@BushidoToken Threat Intel

In this blog, we shall investigate a Russia-based mercenary group that has appeared in multiple CERT-UA reports after sending waves of spam to Ukrainian organisations. These mercenaries use tried and tested tactics, techniques, and procedures (TTPs) that are low effort, but operationally functional. This includes use of off-the-shelf commodity crimeware as well as legitimate remote management and monitoring (RMM) tools. These mercenaries also are notable as they have low operational security (OPSEC) and offer their services publicly, to Russians, via Facebook, Instagram, Telegram, various cybercrime forums, as well as their own websites. Background on UAC-0050 A report by the Computer Emergency Response Team of Ukraine (CERT-UA) on 22 February 2024 shared a notable statement of attribution to a threat group tracked as UAC-0050 that CERT-UA has shared updates on several times already. The CERT-UA team and other security researchers online believe that UAC-0050 is linked to a Rus...

As the COVID-19 lockdown continues, there has been an increasing number of mobile threats appearing on the threat landscape. Android devices are by far the main targets of threat actors which have been delivering fake apps in the form of malicious .APK files to install banking Trojans, like Cerberus , as well as a number of spyware and SMS worms. ESET's malware expert, Lukas Stefanko, along with Malware Hunter Team, have uncovered and analysed an interesting new open-source Android Trojan called XploitSPY.  XploitSPY - new open-source Android Spying Tool -already spreads on UND forums -developed by cyber security solutions company from #India 🇮🇳 (3 ethical hackers) -they have 25years of exper. but based on photo they are under 30 -they also open-sourced Instagram phishing solution https://t.co/SEILSe5KAO pic.twitter.com/q8rIcE1pvI — Lukas Stefanko (@LukasStefanko) April 13, 2020 According to the researchers the malware has been designed by three ethical...