Tag
CL-CRI-1171 Pay-Per-Install Infrastructure and Malware Campaign
1 rule 2 TTPs 5 IOCsThe CL-CRI-1171 threat actor operates a large-scale pay-per-install marketplace, leveraging SEO poisoning and YouTube gaming lures to deploy a persistent multi-payload loader used to distribute malware including Insomnia RAT and ARKTunnel.
GPU Mining Malware Spreads via SEO Poisoning and AI Chatbots
3 rules 6 TTPs 1 IOCA cryptojacking campaign targets systems with high-performance GPUs using SEO poisoning and manipulated AI chatbot recommendations, distributing malware disguised as legitimate software utilities to establish persistence and evade detection before deploying GPU mining programs.
Cryptojacking Campaign Abusing ScreenConnect and SEO Poisoning
2 rules 1 TTP 1 IOCAn active cryptojacking campaign uses SEO poisoning, AI chatbot interactions, and ScreenConnect abuse to target high-performance PCs, aiming to maximize GPU mining yield and establish persistent remote access for potential data theft or ransomware attacks.
Nimbus Manticore Resurfaces During Operation Epic Fury with New Techniques
2 rules 3 TTPsNimbus Manticore, an Iranian IRGC-affiliated threat actor, resurfaced during Operation Epic Fury, employing AppDomain Hijacking, SEO poisoning, and a new MiniFast backdoor while targeting the aviation and software sectors.