Golo Mühr

Golo Mühr

X-Force Threat Intelligence, IBM

Golo Mühr is an enthusiastic malware reverse-engineer with interests in IoT, ethical hacking and threat intelligence. His research covers various malware with a focus on botnet malware and crypters. Golo specializes in threat intelligence, malware detection and C2 communication analysis.

Email campaigns leverage updated DBatLoader to deliver RATs, stealers

11 min read - IBM X-Force has identified new capabilities in DBatLoader malware samples delivered in recent email campaigns, signaling a heightened risk of infection from commodity malware families associated with DBatLoader activity. Explore the analysis.

Threat Intelligence September 7, 2023

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

8 min read - IBM X-Force uncovered a new phishing campaign likely conducted by Hive0117 delivering the fileless malware DarkWatchman, directed at individuals associated with major energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. DarkWatchman malware is capable…

BlotchyQuasar: X-Force Hive0129 targeting financial institutions in LATAM with a custom banking trojan

16 min read - In late April through May 2023, IBM Security X-Force found several phishing emails leading to packed executable files delivering malware we have named BlotchyQuasar, likely developed by a group X-Force tracks as Hive0129. BlotchyQuasar is hardcoded to collect credentials from…

ITG23 crypters highlight cooperation between cyber criminal groups

25 min read - IBM Security X-Force researchers have continually analyzed the use of several crypters developed by the cybercriminal group ITG23, also known as Wizard Spider, DEV-0193, or simply the “Trickbot Group”. The results of this research, along with evidence gained from the…

A Fly on ShellBot’s Wall: The Risk of Publicly Available Cryptocurrency Miners

8 min read - IBM Security X-Force researchers studied the botnet activity of a malware variant that is used by cyber crime groups to illegally mine cryptocurrency. Examining two ShellBot botnets that appeared in attacks honeypots caught, the X-Force team was able to infect…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

Email campaigns leverage updated DBatLoader to deliver RATs, stealers

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

BlotchyQuasar: X-Force Hive0129 targeting financial institutions in LATAM with a custom banking trojan

ITG23 crypters highlight cooperation between cyber criminal groups

A Fly on ShellBot’s Wall: The Risk of Publicly Available Cryptocurrency Miners

{{{title}}}