What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-04-21 12:37:29 | AndroxGH0st malware compromet les serveurs dans le monde entier pour l'attaque de botnet Androxgh0st Malware Compromises Servers Worldwide for Botnet Attack (lien direct) |
> Par deeba ahmed
Veriti Research expose une augmentation des attaques AndroxGH0ST, exploitant CVES et construisant des botnets pour le vol d'identification.Systèmes de correctifs, surveiller les coquilles Web et utiliser l'analyse comportementale pour vous protéger.
Ceci est un article de HackRead.com Lire le post d'origine: AndroxGH0st MicwareCompromet les serveurs dans le monde entier pour l'attaque de botnet
>By Deeba Ahmed Veriti Research exposes surge in Androxgh0st attacks, exploiting CVEs and building botnets for credential theft. Patch systems, monitor for web shells, and use behavioral analysis to protect yourself. This is a post from HackRead.com Read the original post: Androxgh0st Malware Compromises Servers Worldwide for Botnet Attack |
Malware | ★★★ | |
 |
2024-04-20 10:14:28 | Les commentaires GitHub ont été maltraités pour pousser les logiciels malveillants via les URL de Microsoft Repo GitHub comments abused to push malware via Microsoft repo URLs (lien direct) |
Une faille GitHub, ou peut-être une décision de conception, est abusée par les acteurs de la menace pour distribuer des logiciels malveillants à l'aide d'URL associés à un référentiel Microsoft, ce qui rend les fichiers dignes de confiance.[...]
A GitHub flaw, or possibly a design decision, is being abused by threat actors to distribute malware using URLs associated with a Microsoft repository, making the files appear trustworthy. [...] |
Malware Threat | ★★★ | |
 |
2024-04-19 08:59:00 | Les vulnérabilités d'Openmetadata exploitées pour abuser des grappes de Kubernetes pour la cryptomiminage OpenMetadata Vulnerabilities Exploited to Abuse Kubernetes Clusters for Cryptomining (lien direct) |
> Microsoft avertit que plusieurs vulnérabilités Openmetadata sont exploitées pour déployer des logiciels malveillants de cryptomine dans les environnements Kubernetes.
>Microsoft warns that several OpenMetadata vulnerabilities are being exploited to deploy cryptomining malware to Kubernetes environments. |
Malware Vulnerability | ★★ | |
 |
2024-04-19 03:20:00 | Evil XDR: Le chercheur transforme le logiciel Palo Alto en logiciel malveillant parfait Evil XDR: Researcher Turns Palo Alto Software Into Perfect Malware (lien direct) |
Il s'avère qu'une solution de sécurité puissante peut doubler en tant que logiciels malveillants encore plus puissants, capable d'accorder un accès complet sur une machine ciblée.
It turns out that a powerful security solution can double as even more powerful malware, capable of granting comprehensive access over a targeted machine. |
Malware Technical | ★★★★ | |
|
2024-04-18 20:46:29 | Fake Cheat attire les joueurs dans la propagation du malware d'infostealer Fake cheat lures gamers into spreading infostealer malware (lien direct) |
Un nouveau logiciel malveillant de vol d'informations lié à Redline se fait passer pour une triche de jeu appelée \\ 'Cheat Lab, \' promettre aux téléchargeurs une copie gratuite s'ils convaincent leurs amis de l'installer également.[...]
A new info-stealing malware linked to Redline poses as a game cheat called \'Cheat Lab,\' promising downloaders a free copy if they convince their friends to install it too. [...] |
Malware | ★★ | |
 |
2024-04-18 20:37:30 | Threat Group FIN7 Targets the U.S. Automotive Industry (lien direct) | #### Géolocations ciblées
- États-Unis
## Instantané
À la fin de 2023, les analystes de BlackBerry ont détecté une campagne de phisces de lance lancée par FIN7, suivie par Microsoft sous le nom de Sangria Tempest, ciblant un constructeur automobile basé aux États-Unis.
