🤖 Interesting APT Research and Cybersecurity News of the Week

🔹 The evolution of the EAGERBEE backdoor, reportedly used by APT CoughingDown in attacks on organizations in the Middle East, has been documented. Telecommunication providers and government agencies were among the victims.🔹 New attack tactics from Lazarus have emerged: victims received a trojanized version of the IPMsg messenger. Other activities of the group emerged as well, analyses cover the OTTERCOOKIE and SmallTiger malware strains.🔹 OceanLotus APT is spamming GitHub with trojanized versions of Cobalt Strike plugins.🔹 Analysis of the malicious framework SPAWN, used post compromise with fresh Ivanti zero-days.Two stories over Christmas highlight the danger of supply chain attacks. The compromise of the BeyondTrust identity management and remote support solution allowed attackers to infiltrate OFAC, a U.S. Treasury department handling sanctions.Meanwhile, skillful phishing led to the compromise of 35 popular Chrome Web Store extensions, including the Cyberhaven DLP extension.🔹 The banking trojan NGate, functioning as a kind of NFC proxy, has appeared in Russia.🔹 Analysis of the macOS infostealer BansheeStealer, with parts of its encryption code borrowed from Apple's Xprotect.🔹 Investigation of the NonEuclid trojan, gaining popularity in the underground for its high stealth capabilities.🔹 Thorough examination of the PEAKLIGHT loader, built on PowerShell and AutoIT, resulting in the installation of LummaC2, Cryptbot, and other commercial infostealers.🔹 Exploration of cloud environment infiltration tactics, using EC2 Grouper as an example. The group uses PowerShell for AWS and is suspected of conducting attacks to steal computers.#cybersecurity #APT