Rat-Malware · CuraSec

tag: Rat-Malware · 3 items

Engineer — Skip
SOC/IR — Learn: ASHVEIN is a newly documented .NET infostealer/RAT using HTML to conceal C2 commands — adds to actor-profile knowledge for UAC-0099, but no IOCs or ATT&CK mappings are published in this report to enable immediate detection or hunting work.
Leader — Skip

Engineer — Learn: ClickFix via sponsored search ads is a growing delivery vector worth accounting for in endpoint browser controls and employee-facing systems; no specific software to patch here.
SOC/IR — Plan: Build or tune detections for ClickFix behavioral patterns — clipboard-sourced command execution, mshta or PowerShell spawned from browser context — targeting this ChatGPT-branded lure campaign; no specific IOCs surfaced yet.
Leader — Learn: Active campaign exploiting employee searches for AI tools via paid ads; reinforces the case for security awareness content on verifying official software sources before downloading.

Engineer — Skip
SOC/IR — Learn: Consumer-targeted campaign delivering infostealer and RAT via fake gaming tools; lure technique is low-novelty but worth noting if the estate includes personal devices or BYOD endpoints where gaming software might appear.
Leader — Skip