The Cluster25 Blog
CVE-2023-38831 Exploited by Pro-Russia Hacking Groups in RU-UA Conflict Zone for Credential Harvesting Operations
October 12, 2023Cluster25 observed and analyzed several phishing-based attacks to be linked to a Russia-nexus nation-State threat actor....
Cybersecurity Risks and Challenges in the Chemical Industry
April 12, 2023Cybersecurity is a critical concept to take into consideration in the chemical sector given the potential consequences a...
Sanctioned deals: the Irano-Russian connection under Ankara's supervision. Analysis of the NPPD leak
November 7, 2022On October 22nd, during the usual OSInt monitoring, Cluster25 detected the Farsi speaking hacktivist TA known as Black R...
In the footsteps of the Fancy Bear: PowerPoint mouse-over event abused to deliver Graphite implants
September 23, 2022Cluster25 researchers collected and analyzed a lure document used to implant a variant of Graphite malware, uniquely lin...
Cozy Smuggled Into the Box: APT29 Abusing Legitimate Software for Targeted Operations in Europe
May 13, 2022Cozy Bear (aka Nobelium, APT29, The Dukes) is a well-resourced, highly dedicated and organized cyberespionage group that...
The strange link between a destructive malware and a ransomware-gang linked custom loader: IsaacWiper vs Vatet
May 3, 2022NOTICE: After additional reviews, the team at Cluster25 has determined that the code commonality identified in the two a...
The Lotus Panda is Awake Again: Analysis of the Last Strike
April 29, 2022NAIKON is the name of an APT (Advanced Persistent Threat) which is believed to originate from China. The Naikon hacker g...
DPRK-NEXUS Adversary Targets South Korean Individuals in a New Chapter of Kitty Phishing Operations
April 11, 2022The research team at Cluster25 traced a recent activity that started in the first days of April 2022 from a DPRK-nexus t...
Ghostwriter / UNC1151 Adopts Microbackdoor Variants in Cyber Operations Against Ukraine
March 8, 2022For a few months Cluster25 collected and analyzed several malicious activities which then were internally linked with th...
Ukraine: Analysis of the new disk-wiping malware (HermeticWiper)
February 24, 2022Very recently a new type of destructive malware named by the security community “HermeticWiper” was used to attack organ...