## Description
Les attaquants se sont concentrés sur les employés du service informatique possédant des privilèges administratifs élevés, les attirant avec une offre d'un outil de numérisation IP gratuit, qui a dissimulé la porte dérobée Anunak.Cet incident démontre un changement dans les efforts de Fin7 \\, du ciblage généralisé au ciblage plus précis de secteurs de grande valeur tels que le transport et la défense.
En cliquant sur des URL intégrées, les victimes ont été dirigées vers des sites Web malveillants, faisant partie d'un schéma de typosquat, qui a facilité le téléchargement et l'exécution de la porte dérobée Anunak sur leurs systèmes.Le déploiement de la vie des binaires terrestres, des scripts et des bibliothèques (lolbas) a masqué l'activité malveillante, en aidant à l'attaquants \\ 'de pied initial.En outre, le flux d'exécution des logiciels malveillants a impliqué des processus complexes en plusieurs étapes, y compris le décryptage et l'exécution des charges utiles, telles que Anunak, et l'établissement de la persistance via OpenSSH.
Au cours de la phase de livraison de cette campagne, le site Web de faux leurre, «Advanced-ip-scanner \ [. \] Com», redirigé vers «Myipscanner \ [. \] Com».Les analystes de BlackBerry ont trouvé plusieurs domaines enregistrés dans les minutes suivant l'original sur le même fournisseur, illustrant que cette campagne n'est probablement pas limitée à cette attaque, mais fait plutôt partie d'une campagne plus large de FIN7.
## Les références
[https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industrycibles-states unités-automotive-industrie)
#### Targeted Geolocations - United States ## Snapshot In late 2023, BlackBerry analysts detected a spear-phishing campaign launched by FIN7, tracked by Microsoft as Sangria Tempest, targeting a US-based automotive manufacturer. ## Description The attackers concentrated on employees within the IT department possessing elevated administrative privileges, luring them with an offer of a free IP scanning tool, which concealed the Anunak backdoor. This incident is demonstrative of a shift in FIN7\'s efforts from widespread targeting to more precise targeting of high-value sectors such as transportation and defense. Upon clicking on embedded URLs, victims were directed to malicious websites, part of a typosquatting scheme, which facilitated the download and execution of the Anunak backdoor onto their systems. The deployment of living off the land binaries, scripts, and libraries (lolbas) masked the malicious activity, aiding in the attackers\' initial foothold. Furthermore, the malware execution flow involved intricate multi-stage processes, including the decryption and execution of payloads, such as Anunak, and the establishment of persistence through OpenSSH. During the delivery phase of this campaign, the fake lure website, “advanced-ip-sccanner\[.\]com,” redirected to “myipscanner\[.\]com.” Blackberry analysts found multiple domains registered within minutes of the original on the same provider, illustrating that this campaign is likely not limited to this attack, but is instead part of a wider campaign by FIN7. ## References [https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry](https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry) |
Malware Tool Threat | ★★ | |
 |
2024-04-18 19:55:00 | Les logiciels malveillants Offlrouter échappent à la détection en Ukraine pendant près d'une décennie OfflRouter Malware Evades Detection in Ukraine for Almost a Decade (lien direct) |
Certains réseaux gouvernementaux ukrainiens sont restés infectés par un malware appelé Offlrouter depuis 2015.
Cisco Talos a déclaré que ses résultats sont basés sur une analyse de plus de 100 documents confidentiels qui ont été infectés par le virus macro VBA et téléchargés sur la plate-forme de balayage malware Virustotal.
