#emmenhtal — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #emmenhtal, aggregated by home.social.
-
Охота на Emmenhtal: как мы восстановили полную kill chain банковского трояна с переформатированного диска
Разбираем реальный IR-кейс: ClickFix → Emmenhtal Loader → банковский троян с Telegram C2. Форензик переформатированного диска на 930 ГБ, VDM-дисамбигуация ложноположительных и восстановление артефактов из hibernation-файла.
https://habr.com/ru/articles/1021698/
#DFIR #форензика #malware_analysis #банковский_троян #Emmenhtal #ClickFix #threat_hunting #YARA #fileless_malware #incident_response
-
Охота на Emmenhtal: как мы восстановили полную kill chain банковского трояна с переформатированного диска
Разбираем реальный IR-кейс: ClickFix → Emmenhtal Loader → банковский троян с Telegram C2. Форензик переформатированного диска на 930 ГБ, VDM-дисамбигуация ложноположительных и восстановление артефактов из hibernation-файла.
https://habr.com/ru/articles/1021698/
#DFIR #форензика #malware_analysis #банковский_троян #Emmenhtal #ClickFix #threat_hunting #YARA #fileless_malware #incident_response
-
Охота на Emmenhtal: как мы восстановили полную kill chain банковского трояна с переформатированного диска
Разбираем реальный IR-кейс: ClickFix → Emmenhtal Loader → банковский троян с Telegram C2. Форензик переформатированного диска на 930 ГБ, VDM-дисамбигуация ложноположительных и восстановление артефактов из hibernation-файла.
https://habr.com/ru/articles/1021698/
#DFIR #форензика #malware_analysis #банковский_троян #Emmenhtal #ClickFix #threat_hunting #YARA #fileless_malware #incident_response
-
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine – Source:hackread.com https://ciso2ciso.com/github-abused-to-spread-amadey-lumma-and-redline-infostealers-in-ukraine-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #CyberAttacks #CyberAttack #SmokeLoader #Emmenhtal #AsyncRAT #Hackread #security #malware #Redline #Ukraine #Amadey #GitHub #Python #Lumma
-
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine – Source:hackread.com https://ciso2ciso.com/github-abused-to-spread-amadey-lumma-and-redline-infostealers-in-ukraine-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #CyberAttacks #CyberAttack #SmokeLoader #Emmenhtal #AsyncRAT #Hackread #security #malware #Redline #Ukraine #Amadey #GitHub #Python #Lumma
-
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine – Source:hackread.com https://ciso2ciso.com/github-abused-to-spread-amadey-lumma-and-redline-infostealers-in-ukraine-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #CyberAttacks #CyberAttack #SmokeLoader #Emmenhtal #AsyncRAT #Hackread #security #malware #Redline #Ukraine #Amadey #GitHub #Python #Lumma
-
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine – Source:hackread.com https://ciso2ciso.com/github-abused-to-spread-amadey-lumma-and-redline-infostealers-in-ukraine-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #CyberAttacks #CyberAttack #SmokeLoader #Emmenhtal #AsyncRAT #Hackread #security #malware #Redline #Ukraine #Amadey #GitHub #Python #Lumma
-
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine https://hackread.com/github-abused-amadey-lumma-redline-infostealers-ukraine/ #Cybersecurity #CyberAttacks #CyberAttack #SmokeLoader #Emmenhtal #Security #AsyncRAT #Malware #Redline #Ukraine #Amadey #GitHub #Python #Lumma
-
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine https://hackread.com/github-abused-amadey-lumma-redline-infostealers-ukraine/ #Cybersecurity #CyberAttacks #CyberAttack #SmokeLoader #Emmenhtal #Security #AsyncRAT #Malware #Redline #Ukraine #Amadey #GitHub #Python #Lumma
-
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine https://hackread.com/github-abused-amadey-lumma-redline-infostealers-ukraine/ #Cybersecurity #CyberAttacks #CyberAttack #SmokeLoader #Emmenhtal #Security #AsyncRAT #Malware #Redline #Ukraine #Amadey #GitHub #Python #Lumma
-
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine https://hackread.com/github-abused-amadey-lumma-redline-infostealers-ukraine/ #Cybersecurity #CyberAttacks #CyberAttack #SmokeLoader #Emmenhtal #Security #AsyncRAT #Malware #Redline #Ukraine #Amadey #GitHub #Python #Lumma
-
Good day everyone!
