The Cluster25 Blog
Cluster25 joins the VirusTotal community
March 16, 2023We are proud to announce that Cluster25 has joined the VirusTotal community, improving its website/domain scanning eng...
An infostealer comes to town: Dissecting a highly evasive malware targeting Italy
December 22, 2022Cluster25 researchers analyzed several campaigns (also publicly reported by CERT-AGID) that used phishing emails to sp...
Sanctioned deals: the Irano-Russian connection under Ankara's supervision. Analysis of the NPPD leak
November 7, 2022On October 22nd, during the usual OSInt monitoring, Cluster25 detected the Farsi speaking hacktivist TA known as Black...
In the footsteps of the Fancy Bear: PowerPoint mouse-over event abused to deliver Graphite implants
September 23, 2022Cluster25 researchers collected and analyzed a lure document used to implant a variant of Graphite malware, uniquely lin...
Erbium InfoStealer Enters the Scene: Characteristics and Origins
September 15, 2022On the 21st of July 2022 on a DWW (Deep/Dark Web) forum, a Russian speaking threat actor created an announcement about t...
LockBit 3.0: “Making the ransomware great again”
July 6, 2022LockBit is a major player in the ransomware scene and has contributed heavily for this cyber-crime model to become one o...
Cozy Smuggled Into the Box: APT29 Abusing Legitimate Software for Targeted Operations in Europe
May 13, 2022Cozy Bear (aka Nobelium, APT29, The Dukes) is a well-resourced, highly dedicated and organized cyberespionage group that...
The strange link between a destructive malware and a ransomware-gang linked custom loader: IsaacWiper vs Vatet
May 3, 2022NOTICE: After additional reviews, the team at Cluster25 has determined that the code commonality identified in the two a...
Ghostwriter / UNC1151 Adopts Microbackdoor Variants in Cyber Operations Against Ukraine
March 8, 2022For a few months Cluster25 collected and analyzed several malicious activities which then were internally linked with th...
RuRAT used in spear-phishing attacks against media organisations in United States
March 3, 2022INTRODUCTION On 23.02.2022 one of our partners received a very specific targeted spear-phishing email message which lead...