What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-04-10 15:46:00 | Plus d'un million de sites WordPress infectés par la campagne de logiciels malveillants de l'injecteur de Balada Over 1 Million WordPress Sites Infected by Balada Injector Malware Campaign (lien direct) |
On estime que plus d'un million de sites Web WordPress ont été infectés par une campagne en cours pour déployer des logiciels malveillants appelés injecteurs de Balada depuis 2017.
The Massive Campaign, Per Godaddy \'s SucUri, "exploite tous les vulnérabilités du thème et du plugin récemment connues et récemment découvertes" pour violer les sites WordPress.Les attaques sont connues pour se jouer dans des vagues une fois toutes les quelques semaines.
"Cette campagne est facilement identifiée
Over one million WordPress websites are estimated to have been infected by an ongoing campaign to deploy malware called Balada Injector since 2017. The massive campaign, per GoDaddy\'s Sucuri, "leverages all known and recently discovered theme and plugin vulnerabilities" to breach WordPress sites. The attacks are known to play out in waves once every few weeks. "This campaign is easily identified |
Malware | ★★★ | |
|
2023-04-05 19:47:00 | Cryptoclippy: Nouveau logiciel malveillant Clipper ciblant les utilisateurs de crypto-monnaie portugais CryptoClippy: New Clipper Malware Targeting Portuguese Cryptocurrency Users (lien direct) |
Les utilisateurs portugais sont ciblés par une nouvelle cryptoclippie de codéclusion malveillante qui est capable de voler la crypto-monnaie dans le cadre d'une campagne de malvertisation.
L'activité tire parti des techniques d'empoisonnement du référencement pour inciter les utilisateurs à rechercher "WhatsApp Web" pour des domaines voyous hébergeant le malware, a déclaré aujourd'hui un nouveau rapport publié dans le malware.
Cryptoclippy, un exécutable basé sur C, est un type
Portuguese users are being targeted by a new malware codenamed CryptoClippy that\'s capable of stealing cryptocurrency as part of a malvertising campaign. The activity leverages SEO poisoning techniques to entice users searching for "WhatsApp web" to rogue domains hosting the malware, Palo Alto Networks Unit 42 said in a new report published today. CryptoClippy, a C-based executable, is a type |
Malware | ★★★ | |
|
2023-04-05 17:19:00 | Protégez votre entreprise: la prévention des ransomwares facilitée Protect Your Company: Ransomware Prevention Made Easy (lien direct) |
Chaque année, des centaines de millions d'attaques de logiciels malveillants se produisent dans le monde entier, et chaque année, les entreprises traitent de l'impact des virus, des vers, des keyloggers et des ransomwares.Le malware est une menace pernicieuse et le plus grand moteur des entreprises pour rechercher des solutions de cybersécurité.
Naturellement, les entreprises veulent trouver des produits qui arrêteront les logiciels malveillants sur ses pistes, et ils recherchent donc des solutions pour ce faire.
Every year hundreds of millions of malware attacks occur worldwide, and every year businesses deal with the impact of viruses, worms, keyloggers, and ransomware. Malware is a pernicious threat and the biggest driver for businesses to look for cybersecurity solutions. Naturally, businesses want to find products that will stop malware in its tracks, and so they search for solutions to do that. |
Ransomware Malware Threat | ★★ | |
|
2023-04-05 14:05:00 | Typhon Reborn Stealer Malware Resurfaces avec des techniques d'évasion avancées Typhon Reborn Stealer Malware Resurfaces with Advanced Evasion Techniques (lien direct) |
L'acteur de menace derrière les logiciels malveillants de volet de l'information connus sous le nom de Typhon Reborn a refait surface d'une version mise à jour (V2) qui a des capacités améliorées pour échapper à la détection et à résister à l'analyse.
La nouvelle version est offerte à la vente sur le criminaire criminel pour 59 $ par mois, 360 $ par an, ou alternativement, pour 540 $ pour un abonnement à vie.
"Le voleur peut récolter et exfiltrer
The threat actor behind the information-stealing malware known as Typhon Reborn has resurfaced with an updated version (V2) that packs in improved capabilities to evade detection and resist analysis. The new version is offered for sale on the criminal underground for $59 per month, $360 per year, or alternatively, for $540 for a lifetime subscription. "The stealer can harvest and exfiltrate |
Malware Threat | ★★ | |
|
2023-04-04 18:37:00 | New Rilide malware ciblant les navigateurs à base de chrome pour voler la crypto-monnaie New Rilide Malware Targeting Chromium-Based Browsers to Steal Cryptocurrency (lien direct) |
Les navigateurs Web basés sur le chrome sont la cible d'un nouveau malware appelé Rilide qui se dégage comme une extension apparemment légitime pour récolter des données sensibles et une crypto-monnaie siphon.
