SEC News

What's new arround internet

Last one

Src	Date (GMT)	Titre	Description	Tags	Stories	Notes
	2021-01-19 07:04:55	Researchers Discover Raindrop - 4th Malware Linked to the SolarWinds Attack (lien direct)	Cybersecurity researchers have unearthed a fourth new malware strain-designed to spread the malware onto other computers in victims' networks-which was deployed as part of the SolarWinds supply chain attack disclosed late last year. Dubbed "Raindrop" by Broadcom-owned Symantec, the malware joins the likes of other malicious implants such as Sunspot, Sunburst (or Solorigate), and Teardrop that	Malware Mobile	Solardwinds Solardwinds
	2021-01-12 12:32:07	Potential Link between SolarWinds and Turla APT (lien direct)	Researchers at Kaspersky have recently discovered considerable similarities between the Sunburst and Kazuar backdoors. The similarities potentially link the Sunburst backdoors, used in the SolarWinds supply-chain attack, to a previously known Turla weapon. Kazuar, a malware written using the .NET framework, was first reported in 2017. These have been used in unison throughout various breaches […]	Malware Mobile	Solardwinds Solardwinds
	2021-01-12 11:25:00	Third Malware Strain Discovered as Part of SolarWinds Attack (lien direct)	Sunspot used to inject Sunburst into Orion platform, says CrowdStrike	Malware Mobile	Solardwinds Solardwinds
	2021-01-11 22:29:57	Unveiled: SUNSPOT Malware Was Used to Inject SolarWinds Backdoor (lien direct)	As the investigation into the SolarWinds supply-chain attack continues, cybersecurity researchers have disclosed a third malware strain that was deployed into the build environment to inject the backdoor into the company's Orion network monitoring platform. Called "Sunspot," the malignant tool adds to a growing list of previously disclosed malicious software such as Sunburst and Teardrop. "This	Malware Tool Mobile	Solardwinds Solardwinds
	2021-01-11 21:37:06	Connecting the dots between SolarWinds and Russia-linked Turla APT (lien direct)	Experts have found some similarities between the Sunburst backdoor used in the SolarWinds supply chain attack and Turla’s backdoor Kazuar. Security experts from Kaspersky have identified multiple similarities between the Sunburst malware used in the SolarWinds supply chain attack and the Kazuar backdoor that has been employed in cyber espionage campaigns conducted by Russia-linked APT group Turla. The discovery […]	Malware Mobile	Solardwinds Solardwinds
	2021-01-11 17:53:21	SolarWinds Hack Potentially Linked to Turla APT (lien direct)	Researchers have spotted notable code overlap between the Sunburst backdoor and a known Turla weapon.	Hack Mobile	Solardwinds Solardwinds
	2021-01-11 13:47:16	Malware Used in SolarWinds Attack Linked to Backdoor Attributed to Turla Cyberspies (lien direct)	Researchers have identified some similarities between the Sunburst malware used in the SolarWinds supply chain attack and Kazuar, a backdoor that appears to have been used by the Russia-linked cyber-espionage group known as Turla.	Malware Mobile	Solardwinds Solardwinds
	2021-01-11 12:19:03	Sunburst – Les experts ont trouvé des liens entre l\'attaque de SolarWinds et le backdoor Kazuar (lien direct)	Le 13 décembre dernier, FireEye, Microsoft et SolarWinds découvraient dans leurs réseaux informatiques une attaque sophistiquée ciblant leur chaîne logistique. Cette attaque déployait alors un nouveau malware, jusqu'ici inconnu, " Sunburst ", utilisé contre les clients informatiques d'Orion de SolarWinds. The post Sunburst – Les experts ont trouvé des liens entre l'attaque de SolarWinds et le backdoor Kazuar first appeared on UnderNews.	Mobile	Solardwinds Solardwinds
	2021-01-11 10:00:00	Sunburst backdoor – code overlaps with Kazuar (lien direct)	While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.	Mobile	Solardwinds Solardwinds
	2021-01-11 09:07:54	Sunburst backdoor shares features with Russian APT malware (lien direct)	Kaspersky researchers found that the Sunburst backdoor, the malware deployed during the SolarWinds supply-chain attack, shows feature overlaps with Kazuar, a .NET backdoor tentatively linked to the Russian Turla hacking group. [...]	Malware Mobile	Solardwinds Solardwinds
	2021-01-04 11:00:50	Our New Year\'s Resolution for You: Protect Your IoT Networks and Devices! (lien direct)	By, Mitch Muro, Product Marketing Manager Can 2020 just be over yet?! I mean, come on. Not only have we been struck with one of the most sophisticated and severe attacks seen to date (which of course is the Generation V SolarWinds Sunburst Attack), but cyber criminals are even taking advantage of the increase in…	Mobile	Solardwinds Solardwinds
	2020-12-29 21:55:38	SolarWinds hackers aimed at access to victims\' cloud assets (lien direct)	Microsoft says that SolarWinds hackers aimed at compromising the victims’ cloud infrastructure after deploying the Solorigate backdoor (aka Sunburst). The Microsoft 365 Defender Team revealed that the goal of the threat actors behind the SolarWinds supply chain attack was to move to the victims’ cloud infrastructure once infected their network with the Sunburst/Solorigate backdoor. “With […]	Threat Mobile	Solardwinds