"Les documents contenaient du code VBA pour supprimer et exécuter un exécutable avec le nom \\ 'ctrlpanel.exe, \'"
Select Ukrainian government networks have remained infected with a malware called OfflRouter since 2015. Cisco Talos said its findings are based on an analysis of over 100 confidential documents that were infected with the VBA macro virus and uploaded to the VirusTotal malware scanning platform. "The documents contained VBA code to drop and run an executable with the name \'ctrlpanel.exe,\'" |
Malware | ★★★ | |
 |
2024-04-18 16:26:44 | Étude de Kaspersky: les appareils infectés par des logiciels malveillants de vol de données ont augmenté de 7 fois depuis 2020 Kaspersky Study: Devices Infected With Data-Stealing Malware Increased by 7 Times Since 2020 (lien direct) |
Près de 10 millions de dispositifs ont été infectés par des logiciels malveillants de vol de données en 2023, les criminels volant en moyenne 50,9 informations d'identification par appareil.
Nearly 10 million devices were infected with data-stealing malware in 2023, with criminals stealing an average of 50.9 credentials per device. |
Malware Studies | ★★★ | |
|
2024-04-18 16:01:00 | Nouveau Android Trojan \\ 'Soumnibot \\' Évite la détection avec des astuces intelligentes New Android Trojan \\'SoumniBot\\' Evades Detection with Clever Tricks (lien direct) |
Un nouveau chevalier Android appelé & nbsp; soumnibot & nbsp; a été détecté dans les utilisateurs de ciblage sauvage en Corée du Sud en tirant parti des faiblesses dans la procédure d'extraction et d'analyse manifeste.
Le malware est "notable pour une approche non conventionnelle pour échapper à l'analyse et à la détection, à savoir l'obscurcissement du manifeste Android", le chercheur de Kaspersky Dmitry Kalinin & nbsp; dit & nbsp; dans une analyse technique.
A new Android trojan called SoumniBot has been detected in the wild targeting users in South Korea by leveraging weaknesses in the manifest extraction and parsing procedure. The malware is "notable for an unconventional approach to evading analysis and detection, namely obfuscation of the Android manifest," Kaspersky researcher Dmitry Kalinin said in a technical analysis. |
Malware Mobile Technical | ★★ | |
|
2024-04-18 16:01:00 | Comment effectuer une analyse statique avancée dans un sable de logiciels malveillants How to Conduct Advanced Static Analysis in a Malware Sandbox (lien direct) |
Les bacs à sable sont synonymes d'analyse dynamique de logiciels malveillants.Ils aident à exécuter des fichiers malveillants dans un environnement virtuel sûr et à observer leur comportement.Cependant, ils offrent également beaucoup de valeur en termes d'analyse statique.Voir ces cinq scénarios où un bac à sable peut s'avérer être un outil utile dans vos enquêtes.
Détecter les menaces dans les PDF
Les fichiers PDF sont fréquemment exploités par les acteurs de la menace
Sandboxes are synonymous with dynamic malware analysis. They help to execute malicious files in a safe virtual environment and observe their behavior. However, they also offer plenty of value in terms of static analysis. See these five scenarios where a sandbox can prove to be a useful tool in your investigations. Detecting Threats in PDFs PDF files are frequently exploited by threat actors to |
Malware Tool Threat | ★★★ | |
|
2024-04-18 13:55:56 | Google AD imite le marché des baleines pour pousser les logiciels malveillants de drainage du portefeuille Google ad impersonates Whales Market to push wallet drainer malware (lien direct) |
Une publicité de recherche Google à l'aspect légitime pour la plate-forme de trading crypto \\ 'baleines du marché \' redirige les visiteurs vers un site de phishing drainant le portefeuille qui vole tous vos actifs.[...]
A legitimate-looking Google Search advertisement for the crypto trading platform \'Whales Market\' redirects visitors to a wallet-draining phishing site that steals all of your assets. [...] |
Malware | ★★ | |
 |
2024-04-18 10:00:07 | La campagne Dunequixote cible les entités du Moyen-Orient avec des logiciels malveillants «CR4T» DuneQuixote campaign targets Middle Eastern entities with “CR4T” malware (lien direct) |
De nouvelles entités de ciblage de la campagne Dunequixote non attribuée au Moyen-Orient emploient des gouttes déguisés en installateur total commandant et de la porte dérobée CR4T en C et GO.