"Rilide Malware est déguisé en extension légitime de Google Drive et permet aux acteurs de menace de réaliser un large éventail d'activités malveillantes, y compris la surveillance
Parcourir l'histoire, prendre des captures d'écran,
Chromium-based web browsers are the target of a new malware called Rilide that masquerades itself as a seemingly legitimate extension to harvest sensitive data and siphon cryptocurrency. "Rilide malware is disguised as a legitimate Google Drive extension and enables threat actors to carry out a broad spectrum of malicious activities, including monitoring browsing history, taking screenshots, |
Malware Threat | ★★ | |
|
2023-04-04 15:38:00 | Groupe de piratage aride vipère utilisant des logiciels malveillants améliorés dans les cyberattaques du Moyen-Orient Arid Viper Hacking Group Using Upgraded Malware in Middle East Cyber Attacks (lien direct) |
L'acteur de menace connu sous le nom de vipère aride a été observé à l'aide de variantes actualisées de sa boîte à outils malware dans ses attaques ciblant les entités palestiniennes depuis septembre 2022.
Symantec, qui suit le groupe sous son surnom Mantis sur le thème des insectes, a déclaré que l'adversaire "va à de grandes longueurs pour maintenir une présence persistante sur les réseaux ciblés".
Également connu sous les noms apt-c-23 et désert
The threat actor known as Arid Viper has been observed using refreshed variants of its malware toolkit in its attacks targeting Palestinian entities since September 2022. Symantec, which is tracking the group under its insect-themed moniker Mantis, said the adversary is "going to great lengths to maintain a persistent presence on targeted networks." Also known by the names APT-C-23 and Desert |
Malware Threat | APT-C-23 | ★★ |
|
2023-04-04 10:00:00 | Microsoft resserre la sécurité onenote en bloquant automatiquement 120 extensions de fichiers risquées Microsoft Tightens OneNote Security by Auto-Blocking 120 Risky File Extensions (lien direct) |
Microsoft a annoncé son intention de bloquer automatiquement les fichiers embarqués avec des "extensions dangereuses" dans OneNote à la suite de rapports selon lesquels le service de prise de notes est de plus en plus abusé pour la livraison de logiciels malveillants.
Jusqu'à présent, les utilisateurs ont reçu une boîte de dialogue les avertissant que l'ouverture de ces pièces jointes pourrait nuire à leur ordinateur et à leurs données, mais il a été possible de rejeter l'invite et d'ouvrir les fichiers.
Ça va
Microsoft has announced plans to automatically block embedded files with "dangerous extensions" in OneNote following reports that the note-taking service is being increasingly abused for malware delivery. Up until now, users were shown a dialog warning them that opening such attachments could harm their computer and data, but it was possible to dismiss the prompt and open the files. That\'s going |
Malware | ★★★ | |
|
2023-04-03 14:50:00 | Les logiciels malveillants OPCJacker Crypto-Storiel ciblent les utilisateurs avec un faux service VPN Crypto-Stealing OpcJacker Malware Targets Users with Fake VPN Service (lien direct) |
Un nouveau logiciel malveillant de vol d'information appelé Opcjacker a été repéré dans la nature depuis la seconde moitié de 2022 dans le cadre d'une campagne de malvertisation.
"Les fonctions principales d'Opcjacker \\ incluent le keylogging, la prise de captures d'écran, le vol de données sensibles aux navigateurs, le chargement des modules supplémentaires et le remplacement des adresses de crypto-monnaie dans le presse-papiers à des fins de détournement", Trend Micro Researchers
A piece of new information-stealing malware called OpcJacker has been spotted in the wild since the second half of 2022 as part of a malvertising campaign. "OpcJacker\'s main functions include keylogging, taking screenshots, stealing sensitive data from browsers, loading additional modules, and replacing cryptocurrency addresses in the clipboard for hijacking purposes," Trend Micro researchers |
Malware Prediction | ★★★ | |
|
2023-03-30 15:38:00 | Alienfox Malware cible les clés API et les secrets des services AWS, Google et Microsoft Cloud [AlienFox Malware Targets API Keys and Secrets from AWS, Google, and Microsoft Cloud Services] (lien direct) | Un nouveau "ensemble d'outils complet" appelé Alienfox est distribué sur Telegram comme moyen pour les acteurs de menace de récolter les informations d'identification des clés d'API et des secrets des fournisseurs de services cloud populaires.
