Latest from the Lab
Our researchers and analysts share what they're discovering — from zero-day analysis to nation-state TTPs.
Anatomy of a Multi-Stage Phishing Attack: From an Impersonated Email to a Fake Microsoft Login
One ordinary-looking email took its recipient through six stages and ended at a fake Microsoft sign-in page built to steal their password. We traced every hop…
SparkCat Android Malware
THREAT ALERT: SparkCat Malware Returns, Our Team Caught a New Variant Live on Google Play Store
What is Ahtw Ransomware
Ahtw is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
Beware of Microsoft Phishing Page: Protect Your Login Credentials
Introduction Phishing attacks continue to pose a significant threat to individuals and organizations worldwide. Analysts at SecneurX have...
Unveiling a New Malicious Campaign Exploiting Yolasite.com: A Closer Look
Introduction In the ever-evolving landscape of cyber threats, new campaigns emerge with innovative tactics to compromise unsuspecting...
What is Neon Ransomware?
Neon is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Neqp Ransomware?
Neqp is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Xash Ransomware?
Xash is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Gash Ransomware?
Gash is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Qopz Ransomware?
Qopz is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Fofd Ransomware ?
Fofd is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
BEWARE OF FAKE CHROME UPDATE
SecneurX Analysts found a Fake Chrome Update. Recently Malware authors used the compromised website to display fake Google Chrome...
What is Sato Ransomware ?
Sato is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Foza Ransomware ?
Foza is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Coza Ransomware ?
Coza is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Cylance Ransomware ?
SecneurX Analysts found Cylance Ransomware in the wild. Cylance ransomware encrypts files and appends its extension (".Cylance") to...
What is Dapo Ransomware ?
Dapo is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is SkullLocker Ransomware ?
SecneurX Analysts found the SkullLocker Ransomware in the wild and analyzed the sample. This ransomware exhibits several similarities...
What is Tywd Ransomware ?
Tywd is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
what is Jywd Ransomware ?
Jywd is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Dazx Ransomware ?
Dazx is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Coba Ransomware ?
Coba is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Qapo Ransomware ?
Qapo is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Dark Power Ransomware ?
SecneurX Analysts found Dark Power Ransomware in the wild. Dark Power ransomware encrypts files and appends its extension (".dark_power")...
What is Kifr Ransomware ?
Kifr is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
what is Niwm Ransomware ?
Niwm is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
what is Jypo Ransomware ?
Jypo is ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
Malware Starts up Abusing Microsoft's OneNote
Analysts at SecneurX have found that the Redline malware is abusing Microsoft’s OneNote to spread malware. OneNote is one of the highly...
What is Snwkz Ransomware ?
Secneurx Analyst found Snwkz ransomware in the wild and analyzed the sample. Snwkz ransomware belongs to the hive ransomware family....
What is Faust Ransomware ?
Secneurx Analyst found Faust ransomware in the wild and analyzed the sample. Faust ransomware encrypts files and appends its extension...
What is Qotr Ransomware ?
Qotr is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Qoqa Ransomware ?
Qoqa is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Iotr Ransomware ?
Iotr is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Hhee Ransomware ?
Hhee is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Coaq Ransomware ?
Coaq is a ransomware that belongs to the Djvu/Stop Ransomware family. SecneurX Analysts observed that among the prominent ransomware...
What is Goaq Ransomware ?
Goaq is a ransomware that belongs to the Djvu/Stop Ransomware family. SecneurX Analysts observed that among the prominent ransomware...
What is 726 Ransomware ?
SecneurX Analysts found 726 Ransomware in the wild. 726 ransomware encrypts files and appends its extension (".726") to filenames. Also,...
What is Ioqa Ransomware ?
Ioqa is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Bpsm Ransomware ?
Bpsm is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Aleta Ransomware ?
SecneurX Analysts found Aleta Ransomware in the wild and analyzed the sample. Aleta ransomware encrypts files and appends its extension...
What is Encrypt Ransomware ?
SecneurX Analysts found the Encrypt Ransomware in the wild and analysed the sample. This ransomware exhibits several similarities and...
What is Worlddecoding Ransomware?
Secneurx Analysts found the Worlddecoding ransomware in the wild and analyzed the sample. This ransomware exhibits several similarities...
What is Zoqw Ransomware ?
Zoqw is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Andrianov Ransomware ?
SecneurX Analysts found the Andrianov Ransomware in the wild and analysed the sample. This ransomware exhibits several similarities and...
What is Znsm Ransomware ?
