Perfctl is a relatively recent malware that has rapidly demonstrated its ability to infiltrate complex environments, particularly corporate Linux servers. Over the past three to four years, Perfctl has reportedly targeted millions of Linux servers, exploiting nearly 20,000 vulnerable configurations, such as exposed credentials or poorly secured management interfaces. Far more than a simple malicious script, Perfctl stands out due to its modular architecture and advanced evasion techniques, making its detection and neutralization particularly challenging. Chronological Overview and Victimology of Perfctl Perfctl was first detected [...]

The Evil Twin attack is a form of Man-in-the-Middle (MitM) attack targeting public Wi-Fi networks. Its name comes from the fact that an attacker sets up a rogue Wi-Fi access point mimicking a legitimate network to deceive users. Once connected, sensitive data such as credentials, passwords, or banking information are intercepted. According to studies, more than 15% of attacks on public Wi-Fi networks involve this method, and nearly 70% of users connect without verifying the network's authenticity. Particularly widespread in cafes, hotels, airports, and [...]

Agent Tesla stands out as an advanced Remote Access Trojan (RAT), frequently deployed for malicious purposes. Operating as both a keylogger and an information stealer, this malware can monitor user activities, exfiltrate sensitive data, and severely compromise victim security. With an estimated global impact of 3%, understanding its operation, features, and use cases is essential to mount an effective defense. How the Malware Works: A Well-Oiled Machine. Agent Tesla follows a methodical process to infect, establish persistence, collect, and exfiltrate data. Here is a detailed breakdown of [...]

In current cyber news, one name is sparking both curiosity and concern: Steelfox. This malware, with an enigmatic name evoking the strength of steel and the cunning of a fox, perfectly reflects its nature: stealthy, resilient, and remarkably effective. But where does this malicious software originate? Its origins raise as many questions as theories. To fully grasp this threat and anticipate its next moves, our cybersecurity experts break it down. Chronological Overview of the Malware. First spotted in 2023, SteelFox has shown rapid propagation and continuous development: February 2023: Initial identification. [...]

Zergeca is a type of malware discovered in 2024. It is a network of compromised machines (botnet) engineered to execute Distributed Denial of Service (DDoS) attacks, while also featuring capabilities far broader than conventional botnets. Developed in Golang—an open-source language created by Google—Zergeca shares traits reminiscent of the Mirai botnet, notably the reuse of command and control (C2) infrastructure, suggesting a common author or potential connections between threat actors. Its name, derived from "ootheca" (an insect egg capsule) discovered within its servers [...]