"La propagation d'Alienfox représente une tendance non déclarée vers l'attaque des services cloud plus minimaux, inapproprié pour l'exploitation cryptographique, afin d'activer et d'étendre les campagnes ultérieures", Sentinelone Security
A new "comprehensive toolset" called AlienFox is being distributed on Telegram as a way for threat actors to harvest credentials from API keys and secrets from popular cloud service providers. "The spread of AlienFox represents an unreported trend towards attacking more minimal cloud services, unsuitable for crypto mining, in order to enable and expand subsequent campaigns," SentinelOne security |
Malware Threat Prediction Cloud | ★★★ | |
|
2023-03-29 17:31:00 | M & eacute; Lof & eacute; E: Les chercheurs découvrent de nouveaux logiciels malveillants Linux liés aux groupes APT chinois [Mélofée: Researchers Uncover New Linux Malware Linked to Chinese APT Groups] (lien direct) | Un groupe de piratage parrainé par l'État chinois inconnu a été lié à une nouvelle pièce de logiciels malveillants destinée aux serveurs Linux.
La société de cybersécurité française EXATRACK, qui a trouvé trois échantillons du logiciel malveillant précédemment documenté qui remonte au début de 2022, le surnommé m & eacute; lof & eacute; e.
L'un des artefacts est conçu pour supprimer un rootkit en mode noyau qui \\ est basé sur un projet open source appelé
An unknown Chinese state-sponsored hacking group has been linked to a novel piece of malware aimed at Linux servers. French cybersecurity firm ExaTrack, which found three samples of the previously documented malicious software that date back to early 2022, dubbed it Mélofée. One of the artifacts is designed to drop a kernel-mode rootkit that\'s based on an open source project referred to as |
Malware | ★★ | |
|
2023-03-29 17:13:00 | Comment construire un laboratoire de recherche pour l'ingénierie inverse - 4 façons [How to Build a Research Lab for Reverse Engineering - 4 Ways] (lien direct) | L'analyse des logiciels malveillants est un élément essentiel du travail des chercheurs en sécurité.Mais travailler avec des échantillons malveillants peut être dangereux - il nécessite des outils spécialisés pour enregistrer leur activité et un environnement sécurisé pour éviter des dommages involontaires.
Cependant, la configuration et la configuration du laboratoire manuelles peuvent s'avérer être un processus laborieux et long.
Dans cet article, nous examinerons 4 façons de créer un revers
Malware analysis is an essential part of security researcher\'s work. But working with malicious samples can be dangerous - it requires specialized tools to record their activity, and a secure environment to prevent unintended damage. However, manual lab setup and configuration can prove to be a laborious and time-consuming process. In this article, we\'ll look at 4 ways to create a reverse |
Malware | ★★★ | |
|
2023-03-29 14:47:00 | Installateurs de navigateur TOR TOR Trojanisé répartissant les logiciels malveillants de la crypto-étalage Clipper [Trojanized TOR Browser Installers Spreading Crypto-Stealing Clipper Malware] (lien direct) | Les installateurs de Trojanisé pour le navigateur d'anonymat Tor sont utilisés pour cibler les utilisateurs en Russie et en Europe de l'Est avec des logiciels malveillants Clipper conçus pour siphonner les crypto-monnaies depuis septembre 2022.
"Les injecteurs du presse-papiers [...] peuvent se taire pendant des années, ne montrent aucune activité de réseau ou tout autre signe de présence jusqu'à la journée désastreuse lorsqu'ils remplacent une adresse de portefeuille cryptographique", Vitaly Kamluk, directeur du directeur de
Trojanized installers for the TOR anonymity browser are being used to target users in Russia and Eastern Europe with clipper malware designed to siphon cryptocurrencies since September 2022. "Clipboard injectors [...] can be silent for years, show no network activity or any other signs of presence until the disastrous day when they replace a crypto wallet address," Vitaly Kamluk, director of |
Malware | ★★ | |
|
2023-03-28 17:38:00 | Les changements de logiciels malveillants icedid se concentrent de la fraude bancaire à la livraison des ransomwares [IcedID Malware Shifts Focus from Banking Fraud to Ransomware Delivery] (lien direct) | Des acteurs de menaces multiples ont été observés à l'aide de deux nouvelles variantes du malware icedid à l'état sauvage avec des fonctionnalités plus limitées qui suppriment les fonctionnalités liées à la fraude bancaire en ligne.
Icedide, également connu sous le nom de Bokbot, a commencé comme un Troie bancaire en 2017. Il est également capable de livrer des logiciels malveillants supplémentaires, y compris des ransomwares.
