CyberGeeksTech

Malware analysis, Incident Response, Penetration Testing

[CyberGeeksTech @GeeksCyber]

I've reverse engineered the infamous NSO Group's Pegasus spyware for Android. Check out the article if you want to know how it implements its functionalities. https://t.co/Tj4tLV5IUU #pegasus #spyware #dfir

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

攻撃者が配布用インストーラに自らのSSH認証情報やGitLabトークンをハードコードしたまま残し、約1年間の窃取キャンペーン全体を露呈させた事例が報告されています。偽の暗号資産取引アプリ「TralertFX」を囮に使う北朝鮮系アクターVELVET_CHOLLIMAの活動とみられ、フロント企業とみられる名義の正規EV証明書で署名されたMSIのAV検知率はわずか3/52。

窃取データの送出にGitLabへの自動コミットを使い境界防御の回避を狙った一方、配布物に認証情報やトークンを残す致命的なミスでインフラ全体が露呈した形です。

【攻撃の仕組みと規模】

・GitLabリポジトリをペイロード配信と窃取データの送出の両方に利用。システム偵察、キーロガー、ブラウザ認証情報窃取の3モジュールが30分間隔のgitコミットで盗んだデータを自動送信し、通常の開発者トラフィックに紛れる構成

・発見時点でコミット数は4,100件超、侵害ホストは90台以上。攻撃者は被害者ごとに名前付きフォルダで窃取データを手動分��し、暗号資産トレーダーを優先的に選別していたとされる

・最終ペイロードはオープンソースRATであるXenoRATの派生マルウェア「MoonPeak」。2025年6月から続くオペレーションで、当初はGitHubを使用していたが10月にGitLabへ移行し、11月以降は文字列ごとにシフト値の異なるシーザー暗号で難読化を強化

・EV証明書の発行先AgilusTech LLCはフロント企業と中〜高い確度で評価されており、コンパイルから署名まで26分で完了する自動ビルドパイプラインの存在も示唆されている

詳細は以下を参照：
https://t.co/lAtAL0Ekin

[Daily CyberSecurity @the_yellow_fall]

Velvet Chollima leaks its own backend infrastructure keys inside a malicious "Tralert FX" installer signed with a valid EV certificate.

#VelvetChollima #MalwareAnalysis #ThreatIntel #GitLab #CyberSecurity #InfoSec #CryptoTheft #OpSec #WindowsSecurity #EDR
https://t.co/IB4JflsQH5

[CyberGeeksTech @GeeksCyber]

I've analyzed a new VELVET CHOLLIMA (NK) campaign involving a fake trading app called Tralert FX. Key findings:
- Multi-module stealer
- GitLab-based auto-exfiltration
- Hardcoded creds exposed entire infrastructure
- MoonPeak payload
https://t.co/A7rUlxmvwo #dfir #threatintel

[Mr. OS @ksg93rd]

#Malware_analysis
1. Bandook RAT - C2 Traffic Analysis
https://t.co/tXXvPrbE1o
// IOC extraction, protocol analysis, and detection notes
2⃣. VELVET CHOLLIMA Infostealer Campaign
https://t.co/JRv7nggcCW
// Final payload is MoonPeak, a custom variant of the open-source XenoRAT malware
3⃣. Gentlemen RaaS
https://t.co/uPHFH9vzzY
// The group actively evaluates CVE-2024-55591-https://t.co/nQJG3gBkqI, CVE-2025-32433- https://t.co/tSxk6Rc6he, CVE-2025-33073- https://t.co/2T97IwM5wr and combines them with technique‑driven paths like backup and management‑controller abuse and NTLM relay workflows

[lazarusholic @lazarusholic]

"VELVET CHOLLIMA Infostealer Campaign Using Trading App as Lure" published by @HybridAnalysis. #VelvetChollima, #DPRK, #CTI https://t.co/KzridmxlQ0

[Nicolas Krassas @Dinosn]

VELVET CHOLLIMA Infostealer Campaign Using Trading App as Lure https://t.co/XfOkDGwN9E

[CyberGeeksTech @GeeksCyber]

I've analyzed a new VELVET CHOLLIMA (NK) campaign involving a fake trading app called Tralert FX. Key findings:
- Multi-module stealer
- GitLab-based auto-exfiltration
- Hardcoded creds exposed entire infrastructure
- MoonPeak payload
https://t.co/A7rUlxmvwo #dfir #threatintel

[CyberGeeksTech @GeeksCyber]

@forensico @forensico I've documented a similar campaign targeting Romania https://t.co/RJg77OAWQQ.

[Mr. OS @ksg93rd]

#Malware_analysis
1⃣ VoidLink: Dissecting an AI-Generated C2 Implant
https://t.co/EWawfskFDw
2⃣ Technical Analysis of GuLoader Obfuscation Techniques
https://t.co/F4qoGf7cv2
3⃣ "Opulous" - malicious Electron-based application
https://t.co/ETQJZ7g6UY
4⃣ Fake 7-Zip downloads are turning home PCs into proxy nodes
https://t.co/vk6O0Mv11u

[Nicolas Krassas @Dinosn]

Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders https://t.co/QESFwTFgWd

[CyberGeeksTech @GeeksCyber]

I've discovered an organized traffer gang (likely of Russian origin) that targets Web3 employees and Crypto holders and published the research at https://t.co/4QReL6kg0P. #malware #threatintelligence #dfir

[Virus Bulletin @virusbtn]

Hybrid Analysis reports an organised “traffer gang” targeting crypto holders and Web3 employees. The operation delivers malware via fake Electron apps, disguised as legitimate tools. https://t.co/jH2xu0VTAR

[Andre Gironda @AndreGironda]

Hybrid Analysis , Organized Traffer Gang on the rise targeting Web3 employees and crypto holders -- https://t.co/zqxIbjLmJF

[Nicolas Krassas @Dinosn]

Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders https://t.co/jrsRP170tZ

[Security Harvester @secharvesterx]

Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders
https://t.co/fZ5smNmfyJ

[/r/netsec @_r_netsec]

Organized Traffer Gang on the Rise Targeting Web3 Employees and Crypto Holders https://t.co/zlBMupEnPh

[CyberGeeksTech @GeeksCyber]

cc @TheHackersNews @BleepinComputer @DarkReading @SCMagazine @EHackerNews @the_yellow_fall @HackRead @gbhackers_news @The_Cyber_News

[CyberGeeksTech @GeeksCyber]

I've discovered an organized traffer gang (likely of Russian origin) that targets Web3 employees and Crypto holders and published the research at https://t.co/4QReL6kg0P. #malware #threatintelligence #dfir

[Ackee Blockchain Security @AckeeBlockchain]

A new two-stage malware is targeting crypto wallets, signed with a valid EV certificate to bypass security tools and steal sensitive data from Windows machines.

Here's how "LeakyInjector" and "LeakyStealer" work and how devs can protect themselves.

Thread ↓