	2020-12-29 21:22:00	Actionable Threat Intelligence Available for Sunburst Cyber Attacks on SolarWinds (lien direct)	On Dec. 13, FireEye published a detailed analysis about the attack carried out against SolarWinds, which appears to have compromised its Orion IT monitoring and management platform to spread the Sunburst Backdoor malware. As part of the attack, which started in March, the Orion platform started sending out the digitally-signed trojanized malware via regular updates. According to SolarWinds, the compromised update may have been installed by fewer than 18,000 of its customers, including many U.S. federal agencies and Fortune 500 firms that use Orion to monitor the health of their IT networks. In a related blog post, FireEye also announced that a highly sophisticated state-sponsored adversary penetrated its network and stole FireEye Red Team tools used to test customers’ security. In response to the attacks, Anomali has collected, curated, and distributed clear and concise open-source intelligence (OSINT) to help organizations determine if they have been impacted. Two key resources released include a SolarWinds Breach Threat Bulletin and a FireEye Red Team Tools Breach Threat Bulletin. These continually updated resources, for use inside Anomali ThreatStream, include threat analysis, signature threat models, and over 2,000 operationalized indicators of compromise (IOCs) for automated distribution to security controls. Both are available now to Anomali’s 1,500 customers. What Can I Do with This Threat Intelligence?...and How to Do It Our intent in aggregating and curating this threat intelligence is to provide organizations with high-fidelity IOCs that can immediately be pushed into their security stacks for rapid, proactive blocking and alerting. Security products that can take advantage of this actionable threat intelligence include security information and event management (SIEM), endpoint detection and response platforms, firewalls, domain name system (DNS) servers, security orchestration, automation, and response (SOAR) platforms, and other operational security products. These Anomali threat bulletins are designed to be used in conjunction with Anomali ThreatStream, a threat intelligence platform that allows organizations to aggregate, curate, analyze, and distribute multiple sources of threat intelligence to their operational security systems. Inside of the SolarWinds Breach Threat Bulletin, all of these IOCs have been tagged with “solarwinds”, “sunburst backdoor”, “unc2452”, or “avsvmcloud.com.” This enables ThreatStream users to create a simple rule to automatically push IOCs to their security systems, enabling real-time defense against both attacks. For example, if a compromised server inside the organization attempts to connect to a command and control (C2) server outside of the organization, Anomali customers that have activated this research will automatically block the C2 URL, avoiding risk of further compromise and data exfiltration. How Can I Get This Intelligence? The Anomali SolarWinds and FireEye Threat Bulletins are automatically available to Anomali’s ThreatStream customers, and all organizations participating in Anomali-powered threat intelligence sharing communities (ISACs). Anomali Threat Research also created a	Malware Threat Mobile	Solardwinds Solardwinds
	2020-12-29 20:12:00	Anomali ThreatStream Sunburst Backdoor Custom Dashboard Provides Machine Readable IOCs Related To SolarWinds Supply Chain Attack (lien direct)	SolarWinds, a provider of IT management and monitoring software deployed by thousands of global customers, was breached between March and June of 2020 by an Advanced Persistent Threat (APT) that cybersecurity company FireEye is tracking as UNC2452. As part of the supply chain attack, the APT compromised the company’s Orion business software with trojanized malware known as Sunburst, which opens a backdoor into the networks of customers who executed Orion updates. Immediately following news of the attack, Anomali Threat Research launched a custom threat intelligence dashboard called Sunburst Backdoor. Now available to Anomali ThreatStream customers, the dashboard is accessible via the user console. It is preconfigured to provide immediate access and visibility into all known Sunburst Backdoor indicators of compromise (IOCs) that are made available through commercial and open-source threat feeds that users manage on ThreatStream. Customers using ThreatStream, Anomali Match, and Anomali Lens can immediately detect any IOCs present in their environments, quickly consume threat bulletins containing machine readable IOCs to operationalize threat intelligence across their security infrastructures, and communicate to all stakeholders how they have been impacted. As part of ongoing product enhancements that further automate and speed essential tasks performed by threat intelligence and security operations analysts, Anomali recently added thematic dashboards that respond to significant global events. In addition to Sunburst