KillSwitchMalware
ransomwareFrom MISP Galaxy
Last reported 19 days ago, by The Hacker News6 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1036Masquerading
“The end goal is to deploy a custom backdoor called CosmicPulse by setting up scheduled tasks using RedFlick through phishing emails masquerading as invitations.”
- T1053.005Scheduled Task
“The end goal is to deploy a custom backdoor called CosmicPulse by setting up scheduled tasks using RedFlick through phishing emails masquerading as invitations.”
- T1056.001Keylogging
“"The latest Python NodeStealer variant incorporates new spyware features, including keylogging, clipboard monitoring, and screenshot capture," Netskope said.”
- T1505.003Web Shell
“…026-82078 and CVE-2026-81578, two PaperCut MF vulnerabilities, as zero-days to load an in-memory Java loader, which in turn deployed a web shell.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests“As part of Operation KillSwitch, a total of three suspects were provisionally arrested and eight properties searched in Greece, Romania, Spain, and the U.K.”
-
Police Target KillSec Ransomware Group with Arrests and Seizures“Led by German police, Operation KillSwitch saw law enforcers seize the group’s leak site and prevent at least 110TB of stolen data from being exposed, it explained.”
-
Authorities seize KillSec extortion group infrastructure, arrest 3 alleged members“The arrests were part of “Operation KillSwitch,” a globally coordinated operation aided by 10 countries and private cybersecurity companies.”
-
Operation KillSwitch: Police Dismantle KillSec Ransomware Group“Operation KillSwitch: Police Dismantle KillSec Ransomware Group”
-
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader“The teen was identified in Operation KillSwitch, an international investigation led by police and prosecutors in Germany.”
-
Petya starts with Ukraine and then goes global“KillSwitch: On launch, the malware checks if a file with its own name exists in Windows directory, without an extension.”
Indicators in its reports
named in the reports above- apply.fbijobs[.]govin 1 report
- commands[.]inin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.