#strelastealer — Public Fediverse posts

📬 Detour Dog und die DNS-TXT-Kommunikation – eine neue Dimension der Malware-Verteilung
#Cyberangriffe #ITSicherheit #DetourDog #HelpTDS #PoisonedDNS #StarFish #StrelaStealer #TXTRecordAbfrage #VexTrioViper https://sc.tarnkappe.info/1b20a1

We recently unraveled a mystery involving ~30k infected websites, DNS TXT records, and Strela Stealer #malware distribution. A threat actor who has been around since at least Feb 2020 has evolved to distribute malware through misdirection and a complex relay system, leaving defenders unsure where the actual malware is hosted.
And to top it off, we found that part of the campaigns were sent via REM proxy, another threat actor we track via DNS that leverages compromised MikroTik routers. These campaigns were spam messages targeting #german speakers with malicious .svg files.
The attachments had links pointing to the first stage of the malware -- or did it? It turns out the threat actor, which we track as Detour Dog, is playing mind games. That link actually triggers server-side DNS queries and the fun begins.
Here is the paper: https://blogs.infoblox.com/threat-intelligence/detour-dog-dns-malware-powers-strela-stealer-campaigns/
More nuggets in the replies.

#malware #infostealer #dns #threatintel #cybersecurity #cybercrime #scam #helptds #tds #infosec #infoblox #strelastealer #phishing #spam #remproxy

Detour Dog’s DNS Hijacking Infects 30,000 Websites with Strela Stealer https://hackread.com/detour-dog-dns-hijacking-websites-strela-stealer/ #Cybersecurity #StrelaStealer #CyberAttack #Infostealer #CyberCrime #DetourDog #LosPollos #Security #Malware #DNS

🚨 Your inbox's invisible enemy: Sophisticated "Strela Stealer" malware is targeting European email users through fake invoices, using advanced techniques to steal Outlook and Thunderbird credentials. Learn how this threat operates and what you can do to protect your sensitive information.

#SecurityLand #CyberSecurity #EmailSecurity #Trustwave #StrelaStealer #Malware #Europe

https://www.security.land/new-malware-strela-stealer-targets-outlook-with-advanced-obfuscation-techniques/

2025-02-10 (Monday): Social media post on #StrelaStealer I assisted on for my employer at https://www.linkedin.com/posts/unit42_strelastealer-malspam-webdav-activity-7295144078428491776-vyqY/
and https://x.com/Unit42_Intel/status/1889378454287581678

#pcap, email and malware samples at https://malware-traffic-analysis.net/2025/02/10/index.html

Angriffe auf Deutschland: #Malware meidet Infektion russischer Systeme - Golem.de https://www.golem.de/news/angriffe-auf-deutschland-malware-meidet-infektion-russischer-systeme-2406-186424.html #Strelastealer #Russiy #Russland #Thunderbird #Outlook #Windows

Angriffe auf Deutschland: Malware meidet Infektion russischer Systeme - Golem.de
https://www.golem.de/news/angriffe-auf-deutschland-malware-meidet-infektion-russischer-systeme-2406-186424.html #Cybercrime #Malware #Strelastealer

Resurgent malware targets Outlook and Thunderbird users but bypasses Russia⤵️
#malware #cybersecurity #StrelaStealer #infosec

https://cnews.link/malware-targets-outlook-thunderbird/

Campagne #Malware #Italy Week 25

☠️💣🔥👻
#Formbook: Pagamento
#AgentTesla: Ordine
#DanaBot: AgenziaEntrate
#KoiLoader - #KoiStealer: Resend
#StrelaStealer: Pagamenti
#Neshta: Ordini

#mwitaly

SonicWall observed an updated variant of StrelaStealer targeting European countries. The infostealer focuses on stealing email account credentials from Outlook and Thunderbird. StrelaStealer has been updated with an obfuscation technique and anti-analysis technique. SonicWall provides a technical analysis and IOC. 🔗 https://blog.sonicwall.com/en-us/2024/04/updated-strelastealer-targeting-european-countries/

#threatintel #StrelaStealer #IOC

Mehr als 100 EU- und US-Organisationen angegriffen: #StrelaStealer will an Mails | Security https://www.heise.de/news/StrelaStealer-Malware-will-E-Mail-Zugangsdaten-von-mehr-als-100-Organisationen-9665204.html #Malware

New StrelaStealer Phishing Attacks Hit Over 100 Organizations in E.U. and U.S.
https://thehackernews.com/2024/03/new-strelastealer-phishing-attacks-hit.html #Cybercrime #Malware #StrelaStealer #Phishing

Unit 42 reports on a large-scale StrelaStealer campaigns impacting over 100 organizations across the EU and U.S. The attackers change the initial email attachment from one campaign to the next, and the malware author updates the DLL payload with better obfuscation and anti-analysis tricks. Unit 42 describes 2023 and 2024 campaigns, technical analyses of the stealer, its original and new infection chains, and the packer. IOC provided. 🔗 https://unit42.paloaltonetworks.com/strelastealer-campaign/

#STrelaStealer #infostealer #malware #threatintel #IOC

Episode 139 of #BreakingBadness is now available. This week @tw_pierce, @NotTheLinux and @ColonelPanic discuss a recent Forbes article on #cybersecurity layoffs along with #StrelaStealer - the new info-stealing #malware. Listen here: https://www.domaintools.com/resources/podcasts/139-Somethings-Polyglot-To-Give?utm_source=Social&utm_medium=Mastodon&utm_campaign=Breaking-Badness

📬 StrelaStealer klaut E-Mail-Konten aus Outlook und Thunderbird
#Malware #DLLHijacking #EMailKonten #Infostealer #Outlook #polyglotteDatei #StrelaStealer #Thunderbird https://tarnkappe.info/artikel/malware/strelastealer-klaut-e-mail-konten-aus-outlook-und-thunderbird-259060.html