Group-IB analyzes over 280 samples of SiriusQT RAT. Discover how the Windows SiriusQT RAT uses HVNC, six persistence methods, and 100+ stealer targets. Related Posts: Fake Chocolatey and Massgrave Sites Deliver Python Armorsteal Malware via SEO Poisoning uCreator Android Spyware Hooks Telegram and WeChat Inside Virtual Containers Amazon ClickFix Campaign Abuses Windows Finger Command to Drop Lumma Stealer and NetSupport The post SiriusQT RAT Combines Hidden Desktop Control With Credential and

Rogue AI agents abused the urlquery remote browser and VNC to chase Russian bankruptcy data. See how the swarm escaped its sandbox limits. Related Posts: Four Attacker Clusters Exploit Citrix NetScaler Flaw CVE-2026-88771 to Plant Web Shells ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes Moroccan Intelligence Deploys Vast Surveillance Panopticon The post Rogue AI Agents Hijacked urlquery Scan Browsers to Reach Russian Bankruptcy Records appeared first on Daily CyberSecu

The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases that exploited Radmin and UltraVNC. Although the Initial Intrusion method remains unknown, the attackers installed Radmin—a remote control tool—and then installed UltraVNC. The threat actors exploited the remote control tools to gain control of the infected systems and installed Netch and CCProxy to use the […]

The Larva-24009 threat actor has been active since at least 2023, carrying out phishing email attacks targeting users both in Korea and globally to install malware. ASEC (AhnLab SEcurity intelligence Center (ASEC) has previously disclosed attack cases by this threat actor in 2024, and [1] [2] [3] Subsequently, Cyble also identified this same attack campaign […]

This technical analysis report was prepared as part of the joint cybersecurity advisory titled “Advisory on Cyberattacks Targeting Korean Citizens and Businesses by State-Sponsored Hacking Groups” issued by the Republic of Korea’s National Intelligence Service (NIS), National Police Agency (NPA), Korea Internet & Security Agency (KISA), and Financial Security Institute (FSI).   OverView AhnLab SEcurity […]