"La version glacée bien connue se compose d'un chargeur initial
Multiple threat actors have been observed using two new variants of the IcedID malware in the wild with more limited functionality that removes functionality related to online banking fraud. IcedID, also known as BokBot, started off as a banking trojan in 2017. It\'s also capable of delivering additional malware, including ransomware. "The well-known IcedID version consists of an initial loader |
Ransomware Malware Threat | ★★★ | |
|
2023-03-28 15:23:00 | Fondeurs malveillants dbatloader furtifs étalant Remcos Rat et Formbook en Europe [Stealthy DBatLoader Malware Loader Spreading Remcos RAT and Formbook in Europe] (lien direct) | Une nouvelle campagne de phishing a visionné les entités européennes pour distribuer Remcos Rat et FormBook via un chargeur de logiciels malveillants doublé DBATloader.
"La charge utile de malware est distribuée via des sites Web WordPress qui ont autorisé les certificats SSL, qui est une tactique courante utilisée par les acteurs de la menace pour échapper aux moteurs de détection", a déclaré les chercheurs de ZSCaler Meghraj Nandanwar et Satyam Singh dans un rapport dans un rapport
A new phishing campaign has set its sights on European entities to distribute Remcos RAT and Formbook via a malware loader dubbed DBatLoader. "The malware payload is distributed through WordPress websites that have authorized SSL certificates, which is a common tactic used by threat actors to evade detection engines," Zscaler researchers Meghraj Nandanwar and Satyam Singh said in a report |
Malware Threat | ★★★ | |
|
2023-03-27 16:08:00 | Nouveau Macstealer MacOS malware vole les données et les mots de passe iCloud [New MacStealer macOS Malware Steals iCloud Keychain Data and Passwords] (lien direct) | Un nouveau logiciel malveillant de vol d'informations a fixé son objectif sur le système d'exploitation MacOS d'Apple \\ pour siphon des informations sensibles à partir de périphériques compromis.
Surnommé MacStealer, il est le dernier exemple de menace qui utilise Telegram comme plate-forme de commande et de contrôle (C2) pour exfiltrer les données.Il affecte principalement les appareils exécutant des versions macOS Catalina et fonctionnant plus tard sur les processeurs M1 et M2.
"Macstealer a le
A new information-stealing malware has set its sights on Apple\'s macOS operating system to siphon sensitive information from compromised devices. Dubbed MacStealer, it\'s the latest example of a threat that uses Telegram as a command-and-control (C2) platform to exfiltrate data. It primarily affects devices running macOS versions Catalina and later running on M1 and M2 CPUs. "MacStealer has the |
Malware Threat | ★★ | |
|
2023-03-22 17:54:00 | Arsenal évolutif de Scarcruft \\: les chercheurs révèlent de nouvelles techniques de distribution de logiciels malveillants [ScarCruft\\'s Evolving Arsenal: Researchers Reveal New Malware Distribution Techniques] (lien direct) | L'acteur de menace persistante avancée nord-coréenne (APT) surnommé Scarcruft utilise des fichiers HTML (CHM) compilés compilés par Microsoft armé pour télécharger des logiciels malveillants supplémentaires.
Selon plusieurs rapports d'Ahnlab Security Emergency Response Center (ASEC), de Sekoia.io et de Zscaler, les résultats illustrent les efforts continus du groupe pour affiner et réorganiser ses tactiques pour contourner la détection.
"
The North Korean advanced persistent threat (APT) actor dubbed ScarCruft is using weaponized Microsoft Compiled HTML Help (CHM) files to download additional malware. According to multiple reports from AhnLab Security Emergency response Center (ASEC), SEKOIA.IO, and Zscaler, the findings are illustrative of the group\'s continuous efforts to refine and retool its tactics to sidestep detection. " |
Malware Threat General Information Cloud | APT 37 | ★★ |
|
2023-03-22 14:28:00 | Les forfaits Rogue Nuget infectent les développeurs .NET avec des logiciels malveillants crypto-nocaux [Rogue NuGet Packages Infect .NET Developers with Crypto-Stealing Malware] (lien direct) | Le référentiel NuGet est la cible d'une nouvelle "attaque sophistiquée et très malveillante" visant à infecter les systèmes de développeurs .NET avec des logiciels malveillants de voleur de crypto-monnaie.
Les 13 packages Rogue, qui ont été téléchargés plus de 160 000 fois au cours du mois dernier, ont depuis été retirés.
