Threat Source newsletter (Nov. 17, 2022): Hot off the press! The Snort 2023 Calendar is here
Summary: Cisco Talos published a blog detailing new variants of LodaRAT, an AutoIt-written remote access tool and stealer, including one variant that copies itself to all attached removable storage, and observed it deployed alongside RedLine, Neshta and a VenomRAT clone called S500. Australia established a permanent joint standing operation after attacks on Optus and Medibank, with Cybersecurity Minister Clare O'Neil vowing to "hack the hackers," and a researcher earned $70,000 for privately reporting CVE-2022-20465, a Google Pixel lock-screen bypass.
Why it matters: LodaRAT's new removable-storage propagation and pairing with RedLine, Neshta and S500 signal a growth phase that Talos expects to produce more advanced variants, while the Center for Internet Security found 81% of schools have not implemented multi-factor authentication even as education remains a top ransomware target.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2022-20465
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026