More than 50 Alibaba-hosted command-and-control servers have been leveraged to facilitate the distribution of the backdoor, which impersonates the Java, bash, sshd, SQLite, and edr-agent utilities.

A crop of hackers were caught trying to steal money from the oldest profession in society.

Attacks from a China-based command-and-control server involved MacroPack-based documents uploaded from China-, Taiwan-, and Pakistan-based IP addresses that ordered the installation of macros that facilitated Brute Ratel and Havoc distribution between May and July.

Aside from leveraging Telegram bot API to facilitate stealthier exfiltration of targeted devices' sensitive and personal data, Angry Stealer has also been enhanced with the "MotherRussia.exe" payload, which could enable further malicious activity.

Aside from facilitating the comprehensive gathering and exfiltration of device information ManticoraLoader, which could be rented for $500 a month, also features extensive obfuscation capabilities enabling evasion of the 360 Total Security sandboxing tool, a report from Cyble Research and Intelligence Labs showed.

After obtaining initial network access through the exploitation of the VMware vulnerability, tracked as CVE-2023-38831, Head Mare proceeds with the deployment of the PhantomDL and PhantomCore backdoors that facilitate additional payload delivery.

Attackers who spoofed U.S., European, and Asian tax agencies distributed more than 20,000 phishing emails purporting to have updated tax information and links, which when clicked redirect to a search-ms URI file triggering a Python script that displays a decoy PDF while DLL side-loading Voldemort.

PowerShell attacks are common, but the malware’s combination of obfuscation, trusted Windows binaries, and persistence techniques makes it dangerous.