Threat Source newsletter for June 25, 2020
Summary: Cisco Talos said it is replacing the terms "blacklist" and "whitelist" with "block list" and "allow list," declining to assign positive connotations to "white" and negative connotations to "black." The same newsletter describes an IndigoDrop campaign using military-themed malicious Office documents with macros to deliver Cobalt Strike beacons with RAT capabilities, apparently targeting military and government organizations in South Asia, and a resurgent Qbot that waits on victim machines until they visit a U.S. bank's website and then steals login credentials.
What you should know: Qbot's reported six-hour cycle for adapting and evading detection means a signature that caught it this morning may not catch it tonight, and it only activates when a user reaches a bank site, so the theft happens inside a session that looks legitimate.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026