The Cluster25 Blog
The Duck is Hiring in Italy: DUCKTAIL Spread via Compromised LinkedIn Profiles
October 25, 2023Cluster25 observed a malicious campaign that employs LinkedIn messages as a vector for executing identity theft attacks....
CVE-2023-38831 Exploited by Pro-Russia Hacking Groups in RU-UA Conflict Zone for Credential Harvesting Operations
October 12, 2023Cluster25 observed and analyzed several phishing-based attacks to be linked to a Russia-nexus nation-State threat actor....
The Fraud Gala: Exploring a Recent BEC Campaign
August 25, 2023In the modern digital era, businesses operate on a global scale, exchanging information, collaborating, and conducting f...
Back in Black: BlackByte Ransomware returns with its New Technology (NT) version
May 22, 2023BlackByte is a Ransomware-as-a-Service (RaaS) group that is known for the use of the homonymous malware that is constant...
Cluster25 has become partner of DNS0 Project
May 2, 2023We are pleased to announce to have become a partner of the DNS0 Project, the European security-oriented DNS born to prot...
Cluster25 joins the VirusTotal community
March 16, 2023We are proud to announce that Cluster25 has joined the VirusTotal community, improving its website/domain scanning engin...
An infostealer comes to town: Dissecting a highly evasive malware targeting Italy
December 22, 2022Cluster25 researchers analyzed several campaigns (also publicly reported by CERT-AGID) that used phishing emails to spre...
Sanctioned deals: the Irano-Russian connection under Ankara's supervision. Analysis of the NPPD leak
November 7, 2022On October 22nd, during the usual OSInt monitoring, Cluster25 detected the Farsi speaking hacktivist TA known as Black R...
In the footsteps of the Fancy Bear: PowerPoint mouse-over event abused to deliver Graphite implants
September 23, 2022Cluster25 researchers collected and analyzed a lure document used to implant a variant of Graphite malware, uniquely lin...
Erbium InfoStealer Enters the Scene: Characteristics and Origins
September 15, 2022On the 21st of July 2022 on a DWW (Deep/Dark Web) forum, a Russian speaking threat actor created an announcement about t...