News and Analysis

WithSecure researchers found overlapping tools and malware, such as DarkGate, Ducktail, Redline, and Lobshot, being used in cyberattacks, making it difficult to attribute operations to specific groups. Analysts consider it likely that one actor is behind multiple campaigns. The attackers use social engineering to trick digital marketing professionals into downloading malware disguised as job listings, and make no attempt to hide their operations. Among their tactics, fake job openings at Corsair in the UK and at Groww in India have been used.