spear-phishing
HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm
Cybersecurity researchers have identified a new Go-based loader framework named HollowFrame, which is used in conjunction with a Rust-based backdoor called Matryoshka. The attack chain begins with a spear-phishing email containing a malicious link that, when clicked, leads to the execution of a Windows Shortcut file. This initiates a multi-stage process involving privilege escalation, disabling Microsoft Defender, and downloading further malicious payloads.
Armored Likho Hits Government, Energy Sectors With BusySnake Stealer
Cybersecurity researchers have identified a new threat actor, dubbed Armored Likho, targeting government and energy sectors in Russia, Kazakhstan, and Brazil with a sophisticated phishing campaign. The operation utilizes a custom-built Python infostealer named BusySnake, designed to steal credentials, sensitive documents, and other high-value data. The attackers employ AI-generated payloads to obscure their activities and maintain persistence through various methods, including reverse SSH tunneling.