Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
4 matching stories
Spear-PhishingGoogle: APT42 Deploys Nicecurl and Tamecat Backdoors via Journalist Spear-Phishing
Google threat analysts report APT42 (Charming Kitten) is running spear-phishing campaigns that impersonate journalists and NGOs to deploy Nicecurl (VBScript) and Tamecat (PowerShell) backdoors for command execution and data exfiltration.
Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure
Kaspersky has identified a new APT group, Armored Likho, running a multi-stage spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer to steal credentials, browser data, and documents from government and critical infrastructure targets in Russia, Brazil, and Kazakhstan.
FortiGuard Labs flags UNC1549 for spear-phishing and VDI abuse against European aerospace and telecom targets
FortiGuard Labs published an Outbreak Alert for UNC1549, a suspected Iran-linked espionage group targeting aerospace, defense, and telecom organizations in Europe with spear-phishing, credential theft, and VDI abuse for initial access and lateral movement.
SentinelOne Refines APT42 Iran War Assessment with Three Months of New Evidence
SentinelOne's midyear assessment of the Iran War cyber threat landscape refines their April initial assessment with three months of evidence on APT42/MOIS, IRGC, and persona activity, including AI-assisted spear phishing and TAMECAT backdoor deployment.