New unattributed DuneQuixote campaign targeting entities in the Middle East employs droppers disguised as Total Commander installer and CR4T backdoor in C and Go. |
Malware | ★★★ | |
|
2024-04-18 08:29:53 | Sneaky Shellcode: les fibres Windows offrent une exécution du code anti-EDR Sneaky Shellcode: Windows Fibers Offer EDR-Proof Code Execution (lien direct) |
Deux nouvelles techniques d'exécution de code, Foison Fibre et Phantom Thread, profitent d'un cheval de bataille Windows OS peu connu pour faufiler Shellcode et d'autres logiciels malveillants sur les machines victimes.
Two new code-execution techniques, Poison Fiber and Phantom Thread, take advantage of a little-known Windows OS workhorse to sneak shellcode and other malware onto victim machines. |
Malware | ★★★ | |
|
2024-04-18 07:46:32 | Analyse du rat nautique utilisé dans les attaques contre les systèmes Linux Analysis of Pupy RAT Used in Attacks Against Linux Systems (lien direct) |
Pupy est une souche malveillante de rat qui offre un soutien à la plate-forme croisée.Parce qu'il s'agit d'un programme open-source publié sur GitHub, il est continuellement utilisé par divers acteurs de menace, y compris des groupes APT.Par exemple, il est connu pour avoir été utilisé par APT35 (qui aurait des liens avec l'Iran) [1] et a également été utilisé dans l'opération Earth Berberoka [2] qui ciblait les sites de jeux en ligne.Récemment, une souche de logiciels malveillante nommée Disy Dog a été découverte, qui est une version mise à jour de Pupy Rat ....
Pupy is a RAT malware strain that offers cross-platform support. Because it is an open-source program published on GitHub, it is continuously being used by various threat actors including APT groups. For example, it is known to have been used by APT35 (said to have ties to Iran) [1] and was also used in Operation Earth Berberoka [2] which targeted online gambling websites. Recently, a malware strain named Decoy Dog was discovered, which is an updated version of Pupy RAT.... |
Malware Threat | APT 35 | ★★ |
|
2024-04-17 20:31:30 | Dangereux ICS Maleware cible les organisations en Russie et en Ukraine Dangerous ICS Malware Targets Orgs in Russia and Ukraine (lien direct) |
"Kapeka" et "Fuxnext" sont les derniers exemples de logiciels malveillants à émerger du conflit de longue date entre les deux pays.
"Kapeka" and "Fuxnext" are the latest examples of malware to emerge from the long-standing conflict between the two countries. |
Malware Industrial | ★★★★ | |
|
2024-04-17 19:02:00 | Russian APT déploie de nouveaux \\ 'Kapeka \\' Backdoor dans les attaques d'Europe de l'Est Russian APT Deploys New \\'Kapeka\\' Backdoor in Eastern European Attacks (lien direct) |
Une porte dérobée "flexible" sans documentation, sans documentation, appelée & nbsp; kapeka & nbsp; a été "sporadiquement" observée dans les cyberattaques ciblant l'Europe de l'Est, notamment l'Estonie et l'Ukraine, depuis au moins au milieu de 2022.
Les résultats proviennent de la société de cybersécurité finlandaise avec Sésence, qui a attribué le groupe de logiciels malveillants au groupe avancé de menace persistante avancée (APT) suivi comme & nbsp; Sandworm & nbsp; (AKA APT44 ou
A previously undocumented "flexible" backdoor called Kapeka has been "sporadically" observed in cyber attacks targeting Eastern Europe, including Estonia and Ukraine, since at least mid-2022. The findings come from Finnish cybersecurity firm WithSecure, which attributed the malware to the Russia-linked advanced persistent threat (APT) group tracked as Sandworm (aka APT44 or |
Malware Threat | ★★★ | |
|
2024-04-17 19:00:00 | KAPEKA: Une nouvelle porte dérobée dans Sandworm \\'s Arsenal d'agression Kapeka: A New Backdoor in Sandworm\\'s Arsenal of Aggression (lien direct) |
> Kapeka est une nouvelle porte dérobée qui peut être un nouvel ajout à l'arsenal de logiciels malveillants de la Russie-Link \\ et peut-être un successeur de Greyenergy.
