Your Cyble Newsletter

Hi reader, here is your Cyble Newsletter for June 29, 2022

We have an action-packed newsletter for our readers this week. From clippers to loaders to droppers to builders, every type of malware has been extremely active recently. Cyble Research Labs has also observed heightened activity across various areas in cyberspace with a particular focus on re-emerging Threat Actors and Ransomware groups as well as the widespread exploitation of vulnerabilities. To wrap things up, we're also sharing our insights into Initial Access Brokers and their pivotal role in Cybercrime attacks.      Exposed Network Monitor Tool increases the risk of intrusion Cyble analyzes a misconfigured Network Monitor Tool that could leave IT networks vulnerable to compromise and exploitation by Threat Actors.   Cerber2021 Ransomware group back in action The subject of this analysis is Cerber2021 Ransomware - a potential rebrand of the popular Cerber Ransomware family.    Quantum Software: LNK File-Based Builders Growing In Popularity This blog covers Quantum, a .lnk -based builder which has been with possible links to the Lazarus APT Group.   Keona Clipper targets Cryptocurrency users via Telegram In this blog, we take a look at Keona Clipper - an evasive malware variant targeting crypto-wallets and cryptocurrency users.   Matanbuchus Loader resurfaces Matanbuchus is a well-known malware loader that has been highly active in the past. This blog covers it's return in a new variant that delivers Cobalt Strike Beacons via Spam Campaigns.   Threat Actors exploiting Misconfigured Amazon S3 Buckets Cyble takes a look at how entities of all sizes continue to be plagued by Threat Actors exploiting misconfigured Amazon S3 buckets as attack vectors.    NightLion Worm strikes again Read Cyble's detailed analysis of the recently resurfaced "NightLion", a worm that targets vulnerable, openly-accessible Elasticsearch Servers.   Exposed Kubernetes Clusters place organization at risk of Data Breach In this piece, we  take a look at misconfigured Kubernetes clusters and how they could potentially be exploited by Threat Actors and cause a Data Breach.   Bahamut Malware Returns Cyble shares its observations on the return of Bahamut Malware from it's hiatus since 2021 and the new spyware capabilities built into this latest iteration.   The Role of Initial Access in the Ecology of Cybercrime Join us as we do a deep-dive on the pivotal role that Initial Access Brokers play in Organized Cybercrime and how Initial Access is a key element to most sophisticated incidences of cybercrime.   Connect with Cyble Cyble is a Y-combinator backed Cyber Intelligence company which has been recognized as "20 Best Cybersecurity Start-Ups To Watch"  (Forbes), "Top Tech Companies Globally" (Crunchbase), a multi-category winner at the 10th Annual Global Cybersecurity Awards (Cyber Defense magazine) and "Best Cybersecurity Startup" (2022 Cybersecurity Excellence Awards). We help organizations understand and manage their deep, dark and surface web exposure.

11175 Cicero Drive Suite, 100 • Alpharetta, GA 30022 • United States • Click here to unsubscribe.