Threat Research

In 2023, "ToyMaker," an initial access broker (IAB), was discovered working with double extortion gangs. Believed to be financially motivated, ToyMaker exploits internet-exposed vulnerabilities to deploy a custom backdoor called "LAGTOY" on victim systems, allowing access and credential extraction. LAGTOY enables reverse shells and command execution....

"Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal" refers to the use of BackConnect malware by these ransomware groups, as part of their evolving tactics. Attackers exploited social engineering, Microsoft Teams, Quick Assist, and tools like OneDriveStandaloneUpdater.exe to gain initial access and escalate privileges....