Znsm is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Fox Ransomware ?
Fox is a ransomware that belongs to the Matrix Ransomware family. Secneurx Analysts found Fox ransomware in the wild and analysed the...
What is WannaRun 2.0 Ransomware ?
Secneurx Analysts found WannaRun 2.0 Ransomware in the wild and analysed the sample. WannaRun Version 2.0 ransomware encrypts files and...
What is Isza Ransomware ?
Isza is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Isal Ransomware ?
Isal is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Qilin Ransomware ?
Secneurx Analysts found Qilin ransomware in the wild and analsyed the sample. Qilin ransomware encrypts files after executing with a...
Conti Ransomware Continues Its Spread With A New Variant "PUTIN"
The Conti ransomware group has become one of the most notorious cybercrime collectives in the world, known for its aggressive tactics and...
What is Lucknite Ransomware ?
Secneurx Analyst found Lucknite ransomware in the wild and analyzed the sample. Lucknight ransomware encrypts files and appends its...
What is Btnw Ransomware ?
Btnw is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is ScareCrow Ransomware ?
ScareCrow ransomware is now emerging as a new ransomware family attack against Windows systems. ScareCrow attacks are relatively...
What is Manw Ransomware ?
Manw is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Mppn Ransomware
Mppn is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Juli Ransomware ?
What is Juli Ransomware ? VoidCrypt ransomware shows to be a strange hybrid of corporate-aimed ransomware and one targeted at individuals...
New Chaos Ransomware Builder Variant "Puspa2" Discovered in the Wild
Chaos is a customizable ransomware builder that emerged in underground forums, by falsely marketing itself as the .NET version of Ryuk...
What is Uyro Ransomware ?
Uyro is a ransomware that belongs to the Djvu/Stop Ransomware family. Analysts at SecneurX observed that among the prominent ransomware...
What is Kcvp Ransomware ?
Kcvp is a ransomware that belongs to the Stop/Djvu Ransomware family. Analysts at SecneurX found that Kcvp encrypts files and appends its...
What is Ramp Ransomware?
The ramp is ransomware that belongs to the Killnet Ransomware family. SecneurX Malware Analyst found that Ramp encrypts files and appends...
SecneurX Mobile Malware Advisory August 2022
Android users are constantly subjected to frauds by apps that they installed from Google Play Store. At SecneurX we have been monitoring...
HiddenAds malware discovered in Android apps that are distributed on Google Play Store
SecneurX Analysis Mobile research team have discovered more mobile Apps that are distributed on the Google Play store infecting Android...
Agent Tesla: The RAT Spyware and Infostealer
Agent Tesla is a Malware-as-a-Service Trojan that steals user information and exfiltrates it to the threat actors Non-Technical Summary...
Raccoon Stealer: The ‘Malware-as-a-Service’ (MaaS) Information Stealer’s Current Surge
Raccoon Stealer is an information stealer that, as its name suggests, steals user credentials and data stored in web browsers, mail...
Amphitryon : The Spam Blog (Splog) Supportive Malware
Amphitryon gains entry through a macro and redirects affected users to spam blog sites that are solely created to increase advertisement...
SecneurX’s message for Cyber Security Awareness Month - October 2021: Stay Vigilant, Stay Safe.
Cyber Security is a major concern in today's way of life where everyone and everything is connected to the internet. The same devices...
Behaviour Analysis of Ransomware Wana Decryptor
Wana Decryptor encrypts data on computers, rendering it inaccessible without a unique decryption key. A ransom is demanded for the...
New Remcos RAT - the Remote Access Trojan
The Remote Access Trojan Remcos has features to evade detection. Remcos RAT is a malware that affects systems with Windows OS and gives...
New version of Neurevt malware identified
The trojan malware Neurevt is back in a new version as an infostealer with spyware and backdoor capabilities About the threat: The...
Analysis of Android Malware Joker's new communication techniques
The Joker malware is back in the Google PlayStore and this time with a different communication technique than the usual one. This new...
Behavioural Analysis of a sophisticated malware - BIOPASS RAT.
SecneurX has been observing a RAT (Remote Access Trojan) behaviour which is targeting users of Windows systems through the watering hole...
Mosaic Loader - Behaviour Analysis
Mosaic loader (as named recently) refers to a malware delivery platform that infects Windows PCs. SecneurX has been tracking malicious...
Malicious Android Apps are stealing your Facebook Username and Password (Facestealer)
SecneurX malware analysts have discovered malicious apps on Google Play store that steals Facebook username and password. SecneurX’s...