--- title: Morphisec Cybersecurity Blog | Arnold Osipov description: Cybersecurity trends and news, with info about Morphisec, breach prevention, and zero trust endpoint, server, and workload security. --- Recent Webinar: Building an Adaptive Cyber Resilient Cloud ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa) ![close](https://www.morphisec.com/hubfs/close.svg) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) - ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) - [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) # BLOGS By Arnold Osipov Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security ## [Technical Analysis: CVE-2024-38021](https://1534169.hs-sites.com/technical-analysis-cve-2024-38021) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on August 19, 2024 [![CVE-2024-38021](https://www.morphisec.com/hubfs/Outlook%20Moniker_01_1200x628_v.3.0.png) ](https://1534169.hs-sites.com/technical-analysis-cve-2024-38021) Recently, Morphisec researchers discovered a vulnerability in Microsoft Outlook that can lead to remote code execution (RCE). This vulnerability, identified as [CVE-2024-38021](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38021), highlights a significant security flaw within the Microsoft Outlook... [Read More **](https://1534169.hs-sites.com/technical-analysis-cve-2024-38021) ## [Howling at the Inbox: Sticky Werewolf's Latest Malicious Aviation Attacks](https://1534169.hs-sites.com/sticky-werewolfs-aviation-attacks) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on June 6, 2024 [![Werewolf standing in a cyberpunk street as rain comes down](https://www.morphisec.com/hubfs/Morphisec_Werewolf_1200x628_v.1.41-ezgif.com-png-to-webp-converter.webp) ](https://1534169.hs-sites.com/sticky-werewolfs-aviation-attacks) Morphisec Labs has been monitoring increased activity associated with Sticky Werewolf, a group suspected to have geopolitical and/or hacktivist ties. While the group’s geographical origin and home base remain unclear, recent attack techniques... [Read More **](https://1534169.hs-sites.com/sticky-werewolfs-aviation-attacks) ## [Breaking Boundaries: Mispadu's Infiltration Beyond LATAM](https://1534169.hs-sites.com/mispadu-infiltration-beyond-latam) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on March 26, 2024 [![Mispadu's spread from LATAM to Europe](https://www.morphisec.com/hubfs/Morphisec_Mispadu_1200x628_v.1.4%20_lorez.png) ](https://1534169.hs-sites.com/mispadu-infiltration-beyond-latam) Recently, Morphisec Labs identified a significant increase in activity linked to Mispadu (also known as URSA), a banking trojan first flagged by ESET in 2019. Initially concentrated on LATAM countries and Spanish-speaking individuals, Mispadu has... [Read More **](https://1534169.hs-sites.com/mispadu-infiltration-beyond-latam) ## [Chae$ Chronicles: Version 4.1 Dedicated to Morphisec Researchers](https://1534169.hs-sites.com/chaes-chronicles) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on January 18, 2024 [![Chaes Chronicles](https://www.morphisec.com/hubfs/Chae$%20hacking%20banners%20-%201200x628%20%28Blog%20image%29.jpg) ](https://1534169.hs-sites.com/chaes-chronicles) In ongoing efforts to monitor and analyze emerging cyber threats, Morphisec Threat Labs has recently turned its focus to Chae$ 4.1, an update to the Chaes malware Infostealer series. This version introduces key updates, including an improved Chronod... [Read More **](https://1534169.hs-sites.com/chaes-chronicles) ## [GuLoader Campaign Targets Law Firms in the US](https://1534169.hs-sites.com/guloader-campaign-targets-law-firms-in-the-us) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on June 29, 2023 [![Morphisec - GuLoader Campaign Infection Chain](https://www.morphisec.com/hubfs/Morphisec-GuLoaderInfectionChain.png) ](https://1534169.hs-sites.com/guloader-campaign-targets-law-firms-in-the-us) Since April, Morphisec Labs has been closely monitoring an active [GuLoader](https://attack.mitre.org/software/S0561/) campaign that primarily focuses on law firms, along with healthcare and investment firms, specifically within the United States. GuLoader, also known as Cloudeye, has been... [Read More **](https://1534169.hs-sites.com/guloader-campaign-targets-law-firms-in-the-us) ## [How SYS01 Stealer Will Get Your Sensitive Facebook