ALT Pictorial representation of KimJongRAT stealer. Image of a computer screen displaying code with a prominent Biohazard symbol in the center, accompanied by the text 'INFECTED' in red, indicating a cybersecurity threat.

ALT Pictorial representation of a European phishing campaign. A digital artwork depicting a glowing, futuristic shield disintegrating into small fragments against a shimmering blue background.

ALT Diagram showing a cybersecurity threat involving AI models. M malicious model in a public repository.

ALT Pictorial representation of SnipBot malware. Digital abstract background featuring binary code and technology symbols with a blue glow in the shape of a skull.

ALT A pictorial representation of ShinyHunters ransomware. An image showing a laptop with security and financial graphics displayed on the screen, surrounded by stacks of coins and a credit card, set against a dark background illuminated by neon lights.

ALT Screen capture of a Telegram channel named "olympic2024" with the Paris 2024 logo, claiming to have 7,825 subscribers. The channel has options to mute, search, leave, and features a link.

ALT Screenshot of a pinned message in the Telegram channel announcing giveaways related to the group's "Olympic Games Platform" for investments. The chat contains multiple messages advertising an investment opportunity related to the Olympics. Messages highlight daily profits, recruitment of friends and partners, and anniversary registration with a website link provided. Offers include prizes for participation, with specific investment amounts noted. The background is blue with white text, and there is mention of a specific URL and currency amounts in USD.

ALT A screenshot of mobile app. The upper image displays icons for an Olympics Shop, available in English, featuring a phone signal and battery indicators at the top. The lower section shows a Task Hall.

ALT Announcement from the app about "Olympics platform investments." An infographic about the "Olympics Announcement" discussing future Olympic Games activities and venue innovation plans.

ALT A pictorial representation of malware distributed via GootLoader. An open laptop against a dark background is flanked by exclamation points. On the laptop screen are overlapping windows with a bug icon representing the malware.

ALT Screenshot of a computer screen displaying a tutorial on the exploitation method against CVE-2024-4577 using a Python script. The script contains code for testing SQL vulnerability with detailed comments and payload examples. A terminal window shows command output listing directory contents on a device labeled 'Hello Hackers Volume in drive C has no label.' Example of Auto_Append_File exploitation method against the CVE.

ALT A pictorial representation of malicious OneNote samples. An opened envelope reveals a sheet with a malicious bug icon on it. An at symbol is in the upper right.

ALT A pictorial representation of DNS tunneling. Stacks of folders are in rows. One column of folders is a contrasting color topped with a skull icon within a triangle. The Palo Alto Networks and Unit 42 logos.

ALT Google search leads to fake forum post. Google search results page. Red arrow points to Solar Audio "Is bear spray legal in CA?" link.

ALT Screenshot of forum. Browser Downloads notification popup. Forum post from Emma Hill asks about legal bear spray. Downloading ZIP archive from fake forum post. Red arrow points from link to download popup.

ALT wscript.exe runs JS file from downloaded ZIP

ALT After initial infection, scheduled task for persistence. A red arrow points to the relevant row in the folder.

ALT PowerShell commands caused by scheduled task: Windows registry update for AutodialDLL to load malware. Highlighted blue code is the malicious DLL for command and control.

ALT Thread-hijacked email>link>redirects to fake Azure page>Firebase URL>.js file download> victim double-clicks JS file> wscript runs JS file> JS generates WebDAV traffic for MSI> MSI installs Latrodectus DLL>Latrodectus C2? Lumma EXE sent over Latrodectus C2

ALT Screenshot of email. Example of thread hijacked email. That you for staying a respected client. We truly value your precious time & the interest you give us and here's your most recent invoice down below: [Link].

ALT Screenshot of Microsoft Azure download window. Link from email redirects to fake Azure page for JavaScript file download. Download popup alert.

ALT Traffic from an infection filtered in Wireshark. Top to bottom: Link from Email. Fake Azure page. JS file download. Latrodectus installer. WEBDAV traffic. Latrodectus C2 starts. Lumma Stealer data exfiltration.