Backdoor, ThreatStream customers currently have access to additional dashboards announced as part of our December quarterly product release. Customers can integrate Sunburst Backdoor and other dashboards via the “+ Add Dashboard” tab in the ThreatStream console: After integration, users will have immediate access to the Sunburst Backdoor dashboard, which continually updates IOCs as they become available: Organizations interested in learning more about Anomali ThreatStream and our custom dashboard capabilities can request a demo here. For organizations interested in gaining wider visibility and detection capabilities for the Sunburst cyberattack, Anomali Threat Research has compiled and curated an initial threat bulletin and downloadable set of OSINT IOCs available here.	Malware Threat Mobile	Solardwinds Solardwinds
	2020-12-22 21:52:57	Researchers shared the lists of victims of SolarWinds hack (lien direct)	Security experts shared lists of organizations that were infected with the SolarWinds Sunburst backdoor after decoding the DGA mechanism. Security experts started analyzing the DGA mechanism used by threat actors behind the SolarWinds hack to control the Sunburst/Solarigate backdoor and published the list of targeted organizations. Researchers from multiple cybersecurity firms published a list that […]	Hack Threat Mobile	Solardwinds Solardwinds
	2020-12-21 21:32:24	(Déjà vu) How A Device to Cloud Architecture Defends Against the SolarWinds Supply Chain Compromise (lien direct)	In a blog post released 13 Dec 2020, FireEye disclosed that threat actors compromised SolarWinds's Orion IT monitoring and management software with a trojanized version of SoalrWinds.Orion.Core.BusinessLayer.dll delivered as part of a digitally-signed Windows Installer Patch. The trojanized file delivers a backdoor, dubbed SUNBURST by FireEye (and Solorigate by Microsoft), that communicates to third-party servers for […]	Threat Mobile	Solardwinds Solardwinds
	2020-12-17 23:27:06	Additional Analysis into the SUNBURST Backdoor (lien direct)	Executive Summary There has been considerable focus on the recent disclosures associated with SolarWinds, and while existing analysis on the broader campaign has resulted in detection against specific IoCs associated with the Sunburst trojan, the focus within the Advanced Threat Research (ATR) team has been to determine the possibility of additional persistence measures. Our analysis […]	Threat Mobile	Solardwinds Solardwinds
	2020-12-17 00:31:32	FireEye, GoDaddy, and Microsoft created a kill switch for SolarWinds backdoor (lien direct)	Microsoft, FireEye, and GoDaddy have partnered to create a kill switch for the Sunburst backdoor that was employed in the recent SolarWinds hack. Microsoft, FireEye, and GoDaddy have created a kill switch for the Sunburst backdoor that was used in SolarWinds supply chain attack. Last week, Russia-linked hackers breached SolarWinds, the attackers had used a trojanized […]	Mobile	Solardwinds	★★★
	2020-12-16 19:28:13	SolarWinds Sunburst Attack: What Do You Need to Know and How Can You Remain Protected (lien direct)	On the week of December 13th , US government offices exposed they were targeted by a series of mega cyber attacks, allegedly related to state-sponsored threat organizations. Those attacks targeted government, technology and enterprise organizations worldwide. This series of attacks was made possible when hackers were able to embed a backdoor into SolarWinds software updates. Over…	Threat Mobile	Solardwinds Solardwinds
	2020-12-16 17:05:49	The SolarWinds Perfect Storm: Default Password, Access Sales and More (lien direct)	Meanwhile, Microsoft and other vendors are quickly moving to block the Sunburst backdoor used in the attack.	Mobile	Solardwinds	★★
	2020-12-16 16:21:50	FireEye, Microsoft create kill switch for SolarWinds backdoor (lien direct)	Microsoft, FireEye, and GoDaddy have collaborated to create a kill switch for the SolarWinds Sunburst backdoor that forces the malware to terminate itself. [...]	Malware Mobile	Solardwinds
	2020-12-15 00:41:04	2020-12-13 SUNBURST SolarWinds Backdoor samples (lien direct)	ReferenceI am sure you all saw the news.2020-12-13 Fireeye Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor 2020-12-13 Microsoft Customer Guidance on Recent Nation-State Cyber Attacks Well, here are the Sunburst binaries. Download Other malware	Mobile	Solardwinds
	2020-12-15 00:00:00	Overview of Recent Sunburst Targeted Attacks (lien direct)	Various sources have recently disclosed a sophisticated attack that hit organizations via the supply chain via a compromised network monitoring program. This post discusses what the Sunburst backdoor is and what you can do now to mitigate this threat.	Mobile	Solardwinds Solardwinds
	2018-09-24 14:00:00	The Strange, Sad Case of Sunspot, the Empty Astronomy Town (lien direct)	The FBI ordered an evacuation at Sunspot Observatory, in New Mexico, in a child porn investigation. But that's only one of the forces causing the town to empty out.	Mobile	Solardwinds

Last update at: 2024-05-20 05:07:47
See our sources.

To see everything: Our RSS (filtrered)