News of a novel remote access trojan named StilachiRAT, which Microsoft has warned employs advanced techniques to sidestep detection and persist within target environments.
In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) we named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data. Analysis of the StilachiRAT’s WWStartupCtrl64.dll module that contains the RAT capabilities revealed the use of various methods to steal information from the target system, such as credentials stored in the browser, digital wallet information, data stored in the clipboard, as well as system information.
Microsoft has not yet attributed StilachiRAT to a specific threat actor or geolocation. Based on Microsoft’s current visibility, the malware does not exhibit widespread distribution at this time. However, due to its stealth capabilities and the rapid changes within the malware ecosystem, we are sharing these findings as part of our ongoing efforts to monitor, analyze, and report on the evolving threat landscape.
Erich Kron, Security Awareness Advocate at KnowBe4, has the following comments:
“People who work or play in the cryptocurrency world are significant targets for bad actors due to the unregulated nature of the funds, the possibility for anonymity, and the fact that once a transaction is complete, unlike with wire transfers or other more traditional methods, there is no way to undo it.”
“As cryptocurrency continues to become more mainstream, attackers will adjust their tactics as they refine their efficiency and speed. Many people just getting started with cryptocurrency are not familiar with its pitfalls, and are sometimes excited to make a profit, so they take foolish risks.”
“For those people dealing with cryptocurrency, it is important that accounts use extremely strong passwords that are unique and impossible to guess. In addition, accounts should be protected by MFA, and the individuals should educate themselves about common cryptocurrency scams and cyberattack methods.”
This is all good advice not just for anyone in the crypto space, but in general. Things like MFA and strong passwords are going to mitigate threat actors like this one from carrying out attacks of any sort. Crypto related or not.
Pennsylvania State Education Association notifies 500K people of data breach VIA a ransomware gang
Posted in Commentary with tags Comparitech on March 19, 2025 by itnerdThe Pennsylvania State Education Association this week confirmed it notified 517,487 people of a July 2024 data breach that compromised the following personal info including SSNs, passwords, routing numbers, credit/debit card numbers, and a lot more.
Ransomware gang Rhysida claimed responsibility for the breach in September 2024 but the PSEA has not yet verified Rhysida’s claim.
In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote:
“Rhysida is thought to have ties to the ransomware group Vice Society and first surfaced in May 2023. Its ransomware can steal data and lock down targeted systems. It then demands a ransom both for deleting stolen data and for a key to restore infected systems. Rhysida has claimed 82 confirmed ransomware attacks since it began, compromising more than 5.3 million records. Its average ransom demand is $1.08 million.”
“Ransomware attacks can both steal data and lock down computer systems. Organizations are then forced to either pay a ransom or face extended downtime, data loss, and putting data subjects at increased risk of fraud.”
“In 2024, Comparitech researchers logged 74 confirmed ransomware attacks on the US education sector, 72 of which were against schools and colleges. These attacks compromised more than 3 million records in total. Rhysida’s attack on the PSEA is the third-largest of the year by number of records affected. The largest such attacks in 2024 were on Texas Tech University Health Sciences Center (1.5 million) and Chicago Public Schools (700,000).”
“In 2025 so far, we are tracking nine confirmed ransomware attacks on US education, plus another 31 unconfirmed claims that haven’t been acknowledged by the targeted organizations.”
This is yet another bad situation where a threat actor is about to cause lots of misery to lots of people for many years to come. That illustrates why we all need to wrap our heads around protecting organizations from threat actors who mean to do harm to us all.
Leave a comment »