"Les packages contenaient un script PowerShell qui s'exécuterait lors de l'installation et déclencherait un téléchargement d'un \\ '
The NuGet repository is the target of a new "sophisticated and highly-malicious attack" aiming to infect .NET developer systems with cryptocurrency stealer malware. The 13 rogue packages, which were downloaded more than 160,000 times over the past month, have since been taken down. "The packages contained a PowerShell script that would execute upon installation and trigger a download of a \' |
Malware | ★★ | |
|
2023-03-22 12:49:00 | New NapListener Malware utilisé par le groupe REF2924 pour échapper à la détection du réseau [New NAPLISTENER Malware Used by REF2924 Group to Evade Network Detection] (lien direct) | Le groupe de menaces suivi comme Ref2924 a été observé pour déployer des logiciels malveillants invisibles auparavant dans ses attaques destinées aux entités d'Asie du Sud et du Sud-Est.
Le logiciel malveillant, surnommé NapListener par Elastic Security Labs, est un écouteur HTTP programmé en C # et est conçu pour échapper aux "formes de détection basées sur le réseau".
REF2924 est le surnom attribué à un cluster d'activités lié aux attaques contre une entité
The threat group tracked as REF2924 has been observed deploying previously unseen malware in its attacks aimed at entities in South and Southeast Asia. The malware, dubbed NAPLISTENER by Elastic Security Labs, is an HTTP listener programmed in C# and is designed to evade "network-based forms of detection." REF2924 is the moniker assigned to an activity cluster linked to attacks against an entity |
Malware Threat General Information | ★★★ | |
|
2023-03-21 17:11:00 | Nouveau shellbot DDOS malware ciblant les serveurs Linux mal gérés [New ShellBot DDoS Malware Targeting Poorly Managed Linux Servers] (lien direct) | Les serveurs Linux SSH mal gérés sont ciblés dans le cadre d'une nouvelle campagne qui déploie différentes variantes de logiciels malveillants appelés shellbot.
"Shellbot, également connu sous le nom de Perlbot, est un logiciel malveillant DDOS BOT développé dans Perl et utilise caractéristiquement le protocole IRC pour communiquer avec le serveur C & amp; C", a déclaré Ahnlab Security Emergency Response Center (ASEC) dans un rapport.
Shellbot est installé sur des serveurs qui
Poorly managed Linux SSH servers are being targeted as part of a new campaign that deploys different variants of malware called ShellBot. "ShellBot, also known as PerlBot, is a DDoS Bot malware developed in Perl and characteristically uses IRC protocol to communicate with the C&C server," AhnLab Security Emergency response Center (ASEC) said in a report. ShellBot is installed on servers that |
Malware | ★★ | |
|
2023-03-20 19:09:00 | New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads (lien direct) | A new piece of malware dubbed dotRunpeX is being used to distribute numerous known malware families such as Agent Tesla, Ave Maria, BitRAT, FormBook, LokiBot, NetWire, Raccoon Stealer, RedLine Stealer, Remcos, Rhadamanthys, and Vidar. "DotRunpeX is a new injector written in .NET using the Process Hollowing technique and used to infect systems with a variety of known malware families," Check | Malware | ★★★ | |
|
2023-03-17 23:45:00 | FakeCalls Vishing Malware Targets South Korean Users via Popular Financial Apps (lien direct) | An Android voice phishing (aka vishing) malware campaign known as FakeCalls has reared its head once again to target South Korean users under the guise of over 20 popular financial apps. "FakeCalls malware possesses the functionality of a Swiss army knife, able not only to conduct its primary aim but also to extract private data from the victim's device," cybersecurity firm Check Point said. | Malware | ★★★ | |
|
2023-03-17 17:37:00 | New GoLang-Based HinataBot Exploiting Router and Server Flaws for DDoS Attacks (lien direct) | A new Golang-based botnet dubbed HinataBot has been observed to leverage known flaws to compromise routers and servers and use them to stage distributed denial-of-service (DDoS) attacks. "The malware binaries appear to have been named by the malware author after a character from the popular anime series, Naruto, with file name structures such as 'Hinata--,'" Akamai said in a | Malware Threat | ★★★ | |
|
2023-03-17 15:52:00 | Lookalike Telegram and WhatsApp Websites Distributing Cryptocurrency Stealing Malware (lien direct) | Copycat websites for instant messaging apps like Telegram and WhatApp are being used to distribute trojanized versions and infect Android and Windows users with cryptocurrency clipper malware. "All of them are after victims' cryptocurrency funds, with several targeting cryptocurrency wallets," ESET researchers Lukáš Štefanko and Peter Strýček said in a new analysis. While the first instance of | Malware Threat | ★★ | |