Info](https://1534169.hs-sites.com/sys01stealer-facebook-info-stealer) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on March 7, 2023 [![](https://www.morphisec.com/hubfs/Screenshot%202023-03-07%20193418.png) ](https://1534169.hs-sites.com/sys01stealer-facebook-info-stealer) Starting in November 2022, Morphisec has been tracking an advanced info stealer we have named “SYS01 stealer.” SYS01 stealer uses similar lures and loading techniques to another information stealer recently dubbed S1deload by the Bitdefender group,... [Read More **](https://1534169.hs-sites.com/sys01stealer-facebook-info-stealer) ## [Exclusive Threat Research: Mars (Stealer) Attacks!](https://1534169.hs-sites.com/threat-research-mars-stealer) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on March 29, 2022 [![Exclusive Threat Research: Mars Stealer Attacks!](https://blog.morphisec.com/hubfs/Mars%20%28Stealer%29%20Attacks%20-%20Morphisec%20Labs.png) ](https://1534169.hs-sites.com/threat-research-mars-stealer) The Morphisec Labs team has conducted research on the new Mars infostealer. Mars is based on the older [Oski Stealer](https://www.cyberark.com/resources/threat-research-blog/meet-oski-stealer-an-in-depth-analysis-of-the-popular-credential-stealer) and was first discovered in June 2021. The new Mars is available for sale on several underground forums and is reported to be under... [Read More **](https://1534169.hs-sites.com/threat-research-mars-stealer) ## [Explosive New MirrorBlast Campaign Targets Financial Companies](https://1534169.hs-sites.com/explosive-new-mirrorblast-campaign-targets-financial-companies) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on October 14, 2021 [![Explosive Mirrorblast Campaign](https://blog.morphisec.com/hubfs/MirrorBlast%20Threat%20Blog.png) ](https://1534169.hs-sites.com/explosive-new-mirrorblast-campaign-targets-financial-companies) ## Overview - Morphisec Labs tracked a new *MirrorBlast campaign* targeting financial services organizations  - MirrorBlast is delivered via a phishing email that contains malicious links which download a weaponized Excel document - MirrorBlast has low... [Read More **](https://1534169.hs-sites.com/explosive-new-mirrorblast-campaign-targets-financial-companies) ## [AHK RAT Loader Used in Unique Delivery Campaigns](https://1534169.hs-sites.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on May 14, 2021 [![AHK RAT Loader](https://www.morphisec.com/hubfs/AHK%20RAT%20loader.jpg) ](https://1534169.hs-sites.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns) The Morphisec Labs team has been tracking an ongoing RAT delivery campaign that started in February this year. This campaign is unique in its heavy use of the [AutoHotKey ](https://en.wikipedia.org/wiki/AutoHotkey)scripting language—a fork of the AutoIt language frequently used for testing... [Read More **](https://1534169.hs-sites.com/ahk-rat-loader-leveraged-in-unique-delivery-campaigns) ## [The Evolution of the FIN7 JSSLoader](https://1534169.hs-sites.com/the-evolution-of-the-fin7-jssloader) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on January 4, 2021 [![FIN7 JSSLoader Evolution](https://www.morphisec.com/hubfs/FIN7%20JSSLoader%20post.png) ](https://1534169.hs-sites.com/the-evolution-of-the-fin7-jssloader) *This report has been updated with assistance from the cybersecurity community.* ## Introduction Morphisec Labs has been tracking [FIN7](https://attack.mitre.org/groups/G0046/) (Carbanak Group) activity for the past several years. Morphisec’s ability to collect rich forensic data from memory has... [Read More **](https://1534169.hs-sites.com/the-evolution-of-the-fin7-jssloader) ## [The Introduction of the Jupyter InfoStealer/Backdoor](https://1534169.hs-sites.com/jupyter-infostealer-backdoor-introduction) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on November 12, 2020 [![Jupyter Backdoor](https://www.morphisec.com/hubfs/Jupyter%20Infostealer%20Blog-1.png) ](https://1534169.hs-sites.com/jupyter-infostealer-backdoor-introduction) An** Infostealer** is a trojan that is designed to gather and exfiltrate private and sensitive information from a target system. There is a large variety of info stealers active in the wild, some are independent and some act as a modular part of a... [Read More **](https://1534169.hs-sites.com/jupyter-infostealer-backdoor-introduction) ## [QakBot (QBot) Maldoc Campaign Introduces Two New Techniques into Its Arsenal](https://1534169.hs-sites.com/qakbot-qbot-maldoc-two-new-techniques) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on August 20, 2020 [![QakBot QBot Malware Campaign](https://www.morphisec.com/hubfs/Qakbot-Two-New-Techniques.jpg) ](https://1534169.hs-sites.com/qakbot-qbot-maldoc-two-new-techniques) ## Introduction Morphisec Labs has tracked a massive maldoc campaign delivering the **QakBot/QBot** banking trojan, starting earlier this month. Qakbot leverages advanced techniques to evade detection and hamper manual analysis of the threat. In this post... [Read More **](https://1534169.hs-sites.com/qakbot-qbot-maldoc-two-new-techniques) ## [Obfuscated VBScript Drops Zloader, Ursnif, Qakbot, Dridex](https://1534169.hs-sites.com/obfuscated-vbscript-drops-zloader-ursnif-qakbot-dridex) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on June 24, 2020 [![VBScript campaign drops Zloader, Ursnif, Qakbot, Dridex](https://www.morphisec.com/hubfs/FEATURED-Obfuscated%20VBScript-Analysis.jpg) ](https://1534169.hs-sites.com/obfuscated-vbscript-drops-zloader-ursnif-qakbot-dridex) The Morphisec Labs team has tracked an **obfuscated VBScript** package in campaigns since March 2020. Initially, the malware campaign was focused on targets within Germany, but has since moved on to additional targets--excluding any IP address within... [Read More **](https://1534169.hs-sites.com/obfuscated-vbscript-drops-zloader-ursnif-qakbot-dridex) ## [Ursnif/Gozi Delivery - Excel Macro 4.0 Utilization Uptick & OCR Bypass](https://1534169.hs-sites.com/ursnif/gozi-delivery-excel-macro-4.0-utilization-uptick-ocr-bypass) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on June 2, 2020 [![Ursnif Gozi Technical Analysis](https://www.morphisec.com/hubfs/FEATURED-Ursnif-2020-06-01.jpg) ](https://1534169.hs-sites.com/ursnif/gozi-delivery-excel-macro-4.0-utilization-uptick-ocr-bypass) ## Ursnif/Gozi Introduction: Morphisec has been tracking an uptick in the delivery of **Ursnif****/****Gozi** during the COVID-19 pandemic. Specifically, we have noticed a significant spike both in numbers and sophistication. The latest delivery methods will many... [Read More **](https://1534169.hs-sites.com/ursnif/gozi-delivery-excel-macro-4.0-utilization-uptick-ocr-bypass) ## [GuLoader: The RAT Downloader](https://1534169.hs-sites.com/guloader-the-rat-downloader) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on April 2, 2020 [![](https://www.morphisec.com/hubfs/FEATURED-GuLoader-Analysis.jpg) ](https://1534169.hs-sites.com/guloader-the-rat-downloader) Guloader is a downloader that has been widely used from December 2019. Several security researchers have identified the downloader in the wild, signifying that it has quickly gained popularity among threat actors. When it first appeared, GuLoader... [Read More **](https://1534169.hs-sites.com/guloader-the-rat-downloader) ## [Parallax: The New RAT on the Block](https://1534169.hs-sites.com/parallax-rat-active-status) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on March 18, 2020 [![Parallax Rat](https://www.morphisec.com/hubfs/FEATURED-Parallax%20Rat.jpg) ](https://1534169.hs-sites.com/parallax-rat-active-status) Following the [increase](https://www.bleepingcomputer.com/news/security/parallax-rat-common-malware-payload-after-hacker-forums-promotion/) in **Parallax RAT** campaigns -- *the new RAT on the block*, Morphisec Labs decided to release more technical details on some of the latest campaigns that the [Morphisec Preemptive Cyber Defense Platform](https://www.morphisec.com/products/) intercepted and prevented on... [Read More **](https://1534169.hs-sites.com/parallax-rat-active-status) ## [Trickbot Trojan Leveraging a New Windows 10 UAC Bypass](https://1534169.hs-sites.com/trickbot-uses-a-new-windows-10-uac-bypass) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on January 30, 2020 [![Trickbot Trojan UAC Bypass](https://www.morphisec.com/hubfs/FEATURED-Trickbot%20WSReset%20UAC%20Bypass.jpg) ](https://1534169.hs-sites.com/trickbot-uses-a-new-windows-10-uac-bypass) The **Trickbot trojan** is one of the most advanced malware delivery vehicles currently in use. Attackers have leveraged it to deliver a wide variety of malicious code, in many different methods. Just yesterday, [Bleeping