>Kapeka is a new backdoor that may be a new addition to Russia-link Sandworm\'s malware arsenal and possibly a successor to GreyEnergy. |
Malware | ★★ | |
 |
2024-04-17 18:00:31 | Réduire le désabonnement d'incitation avec une composition de modèle explosive Reducing Prompting Churn with Exploding Template Composition (lien direct) |
Engineering Insights is an ongoing blog series that gives a behind-the-scenes look into the technical challenges, lessons and advances that help our customers protect people and defend data every day. Each post is a firsthand account by one of our engineers about the process that led up to a Proofpoint innovation. In the nascent world of large language models (LLMs), prompt engineering has emerged as a critical discipline. However, as LLM applications expand, it is becoming a more complex challenge to manage and maintain a library of related prompts. At Proofpoint, we developed Exploding Prompts to manage the complexity through exploding template composition. We first created the prompts to generate soft labels for our data across a multitude of models and labeling concerns. But Exploding Prompts has also enabled use cases for LLMs that were previously locked away because managing the prompt lifecycle is so complex. Recently, we\'ve seen exciting progress in the field of automated prompt generation and black-box prompt optimization through DSPy. Black-box optimization requires hand-labeled data to generate prompts automatically-a luxury that\'s not always an option. You can use Exploding Prompts to generate labels for unlabeled data, as well as for any prompt-tuning application without a clear (or tractable) objective for optimization. In the future, Exploding Prompts could be used with DSPy to achieve a human-in-the-loop feedback cycle. We are also thrilled to announce that Exploding Prompts is now an open-source release. We encourage you to explore the code and consider how you might help make it even better. The challenge: managing complexity in prompt engineering Prompt engineering is not just about crafting queries that guide intelligent systems to generate the desired outputs; it\'s about doing it at scale. As developers push the boundaries of what is possible with LLMs, the need to manage a vast array of prompts efficiently becomes more pressing. Traditional methods often need manual adjustments and updates across numerous templates, which is a process that\'s both time-consuming and error-prone. To understand this problem, just consider the following scenario. You need to label a large quantity of data. You have multiple labels that can apply to each piece of data. And each label requires its own prompt template. You timebox your work and find a prompt template that achieves desirable results for your first label. Happily, most of the template is reusable. So, for the next label, you copy-paste the template and change the portion of the prompt that is specific to the label itself. You continue doing this until you figure out the section of the template that has persisted through each version of your labels can be improved. Now you now face the task of iterating through potentially dozens of templates to make a minor update to each of the files. Once you finish, your artificial intelligence (AI) provider releases a new model that outperforms your current model. But there\'s a catch. The new model requires another small update to each of your templates. To your chagrin, the task of managing the lifecycle of your templates soon takes up most of your time. The solution: exploding prompts from automated dependency graphs Prompt templating is a popular way to manage complexity. Exploding Prompts builds on prompt templating by introducing an “explode” operation. This allows a few single-purpose templates to explode into a multitude of prompts. This is accomplished by building dependency graphs automatically from the directory structure and the content of prompt template files. At its core, Exploding Prompts embodies the “write it once” philosophy. It ensures that every change made in a template correlates with a single update in one file. This enhances efficiency and consistency, as updates automatically propagate across all relevant generated prompts. This separation ensures that updates can be made with speed and efficiency so you can focus on innovation rather th | Malware Tool Threat Studies Cloud Technical | ★★★ | |
|
2024-04-17 17:38:28 | Soumnibot Malware exploite les bogues Android pour échapper à la détection SoumniBot malware exploits Android bugs to evade detection (lien direct) |
Un nouveau logiciel malveillant bancaire Android nommé \\ 'Soumnibot \' utilise une approche d'obscurcation moins courante en exploitant les faiblesses dans la procédure d'extraction et d'analyse manifeste Android.[...]