Cisco Talos researchers report on a malware-as-a-service (MaaS) operation that was targeting Ukrainian entities and involved the #Amadey trojan, known for "collecting system information and downloading secondary payloads" and the #Emmenhtal downloader.
Behaviors that are observed in this attack include a BUNCH of powershell activity with obfuscation and dropping a legitimate copy of PuTTY.exe. Looking at the technical details, they also us some URLs that may look legitimate to their targets in Ukraine as they add the value "ukraine2" in the URL. Finally, the attack involved multiple variants of the Emmenhtal downloader that were masquerading as MP4 files.
As usual, I glossed over many of the technical details so you can go enjoy the article without me spoiling it! Thanks to the researchers and authors and Happy Hunting!
MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities
https://lnkd.in/gUisprruIntel 471 Cyborg Security, Now Part of Intel 471#ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
-
Good day everyone!
Cisco Talos researchers report on a malware-as-a-service (MaaS) operation that was targeting Ukrainian entities and involved the #Amadey trojan, known for "collecting system information and downloading secondary payloads" and the #Emmenhtal downloader.
Behaviors that are observed in this attack include a BUNCH of powershell activity with obfuscation and dropping a legitimate copy of PuTTY.exe. Looking at the technical details, they also us some URLs that may look legitimate to their targets in Ukraine as they add the value "ukraine2" in the URL. Finally, the attack involved multiple variants of the Emmenhtal downloader that were masquerading as MP4 files.
As usual, I glossed over many of the technical details so you can go enjoy the article without me spoiling it! Thanks to the researchers and authors and Happy Hunting!
MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities
https://lnkd.in/gUisprruIntel 471 Cyborg Security, Now Part of Intel 471#ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
-
Good day everyone!
Cisco Talos researchers report on a malware-as-a-service (MaaS) operation that was targeting Ukrainian entities and involved the #Amadey trojan, known for "collecting system information and downloading secondary payloads" and the #Emmenhtal downloader.
Behaviors that are observed in this attack include a BUNCH of powershell activity with obfuscation and dropping a legitimate copy of PuTTY.exe. Looking at the technical details, they also us some URLs that may look legitimate to their targets in Ukraine as they add the value "ukraine2" in the URL. Finally, the attack involved multiple variants of the Emmenhtal downloader that were masquerading as MP4 files.
As usual, I glossed over many of the technical details so you can go enjoy the article without me spoiling it! Thanks to the researchers and authors and Happy Hunting!
MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities
https://lnkd.in/gUisprruIntel 471 Cyborg Security, Now Part of Intel 471#ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
-
Good day everyone!
Cisco Talos researchers report on a malware-as-a-service (MaaS) operation that was targeting Ukrainian entities and involved the #Amadey trojan, known for "collecting system information and downloading secondary payloads" and the #Emmenhtal downloader.
Behaviors that are observed in this attack include a BUNCH of powershell activity with obfuscation and dropping a legitimate copy of PuTTY.exe. Looking at the technical details, they also us some URLs that may look legitimate to their targets in Ukraine as they add the value "ukraine2" in the URL. Finally, the attack involved multiple variants of the Emmenhtal downloader that were masquerading as MP4 files.
As usual, I glossed over many of the technical details so you can go enjoy the article without me spoiling it! Thanks to the researchers and authors and Happy Hunting!
MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities
https://lnkd.in/gUisprruIntel 471 Cyborg Security, Now Part of Intel 471#ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
-
Good day everyone!
Cisco Talos researchers report on a malware-as-a-service (MaaS) operation that was targeting Ukrainian entities and involved the #Amadey trojan, known for "collecting system information and downloading secondary payloads" and the #Emmenhtal downloader.
Behaviors that are observed in this attack include a BUNCH of powershell activity with obfuscation and dropping a legitimate copy of PuTTY.exe. Looking at the technical details, they also us some URLs that may look legitimate to their targets in Ukraine as they add the value "ukraine2" in the URL. Finally, the attack involved multiple variants of the Emmenhtal downloader that were masquerading as MP4 files.
