minute read
Authors
A new Bofra variant has been reported. We already detect it generically as “I-Worm.Bofra.gen”. The new variant has a distribution node located at the following URL:
http://kjh0.narod.ru/
Just like we did with previous Bofra variants, we are talking to narod.ru adminstrators to take the site offline ASAP.
Authors
From the same authors
In the same category
According to Kaspersky, Librarian Ghouls APT continues its series of attacks on Russian entities. A detailed analysis of a malicious campaign utilizing RAR archives and BAT scripts.
Kaspersky GReAT experts uncovered a new campaign by Lazarus APT that exploits vulnerabilities in South Korean software products and uses a watering hole approach.
MysterySnail RAT attributed to IronHusky APT group hasn’t been reported since 2021. Recently, Kaspersky GReAT detected new versions of this implant in government organizations in Mongolia and Russia.
Kaspersky researchers analyze GOFFEE’s campaign in H2 2024: the updated infection scheme, new PowerModul implant, switch to a binary Mythic agent.
Yet another Bofra variant