A new Android banking malware named \'SoumniBot\' is using a less common obfuscation approach by exploiting weaknesses in the Android manifest extraction and parsing procedure. [...] |
Malware Mobile | ★★ | |
 |
2024-04-17 12:00:00 | Les logiciels malveillants de décennie hante la police ukrainienne Decade-old malware haunts Ukrainian police (lien direct) |
> Un virus datant de 2015 atteint toujours des cibles en Ukraine, montrant sa puissance durable.
>A virus dating to 2015 is still hitting targets in Ukraine, showing its enduring power. |
Malware Legislation | ★★ | |
|
2024-04-17 09:03:09 | Plusieurs botnets exploitant une faille TP-Link d'un an pour pirater des routeurs Multiple botnets exploiting one-year-old TP-Link flaw to hack routers (lien direct) |
Au moins six opérations distinctes de logiciels malveillants en botnet sont des routeurs TP-Link Archer AX21 (AX1800) vulnérables à un problème de sécurité d'injection de commande signalé et abordé l'année dernière.[...]
At least six distinct botnet malware operations are hunting for TP-Link Archer AX21 (AX1800) routers vulnerable to a command injection security issue reported and addressed last year. [...] |
Malware Hack | ★★ | |
 |
2024-04-17 07:06:27 | WithSecure annonce la découverte du malware Kapeka, un logiciel malveillant lié au groupe de menace étatique russe Sandworm (lien direct) | WithSecure annonce la découverte du malware Kapeka, un logiciel malveillant lié au groupe de menace étatique russe Sandworm Les lieux et le timing auxquels Kapeka a été repéré, ainsi que les liens possibles avec Sandworm, laissent penser que son développement et son utilisation sont liés à la guerre entre la Russie et l'Ukraine. - Malwares | Malware | ★★ | |
|
2024-04-16 19:09:00 | TA558 Hackers Armez des images pour les attaques de logiciels malveillants à grande échelle TA558 Hackers Weaponize Images for Wide-Scale Malware Attacks (lien direct) |
L'acteur de menace suivi comme & nbsp; TA558 & nbsp; a été observé en tirant la stéganographie comme une technique d'obscuscation pour fournir un large éventail de logiciels malveillants tels que l'agent Tesla, le formbook, Remcos Rat, Lokibot, Guloader, Snake Keylogger et Xworm, entre autres.
"Le groupe a utilisé beaucoup de stéganographie en envoyant des VBS, du code PowerShell, ainsi que des documents RTF avec un exploit intégré, à l'intérieur
The threat actor tracked as TA558 has been observed leveraging steganography as an obfuscation technique to deliver a wide range of malware such as Agent Tesla, FormBook, Remcos RAT, LokiBot, GuLoader, Snake Keylogger, and XWorm, among others. "The group made extensive use of steganography by sending VBSs, PowerShell code, as well as RTF documents with an embedded exploit, inside |
Malware Threat | ★★★ | |
 |
2024-04-16 18:00:00 | Couverture des menaces de netskope: ransomware de fourmis maléfique Netskope Threat Coverage: Evil Ant Ransomware (lien direct) |
> Résumé Netskope Threat Labs a récemment analysé une nouvelle souche de ransomware nommée Evil Ant.Evil Ant Ransomware est un logiciel malveillant basé sur Python compilé à l'aide de Pyinstaller qui cherche à crypter tous les fichiers stockés sur les dossiers personnels et les lecteurs externes de la victime.Cette souche de ransomware nécessite la continuité du traitement du chiffrement jusqu'à la récupération du fichier.Redémarrer, fermer ou mettre fin au [& # 8230;]
>Summary Netskope Threat Labs recently analyzed a new ransomware strain named Evil Ant. Evil Ant ransomware is a Python-based malware compiled using PyInstaller that looks to encrypt all files stored on the victim’s personal folders and external drives. This ransomware strain requires process continuity from encryption until file recovery. Rebooting, shutting down, or ending the […] |
Ransomware Malware Threat | ★★ | |
 |
2024-04-16 15:00:00 | Importation dangereuse: Sourceforge Patches Critical Code Vulnérabilité Dangerous Import: SourceForge Patches Critical Code Vulnerability (lien direct) |
Notre équipe de recherche sur la vulnérabilité a découvert une vulnérabilité critique de code dans Sourceforge, que les attaquants auraient pu utiliser pour empoisonner les fichiers déployés et répandre des logiciels malveillants à des millions d'utilisateurs.
