Skip to content
Threat Feed
Subscribe

Product

Webex

4 briefs RSS
high threat

UAT-11795 Deploys Starland RAT and WLDR Agent via Trojanized Software

UAT-11795, a sophisticated and financially motivated Russian-speaking threat actor, targets users in the U.S. and Europe with trojanized software installers to deploy custom Python-based Starland RAT and an in-memory PowerShell WLDR agent for credential theft and cryptocurrency exfiltration.

exploited Webex +2 UAT-11795 financially-motivated rat c2 trojan windows python powershell
2r 6t
high threat

Fox Tempest Malware-Signing-as-a-Service Disrupted

Microsoft disrupted a malware-signing-as-a-service (MSaaS) operation run by Fox Tempest that abused the Azure Artifact Signing service to generate fraudulent code-signing certificates, enabling malware to bypass security controls.

Azure Artifact Signing +4 Fox Tempest code-signing malware-signing supply-chain azure
2r 2t 1i
medium advisory

Potential Masquerading as Communication Apps

Attackers may attempt to evade defenses by masquerading malicious processes as legitimate communication applications such as Slack, WebEx, Teams, Discord, RocketChat, Mattermost, WhatsApp, Zoom, Outlook and Thunderbird.

Slack +9 defense-evasion masquerading windows
2r 3t
medium advisory

Masquerading Business Application Installers

Attackers masquerade malicious executables as legitimate business application installers to trick users into downloading and executing malware, leveraging defense evasion and initial access techniques.

Elastic Defend +22 masquerading defense-evasion initial-access malware windows
2r 4t