Computer](https://www.bleepingcomputer.com/news/security/malware-tries-to-trump-security-software-with-potus-impeachment/) reported that news... [Read More **](https://1534169.hs-sites.com/trickbot-uses-a-new-windows-10-uac-bypass) ## [Trickbot Trojan Returns in a New eCommerce Shopping Campaign](https://1534169.hs-sites.com/trickbot-returns-in-a-new-ecommerce-shopping-campaign) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on December 19, 2019 [![Trickbot eCommerce 2019-12-19](https://www.morphisec.com/hubfs/Trickbot%20eCommerce%202019-12-19.jpg) ](https://1534169.hs-sites.com/trickbot-returns-in-a-new-ecommerce-shopping-campaign) A whopping 186.4 million Americans shopped in stores and online between Black Friday and Cyber Monday this year, according to the National Retail Federation. On average, these shoppers spent $361.90 per person over the five-day Thanksgiving weekend. [Read More **](https://1534169.hs-sites.com/trickbot-returns-in-a-new-ecommerce-shopping-campaign) ## [Threat Alert: GermanWiper](https://1534169.hs-sites.com/threat-alert-germanwiper) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on August 6, 2019 [![germanwiper-header](https://www.morphisec.com/hubfs/Blog_images/1-Q3-2019/germanwiper/germanwiper-header.png) ](https://1534169.hs-sites.com/threat-alert-germanwiper) Last week, a new strain of ransomware hit dozens of targets across Germany. The categorization as ransomware is really a misnomer as, while the attackers do demand a ransom, by that time the victim’s data has already been irreversibly wiped, even if... [Read More **](https://1534169.hs-sites.com/threat-alert-germanwiper) ## [BitPaymer Ransomware Leveraging New Custom Packer Framework](https://1534169.hs-sites.com/bitpaymer-ransomware-with-new-custom-packer-framework) Posted by [Arnold Osipov](https://1534169.hs-sites.com/author/arnold-osipov) on July 18, 2019 [![BitPaymer Ransomware](https://www.morphisec.com/hubfs/Blog_images/1-Q3-2019/blogpost-image-bitpaymer.png) ](https://1534169.hs-sites.com/bitpaymer-ransomware-with-new-custom-packer-framework) Morphisec Labs recently investigated an ongoing **BitPaymer ransomware** campaign that has been attacking companies across the U.S., both public and private, over the last 3 months. [Read More **](https://1534169.hs-sites.com/bitpaymer-ransomware-with-new-custom-packer-framework) [ All posts ](https://1534169.hs-sites.com/all) [ Next ](https://1534169.hs-sites.com/author/arnold-osipov/page/2) ### Subscribe to our blog Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates. [![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4) ### Search Our Site ### Recent Posts ### Posts by Tag - [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense) - [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research) - [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news) - [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs) - [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news) - [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management) - [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth) - [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware) - [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security) - [Gartner (10)](https://1534169.hs-sites.com/topic/gartner) - [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem) - [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft) - [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks) - [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity) - [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense) - [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity) - [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security) - [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence) - [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity) - [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware) - [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management) - [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers) [See all](https://1534169.hs-sites.com/author/arnold-osipov#) - [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec) - [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec) - [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw) © 2026 Morphisec Ltd. | All rights reserved ![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)