|
2023-03-16 21:00:00 | Chinese and Russian Hackers Using SILKLOADER Malware to Evade Detection (lien direct) | Threat activity clusters affiliated with the Chinese and Russian cybercriminal ecosystems have been observed using a new piece of malware that's designed to load Cobalt Strike onto infected machines. Dubbed SILKLOADER by Finnish cybersecurity company WithSecure, the malware leverages DLL side-loading techniques to deliver commercial adversary simulation software. The development comes as | Malware Threat | ★★ | |
|
2023-03-16 19:09:00 | Cryptojacking Group TeamTNT Suspected of Using Decoy Miner to Conceal Data Exfiltration (lien direct) | The cryptojacking group known as TeamTNT is suspected to be behind a previously undiscovered strain of malware used to mine Monero cryptocurrency on compromised systems. That's according to Cado Security, which found the sample after Sysdig detailed a sophisticated attack known as SCARLETEEL aimed at containerized environments to ultimately steal proprietary data and software. Specifically, the | Malware | ★★ | |
|
2023-03-15 14:53:00 | Tick APT Targeted High-Value Customers of East Asian Data-Loss Prevention Company (lien direct) | A cyberespionage actor known as Tick has been attributed with high confidence to a compromise of an East Asian data-loss prevention (DLP) company that caters to government and military entities. "The attackers compromised the DLP company's internal update servers to deliver malware inside the software developer's network, and trojanized installers of legitimate tools used by the company, which | Malware Threat | ★★★ | |
|
2023-03-14 17:32:00 | GoBruteforcer: New Golang-Based Malware Breaches Web Servers Via Brute-Force Attacks (lien direct) | A new Golang-based malware dubbed GoBruteforcer has been found targeting web servers running phpMyAdmin, MySQL, FTP, and Postgres to corral the devices into a botnet. "GoBruteforcer chose a Classless Inter-Domain Routing (CIDR) block for scanning the network during the attack, and it targeted all IP addresses within that CIDR range," Palo Alto Networks Unit 42 researchers said. "The threat actor | Malware Threat | ★★★ | |
|
2023-03-13 17:17:00 | Warning: AI-generated YouTube Video Tutorials Spreading Infostealer Malware (lien direct) | Threat actors have been increasingly observed using AI-generated YouTube Videos to spread a variety of stealer malware such as Raccoon, RedLine, and Vidar. "The videos lure users by pretending to be tutorials on how to download cracked versions of software such as Photoshop, Premiere Pro, Autodesk 3ds Max, AutoCAD, and other products that are licensed products available only to paid users," | Malware Threat | ★★ | |
|
2023-03-13 11:45:00 | KamiKakaBot Malware Used in Latest Dark Pink APT Attacks on Southeast Asian Targets (lien direct) | The Dark Pink advanced persistent threat (APT) actor has been linked to a fresh set of attacks targeting government and military entities in Southeast Asian countries with a malware called KamiKakaBot. Dark Pink, also called Saaiwc, was first profiled by Group-IB earlier this year, describing its use of custom tools such as TelePowerBot and KamiKakaBot to run arbitrary commands and exfiltrate | Malware Threat | ★★★ | |
|
2023-03-11 19:02:00 | BATLOADER Malware Uses Google Ads to Deliver Vidar Stealer and Ursnif Payloads (lien direct) | The malware downloader known as BATLOADER has been observed abusing Google Ads to deliver secondary payloads like Vidar Stealer and Ursnif. According to cybersecurity company eSentire, malicious ads are used to spoof a wide range of legitimate apps and services such as Adobe, OpenAPI's ChatGPT, Spotify, Tableau, and Zoom. BATLOADER, as the name suggests, is a loader that's responsible for | Malware | ChatGPT | ★★ |
|
2023-03-10 19:32:00 | New Version of Prometei Botnet Infects Over 10,000 Systems Worldwide (lien direct) | An updated version of a botnet malware called Prometei has infected more than 10,000 systems worldwide since November 2022. The infections are both geographically indiscriminate and opportunistic, with a majority of the victims reported in Brazil, Indonesia, and Turkey. Prometei, first observed in 2016, is a modular botnet that features a large repertoire of components and several proliferation | Malware | ★★★ | |
|
2023-03-10 19:20:00 | China-linked Hackers Targeting Unpatched SonicWall SMA Devices with Malware (lien direct) | A suspecting China-linked hacking campaign has been observed targeting unpatched SonicWall Secure Mobile Access (SMA) 100 appliances to drop malware and establish long-term persistence. "The malware has functionality to steal user credentials, provide shell access, and persist through firmware upgrades," cybersecurity company Mandiant said in a technical report published this week. The | Malware | ★★ | |
