Malicious Campaign Targets Latin America: The seller, The operator and a curious link
Summary: Cisco Talos observed new campaigns targeting Latin American countries that use macro-enabled Office documents to start a modular chain of PowerShell and VB scripts, disabling protections such as AMSI before delivering njRAT or AsyncRAT. The infection chains were built with a .NET-based crypter called "3losh crypter rat," which its author advertises on Facebook and YouTube, and the same crypter appears in three distinct campaigns: the Latin American ones, Aggah's, and those run by the crypter's authors.
What you should know: Because a shared crypter lets completely disjointed actors generate identical infection chains, defenders can no longer attribute an intrusion by its chain alone - and the Latin American operator's test files, submitted to VirusTotal from Brazil in June and July 2021, show the tooling is being refined against commercial antivirus before use.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026