Malware Round-up For The Week of Feb 27 - Mar 3
Summary: Cisco Talos published its weekly round-up of prevalent threats, covering Cerber ransomware, which encrypts office documents, pictures and music, attempts to exfiltrate browser history, and pings specific IP address ranges over TCP port 6892 when it cannot reach its command-and-control domains. The post also covers a macro downloader delivered through macro-enabled Office documents, and Umbrella, a Windows trojan written in Delphi and packed with UPX that steals credentials submitted through Mozilla Firefox and Google Chrome and stores them in a SQLite database.
What's compelling: Cerber's fallback to pinging hardcoded IP ranges on port 6892 when its domains are blocked means domain-based blocking alone leaves a live channel, and Umbrella's lack of discernible network traffic during runtime means stolen Firefox and Chrome credentials can sit locally without tripping network detection.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026