As usual, I glossed over many of the technical details so you can go enjoy the article without me spoiling it! Thanks to the researchers and authors and Happy Hunting!
MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities
https://lnkd.in/gUisprruIntel 471 Cyborg Security, Now Part of Intel 471#ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
-
In early 2025, the ClearFake framework widely spread #Emmenhtal Loader as the initial stage, aiming to download #Lumma or #Rhadamanthys, or PowerShell scripts installing #Vidar.
We identified thousands of sites compromised with ClearFake distributing these malware.
-
In early 2025, the ClearFake framework widely spread #Emmenhtal Loader as the initial stage, aiming to download #Lumma or #Rhadamanthys, or PowerShell scripts installing #Vidar.
We identified thousands of sites compromised with ClearFake distributing these malware.
-
In early 2025, the ClearFake framework widely spread #Emmenhtal Loader as the initial stage, aiming to download #Lumma or #Rhadamanthys, or PowerShell scripts installing #Vidar.
We identified thousands of sites compromised with ClearFake distributing these malware.
-
In early 2025, the ClearFake framework widely spread #Emmenhtal Loader as the initial stage, aiming to download #Lumma or #Rhadamanthys, or PowerShell scripts installing #Vidar.
We identified thousands of sites compromised with ClearFake distributing these malware.
-
In this post I take a deep dive into a fake CAPTCHA on a compromised website, and the multistage fileless loader that delivered the Lumma Stealer malware if visitors followed its instructions.
#Google #reCAPTCHA #WordPress #PowerShell #Malware #Emmenhtal #Infostealer #LummaStealer
https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
-
In this post I take a deep dive into a fake CAPTCHA on a compromised website, and the multistage fileless loader that delivered the Lumma Stealer malware if visitors followed its instructions.
#Google #reCAPTCHA #WordPress #PowerShell #Malware #Emmenhtal #Infostealer #LummaStealer
https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
-
In this post I take a deep dive into a fake CAPTCHA on a compromised website, and the multistage fileless loader that delivered the Lumma Stealer malware if visitors followed its instructions.
#Google #reCAPTCHA #WordPress #PowerShell #Malware #Emmenhtal #Infostealer #LummaStealer
https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
-
In this post I take a deep dive into a fake CAPTCHA on a compromised website, and the multistage fileless loader that delivered the Lumma Stealer malware if visitors followed its instructions.
#Google #reCAPTCHA #WordPress #PowerShell #Malware #Emmenhtal #Infostealer #LummaStealer
https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
-
In this post I take a deep dive into a fake CAPTCHA on a compromised website, and the multistage fileless loader that delivered the Lumma Stealer malware if visitors followed its instructions.
#Google #reCAPTCHA #WordPress #PowerShell #Malware #Emmenhtal #Infostealer #LummaStealer
https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
-
Not to flex, but my team released a report on a loader a few days before Mandiant released their own! :p
Both articles for reference!
https://www.orangecyberdefense.com/global/blog/cert-news/emmenhtal-a-little-known-loader-distributing-commodity-infostealers-worldwide
https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/?hl=en -
Not to flex, but my team released a report on a loader a few days before Mandiant released their own! :p
Both articles for reference!
https://www.orangecyberdefense.com/global/blog/cert-news/emmenhtal-a-little-known-loader-distributing-commodity-infostealers-worldwide
https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/?hl=en -
Not to flex, but my team released a report on a loader a few days before Mandiant released their own! :p
Both articles for reference!
https://www.orangecyberdefense.com/global/blog/cert-news/emmenhtal-a-little-known-loader-distributing-commodity-infostealers-worldwide
https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/?hl=en -
Not to flex, but my team released a report on a loader a few days before Mandiant released their own! :p
Both articles for reference!
https://www.orangecyberdefense.com/global/blog/cert-news/emmenhtal-a-little-known-loader-distributing-commodity-infostealers-worldwide
https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/?hl=en -
Not to flex, but my team released a report on a loader a few days before Mandiant released their own! :p
Both articles for reference!
https://www.orangecyberdefense.com/global/blog/cert-news/emmenhtal-a-little-known-loader-distributing-commodity-infostealers-worldwide
https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/?hl=en