuine software projects in the npm registry. Because of several levels of obfuscation that enabled them evade common static analysis tools, the packages, which were posted to npm on July 4, went unnoticed for a considerable amount of time. Researchers at the cybersecurity firm Socket claim that the ten packages collected login credentials from browsers, authentication services, and system keyrings, and they counted close to 10,000 downloads. At the time of writing, the packages are still available, despite Socket reporting them to npm read more about Malicious NPM packages fetch infostealer for Windows Linux macOS. Get...

ASUS Armoury Crate bug lets attackers get Windows admin privileges

17Jun

By RBNo Comments

News

ASUS Armoury Crate bug lets attackers get Windows admin privileges

On Windows computers, a high-severity flaw in the ASUS Armoury Crate program can enable threat actors to elevate their privileges to SYSTEM level. With a severity rating of 8.8 out of 10, the security flaw is identified as CVE-2025-3464. It impacts the Armoury Crate system management software's AsIO3.sys and could be used to get around authorization. The official ASUS system control program for Windows is called Armoury Crate. It offers a centralized interface for managing ASUS peripherals and performance settings, adjusting fan curves, controlling RGB lighting (Aura Sync), and downloading drivers and firmware updates. The software package employs the kernel driver to access and control hardware capabilities in order to carry out all of these tasks and offer low-level system monitor...

Chaos RAT Malware Targets Windows and Linux via Fake Network Tool Downloads

5Jun

By RBNo Comments

News

Chaos RAT Malware Targets Windows and Linux via Fake Network Tool Downloads

A new version of a remote access trojan (RAT) known as Chaos RAT has been utilized in recent attacks against Linux and Windows systems, and threat hunters are drawing attention to it. Acronis's results suggest that the malware artifact might have spread by deceiving victims into downloading a Linux network troubleshooting tool. In a study shared with The Hacker News, security experts Santiago Pontiroli, Gabor Molnar, and Kirill Antonenko claimed that Chaos RAT is an open-source RAT written in Golang that supports both Windows and Linux systems. Drawing inspiration from well-known frameworks like Cobalt Strike and Sliver, Chaos RAT offers an administration panel that enables users to create payloads, create sessions, and take control of compromised systems read more about Chaos RA...

New ‘Defendnot’ tool tricks Windows into disabling Microsoft Defender

19May

By RBNo Comments

News

New ‘Defendnot’ tool tricks Windows into disabling Microsoft Defender

'Defendnot' is a new utility that can disable Microsoft Defender on Windows devices by registering a phony antivirus program, even if there isn't any actually installed. The method makes advantage of an undocumented Windows Security Center (WSC) API, which antivirus software uses to inform Windows that it has been installed and is now in charge of the device's real-time security. To prevent conflicts from running several security apps on the same device, Windows immediately disables Microsoft Defender when an antivirus product is registered. This API is abused by the Defendnot utility, developed by researcher es3n1n, which registers a phony antivirus program that passes all of Windows' validation checks. The tool is built on a prior project called no-defender, which spoof regi...

New VanHelsing ransomware targets Windows, ARM, ESXi systems

25Mar

By RBNo Comments

News

New VanHelsing ransomware targets Windows, ARM, ESXi systems

VanHelsing is a recently discovered multi-platform ransomware-as-a-service (RaaS) business that targets Linux, Windows, BSD, ARM, and ESXi computers. On March 7, VanHelsing was originally advertised on underground cybercrime platforms, giving seasoned affiliates a free pass to sign up while requiring a $5,000 payment from less seasoned threat actors. CYFIRMA initially reported the new ransomware operation late last week, but Check Point Research conducted a more thorough investigation that was released Tuesday. VanHelsing is a Russian cybercrime initiative that prohibits targeting systems in Commonwealth of Independent States (CIS) nations, according to Check Point's experts. Operators receive 20% of the ransom money, while affiliates are permitted to keep 80%. An automated escro...

LightSpy Expands to 100+ Commands, Increasing Control Over Windows, macOS, Linux, and Mobile

26Feb

By RBNo Comments

News

LightSpy Expands to 100+ Commands, Increasing Control Over Windows, macOS, Linux, and Mobile

An upgraded LightSpy implant with a wider range of data collecting capabilities has been identified by cybersecurity researchers as a way to gather information from social media sites like Facebook and Instagram. The modular spyware known as LightSpy can infect Apple and Windows systems with the intention of gathering data. It was initially reported in 2020, focusing on Hong Kong users. This include data from a variety of apps, including as Files, LINE, Mail Master, Telegram, Tencent QQ, WeChat, and WhatsApp, as well as Wi-Fi network information, screenshots, location, iCloud Keychain, voice recordings, images, browsing history, contacts, phone history, and SMS messages. ThreatFabric revealed a revised version of the malware late last year that increases the number of compatible ...

FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux

13Feb

By RBNo Comments

News

FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux

Threat hunters have revealed a new campaign that uses custom malware that can provide infected computers remote access to target the foreign ministry of an unidentified South American country. Elastic Security Labs has linked the behavior, which was discovered in November 2024, to a threat cluster it monitors with the ID REF7707. A university and a telecoms company in Southeast Asia are among the potential targets. According to a technical examination by security experts Andrew Pease and Seth Goodwin, the REF7707 campaign's owners demonstrated poor campaign management and inconsistent evasion techniques, despite the campaign's well-designed read more about FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux. Get up to date on the latest cyberse...

North Korea-Linked Malware Targets Developers on Windows, Linux, and macOS

1Aug

By RBNo Comments

News

North Korea-Linked Malware Targets Developers on Windows, Linux, and macOS

The threat actors responsible for a persistent campaign of malware directed on software developers have showcased novel malware and strategies, broadening their scope to encompass Windows, Linux, and macOS operating systems. It has been discovered that the North Korean-affiliated activity cluster, known as DEV#POPPER, has targeted victims in South Korea, North America, Europe, and the Middle East. Securonix researchers Den Iuzvyk and Tim Peck described this type of attack as an advanced form of social engineering, intended to coerce people into disclosing private information or taking actions against their better judgment. They made these claims in a recent article that was shared with The Hacker News. An ongoing malware operation known as DEV#POPPER lures software developers rea...