|
2023-03-10 15:33:00 | Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant (lien direct) | A new variant of the Android banking trojan named Xenomorph has surfaced in the wild, the latest findings from ThreatFabric reveal. Named "Xenomorph 3rd generation" by the Hadoken Security Group, the threat actor behind the operation, the updated version comes with new features that allow it to perform financial fraud in a seamless manner. "This new version of the malware adds many new | Malware Threat | ★★ | |
|
2023-03-10 13:13:00 | North Korean UNC2970 Hackers Expands Operations with New Malware Families (lien direct) | A North Korean espionage group tracked as UNC2970 has been observed employing previously undocumented malware families as part of a spear-phishing campaign targeting U.S. and European media and technology organizations since June 2022. Google-owned Mandiant said the threat cluster shares "multiple overlaps" with a long-running operation dubbed "Dream Job" that employs job recruitment lures in | Malware Threat | ★★ | |
|
2023-03-09 20:24:00 | Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware (lien direct) | Security vulnerabilities in remote desktop programs such as Sunlogin and AweSun are being exploited by threat actors to deploy the PlugX malware. AhnLab Security Emergency Response Center (ASEC), in a new analysis, said it marks the continued abuse of the flaws to deliver a variety of payloads on compromised systems. This includes the Sliver post-exploitation framework, XMRig cryptocurrency | Malware Threat | ★★★ | |
|
2023-03-06 19:48:00 | New HiatusRAT Malware Targets Business-Grade Routers to Covertly Spy on Victims (lien direct) | A never-before-seen complex malware is targeting business-grade routers to covertly spy on victims in Latin America, Europe, and North America at least since July 2022. The elusive campaign, dubbed Hiatus by Lumen Black Lotus Labs, has been found to deploy two malicious binaries, a remote access trojan dubbed HiatusRAT and a variant of tcpdump that makes it possible to capture packet capture on | Malware | ★★ | |
|
2023-03-04 16:48:00 | New FiXS ATM Malware Targeting Mexican Banks (lien direct) | A new ATM malware strain dubbed FiXS has been observed targeting Mexican banks since the start of February 2023. "The ATM malware is hidden inside another not-malicious-looking program," Latin American cybersecurity firm Metabase Q said in a report shared with The Hacker News. Besides requiring interaction via an external keyboard, the Windows-based ATM malware is also vendor-agnostic and is | Malware | ★★★ | |
|
2023-03-02 16:51:00 | Experts Identify Fully-Featured Info Stealer and Trojan in Python Package on PyPI (lien direct) | A malicious Python package uploaded to the Python Package Index (PyPI) has been found to contain a fully-featured information stealer and remote access trojan. The package, named colourfool, was identified by Kroll's Cyber Threat Intelligence team, with the company calling the malware Colour-Blind. "The 'Colour-Blind' malware points to the democratization of cybercrime that could lead to an | Malware Threat Guideline | ★★ | |
|
2023-03-02 13:33:00 | SysUpdate Malware Strikes Again with Linux Version and New Evasion Tactics (lien direct) | The threat actor known as Lucky Mouse has developed a Linux version of a malware toolkit called SysUpdate, expanding on its ability to target devices running the operating system. The oldest version of the updated artifact dates back to July 2022, with the malware incorporating new features designed to evade security software and resist reverse engineering. Cybersecurity company Trend Micro said | Malware Threat Prediction | APT 27 | ★★ |
|
2023-03-01 19:32:00 | Cybercriminals Targeting Law Firms with GootLoader and FakeUpdates Malware (lien direct) | Six different law firms were targeted in January and February 2023 as part of two disparate threat campaigns distributing GootLoader and FakeUpdates (aka SocGholish) malware strains. GootLoader, active since late 2020, is a first-stage downloader that's capable of delivering a wide range of secondary payloads such as Cobalt Strike and ransomware. It notably employs search engine optimization ( | Malware Threat | ★★ | |
|
2023-03-01 17:02:00 | BlackLotus Becomes First UEFI Bootkit Malware to Bypass Secure Boot on Windows 11 (lien direct) | A stealthy Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus has become the first publicly known malware capable of bypassing Secure Boot, making it a potent threat in the cyber landscape. "This bootkit can run even on fully up-to-date Windows 11 systems with UEFI Secure Boot enabled," Slovak cybersecurity company ESET said in a report shared with The Hacker News. UEFI | Malware Threat | ★★★★ | |
|
