Threat Source newsletter for May 21, 2020
Summary: Cisco Talos reports that a modified version of the DenDroid Android malware, which it calls WolfRAT, is targeting Android users in Thailand through messaging apps including WhatsApp, Facebook Messenger and Line, and assesses with high confidence that the Wolf Research actor operates it. A joint analysis from two security firms also found actors in Asia using the Gh0st RAT backdoor for espionage against a government agency, a telecommunications company and a gas company, with the RAT able to take screenshots, run console commands and exfiltrate data to a command and control server.
Key Takeaway: Two separate campaigns in this newsletter show RATs doing the quiet work - one stealing data from a government agency, a telecom and a gas company, the other spreading through the messaging apps your employees already have open on their phones.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026