Elastic Security Labs discovers the LOBSHOT malware
ID: 18c159f2-f748-5c8d-94b0-d4d87bacc630
STIX ID: report--18c159f2-f748-5c8d-94b0-d4d87bacc630
Feed Name: Elastic Security Labs
Threat Score
Elastic Security Labs describes LOBSHOT, a stealthy hVNC-enabled malware distributed via malvertising (fake Google Ads and impersonated installers) that provides hidden remote desktop (hVNC) access, browser/cryptocurrency wallet-stealing functionality, registry-based persistence and C2 beaconing; the report links activity to TA505, documents technical behaviors and detection artefacts (YARA rule, EQL query), lists IOCs and supplies a configuration extractor tool for defenders.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.