2023-03-01 11:41:00 | Parallax RAT Targeting Cryptocurrency Firms with Sophisticated Injection Techniques (lien direct) | Cryptocurrency companies are being targeted as part of a new campaign that delivers a remote access trojan called Parallax RAT. The malware "uses injection techniques to hide within legitimate processes, making it difficult to detect," Uptycs said in a new report. "Once it has been successfully injected, attackers can interact with their victim via Windows Notepad that likely serves as a | Malware | ★★ | |
|
2023-02-27 16:23:00 | ChromeLoader Malware Targeting Gamers via Fake Nintendo and Steam Game Hacks (lien direct) | A new ChromeLoader malware campaign has been observed being distributed via virtual hard disk (VHD) files, marking a deviation from the ISO optical disc image format. "These VHD files are being distributed with filenames that make them appear like either hacks or cracks for Nintendo and Steam games," AhnLab Security Emergency response Center (ASEC) said in a report last week. ChromeLoader (aka | Malware | ★★★★ | |
|
2023-02-27 15:52:00 | (Déjà vu) PureCrypter Malware Targets Government Entities in Asia-Pacific and North America (lien direct) | Government entities in Asia-Pacific and North America are being targeted by an unknown threat actor with an off-the-shelf malware downloader known as PureCrypter to deliver an array of information stealers and ransomware. "The PureCrypter campaign uses the domain of a compromised non-profit organization as a command-and-control (C2) to deliver a secondary payload," Menlo Security researcher | Malware Threat | ★★ | |
|
2023-02-23 22:19:00 | Hackers Using Trojanized macOS Apps to Deploy Evasive Cryptocurrency Mining Malware (lien direct) | Trojanized versions of legitimate applications are being used to deploy evasive cryptocurrency mining malware on macOS systems. Jamf Threat Labs, which made the discovery, said the XMRig coin miner was executed as Final Cut Pro, a video editing software from Apple, which contained an unauthorized modification. "This malware makes use of the Invisible Internet Project (i2p) [...] to download | Malware Threat | ★ | |
|
2023-02-23 17:17:00 | Lazarus Group Using New WinorDLL64 Backdoor to Exfiltrate Sensitive Data (lien direct) | A new backdoor associated with a malware downloader named Wslink has been discovered, with the tool likely used by the notorious North Korea-aligned Lazarus Group, new findings reveal. The payload, dubbed WinorDLL64 by ESET, is a fully-featured implant that can exfiltrate, overwrite, and delete files; execute PowerShell commands; and obtain comprehensive information about the underlying machine. | Malware Tool Medical | APT 38 | ★ |
|
2023-02-23 16:15:00 | New S1deload Malware Hijacking Users\' Social Media Accounts and Mining Cryptocurrency (lien direct) | An active malware campaign has set its sights on Facebook and YouTube users by leveraging a new information stealer to hijack the accounts and abuse the systems' resources to mine cryptocurrency. Bitdefender is calling the malware S1deload Stealer for its use of DLL side-loading techniques to get past security defenses and execute its malicious components. "Once infected, S1deload Stealer steals | Malware | ★ | |
|
2023-02-21 16:05:00 | Researchers Discover Dozens Samples of Information Stealer \'Stealc\' in the Wild (lien direct) | A new information stealer called Stealc that's being advertised on the dark web could emerge as a worthy competitor to other malware of its ilk. "The threat actor presents Stealc as a fully featured and ready-to-use stealer, whose development relied on Vidar, Raccoon, Mars, and RedLine stealers," SEKOIA said in a Monday report. The French cybersecurity company said it discovered more than 40 | Malware Threat | ★★★ | |
|
2023-02-20 16:32:00 | How to Detect New Threats via Suspicious Activities (lien direct) | Unknown malware presents a significant cybersecurity threat and can cause serious damage to organizations and individuals alike. When left undetected, malicious code can gain access to confidential information, corrupt data, and allow attackers to gain control of systems. Find out how to avoid these circumstances and detect unknown malicious behavior efficiently. Challenges of new threats' | Malware Threat | ★★★ | |
|
2023-02-20 15:41:00 | North Korean Cyber Espionage Group Deploys WhiskerSpy Backdoor in Latest Attacks (lien direct) | The cyber espionage threat actor tracked as Earth Kitsune has been observed deploying a new backdoor called WhiskerSpy as part of a social engineering campaign. Earth Kitsune, active since at least 2019, is known to primarily target individuals interested in North Korea with self-developed malware such as dneSpy and agfSpy. Previously documented intrusions have entailed the use of watering holes | Malware Threat | ★★ |
To see everything:
Our RSS (filtrered)
