Threat Spotlight: Upatre - Say No to Drones, Say Yes to Malware
Summary: Cisco Talos tracked at least fifteen Upatre spam campaigns active between one and two days, each with a different sender address, subject and attachment, delivering a zip or rar file containing an executable disguised with a PDF icon. A new variant seen on April 13, 2015 switched IP lookup from checkip.dyndns.org to icanhazip.com, adopted a standard Firefox User-Agent, and moved all command-and-control traffic into SSL, leaving under 1% of transferred data unencrypted.
Key Takeaway: Upatre's loader has been pulling the Dyre banking trojan onto endpoints since 2013, and the shift to full SSL means the network traffic that once made it easy to spot now hides the payload delivery and the C2 channel alike.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026