Threat Source newsletter (Aug. 5, 2021)
Summary: Cisco Talos reported new activity from SolarMarker, a modular .NET-based information stealer and keylogger, in which the previous staging module "d.m" was replaced by a new module called "Mars" and a previously unreported module named "Uranus" was identified. Microsoft also released an advisory with guidance for mitigating NTLM relay attacks carried out with a tool called PetitPotam against servers enabling NTLM authentication and Active Directory Certificate Services, which an adversary could use without any prior authentication.
What you should know: SolarMarker's staging DLL can execute whichever payload module the operators choose, including ones not yet discovered, exposing employees' browser-entered credit card numbers and login credentials that could then be used for lateral movement into databases such as customer or patient medical records.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026