VolgmerMalware
- fallchill
- Manuscrypt
Volgmer is a backdoor Trojan designed to provide covert access to a compromised system. It has been used since at least 2013 to target the government, financial, automotive, and media industries. Its primary delivery mechanism is suspected to be spearphishing.From MITRE ATT&CK
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1056.001Keylogging
“InvisibleFerret supports functions such as remote control, data exfiltration, browser stealing capabilities, and keylogging.”
- T1059.009Cloud API
“api.camdriverhub.cloud api.camdrivers.cloud”
- T1195Supply Chain Compromise
“Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Lazarus ClickFake Interview Campaign: ClickFix Malware“It has relied on a wide range of malware and tools to achieve its objectives, leveraging wiper (Sharpknot), spyware (Manuscrypt), ransomware (VHD), trojanised applications (PondRAT), and exploiting open-source and zero-day vulnerabilities.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“Among payloads executed are included updated macOS and Windows variants of Manuscrypt, allowing to collect system information, execute arbitrary commands and download payloads.”
Indicators in its reports
named in the reports above- hxxps://www.archblock[.]comin 1 report
- www.archblock[.]comin 1 report
- all[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiadrivers-kp9s.updatein 1 report
- api.smartdriverfix[.]cloudin 1 report
- scenarios[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/coremedia-kp9s.shin 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiawins-updatein 1 report
- driverpackx[.]appin 1 report
- process.parent[.]pidin 1 report
- vid-crypto-assess[.]comin 1 report
- assessiohq[.]comin 1 report
- blockassess[.]comin 1 report
- blockchainjobassessment[.]comin 1 report
- blockchainjobhub[.]comin 1 report
- candidateinsightinfo[.]comin 1 report
- coinbase-walet[.]bizin 1 report
- coinbase-walet[.]mein 1 report
- competency-core[.]comin 1 report
- devchallengehq[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.