Kaspersky researchers attributed the attacks to a group tracked as Lyceum (aka Hexane), which was first publicly documented in 2019 by Secureworks. The attacks have shifted from leveraging a combination of PowerShell scripts and a.NET-based remote administration tool called “DanBot” to two new malware variants written in C++. Both the artifacts support communication with a remote command-and-server server via custom-designed protocols tunneled over DNS or. HTTP. In addition, the attackers are also believed to have deployed a custom keylogger as well as a. PowerShell script to record keystrokes and plunder credentials stored in web browsers.”]
Source: https://thehackernews.com/2021/10/cybersecurity-experts-warn-of-rise-in.html