Threat Source newsletter (Feb. 25, 2021)
Summary: Cisco Talos reported that Gamaredon, an actor active since at least 2013 and long associated with pro-Russian activity, ran four recent campaigns using different initial infection vectors and final payloads, and Talos assesses the group as on par with the most prolific crimeware gangs. Talos also described a Masslogger trojan variant that retrieves and exfiltrates credentials from Microsoft Outlook, Google Chrome and instant messengers through a multi-modular phishing chain.
What's compelling: Talos notes Gamaredon has been exposed in multiple threat intelligence reports without any significant effect on its operations, and that stolen credentials carry resale value on the dark web or fuel further attacks - so a single phished Outlook or Chrome credential can outlive the intrusion that took it.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026