BRICKSTORMMalware

“We noted several global China-linked campaigns, such as APT group Lotus Blossom's Notepad++ supply-chain compromise and UNC2814’s campaign targeting telecoms and government entities worldwide.”

“Volexity found evidence of web shells, cryptocurrency miners, and alternate VPN configurations.”

“…t 341 malicious “skills” published to ClawHub and GitHub that deliver info-stealing malware targeting cryptocurrency API keys, wallet private keys, SSH credentials and browser passwords.”

“Volexity assesses with high confidence that this was done to blend in with legitimate network traffic and evade Conditional Access policies that would have otherwise prevented access.”

“…ack spoofed Ukrainian judicial domains to target a senior legal advisor, aiming to gain remote access for intelligence gathering or financial theft.”

“The infostealer, linked to the GrayBravo threat actor, is spreading through social engineering lures such as fake CAPTCHAs.”