PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Inside Astaroth's New Spambot Component

crowdstrike.com | research | #featured | #threat-intelligence | #malware | #astaroth | #whatsapp | #crowdstrike | #latam | #spambot
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Learn about the new Astaroth spambot component, how it overlaps with other spambots, and its role in the LATAM eCrime ecosystem.

Why it matters

The analysis documents a new WhatsApp-based propagation component with behavioral details, a YARA rule, a Falcon LogScale query and indicators defenders can operationalize against Astaroth activity.
Published
Collected

Related coverage

blog · crowdstrike.com
CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies
The CrowdStrike 2026 Legal Threat Landscape Report analyzes the key themes, trends, and events shaping the legal sector threat landscape.
blog · netspi.com
Why Do People Confuse “End-to-End Encryption” with “Security”?
Explains why end-to-end encryption in apps like WhatsApp isn't overall security: encrypted channels still deliver phishing links and malware, and endpoint and application risks remain fully in play.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · aikido.dev
Novel supplychain.local Go worm appears
On 23 September 2026, a threat actor published a novel supply chain worm to the following packages:
research · hunt.io
Ukraine’s State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell
An exposed open directory revealed a solo operator's full Log4Shell chain against a Graylog host holding Trembita logs, with the access log that proves execution.
Back