Our Vulnerability Research team discovered a critical code vulnerability in SourceForge, which attackers could have used to poison deployed files and spread malware to millions of users. |
Malware Vulnerability | ★★ | |
|
2024-04-16 13:41:32 | La variante Lockbit 3.0 génère des logiciels malveillants personnalisés et autonomes LockBit 3.0 Variant Generates Custom, Self-Propagating Malware (lien direct) |
Les chercheurs de Kaspersky ont découvert la nouvelle variante après avoir répondu à un incident critique ciblant une organisation en Afrique de l'Ouest.
Kaspersky researchers discovered the new variant after responding to a critical incident targeting an organization in West Africa. |
Malware | ★★ | |
|
2024-04-16 13:03:00 | Créateurs de rats Hive et cerveau de cryptojacking de 3,5 millions de dollars arrêtés dans la répression mondiale Hive RAT Creators and $3.5M Cryptojacking Mastermind Arrested in Global Crackdown (lien direct) |
Deux individus ont été arrêtés en Australie et aux États-Unis dans le cadre d'un schéma présumé pour développer et distribuer un cheval de Troie à distance appelé Hive Rat (auparavant Firebird).
Le ministère américain de la Justice (DOJ) & NBSP; a déclaré & nbsp; le malware "a donné aux acheteurs de logiciels malveillants contrôler les ordinateurs des victimes et leur a permis d'accéder aux victimes \\ 'Private Communications, leurs informations d'identification de connexion et
Two individuals have been arrested in Australia and the U.S. in connection with an alleged scheme to develop and distribute a remote access trojan called Hive RAT (previously Firebird). The U.S. Justice Department (DoJ) said the malware "gave the malware purchasers control over victim computers and enabled them to access victims\' private communications, their login credentials, and |
Malware | ★★ | |
|
2024-04-16 06:00:54 | De l'ingénierie sociale aux abus DMARC: Ta427 \\'s Art of Information Gathering From Social Engineering to DMARC Abuse: TA427\\'s Art of Information Gathering (lien direct) |
Key takeaways TA427 regularly engages in benign conversation starter campaigns to establish contact with targets for long-term exchanges of information on topics of strategic importance to the North Korean regime. In addition to using specially crafted lure content, TA427 heavily leverages think tank and non-governmental organization-related personas to legitimize its emails and increase the chances that targets will engage with the threat actor. To craftily pose as its chosen personas, TA427 uses a few tactics including DMARC abuse in concert with free email addresses, typosquatting, and private email account spoofing. TA427 has also incorporated web beacons for initial reconnaissance of its targets, establishing basic information like that the email account is active. Overview Proofpoint researchers track numerous state-sponsored and state-aligned threat actors. TA427 (also known as Emerald Sleet, APT43, THALLIUM or Kimsuky), a Democratic People\'s Republic of Korea (DPRK or North Korea) aligned group working in support of the Reconnaissance General Bureau, is particularly prolific in email phishing campaigns targeting experts for insight into US and the Republic of Korea (ROK or South Korea) foreign policy. Since 2023, TA427 has directly solicited foreign policy experts for their opinions on nuclear disarmament, US-ROK policies, and sanction topics via benign conversation starting emails. In recent months, Proofpoint researchers have observed (Figure 1) a steady, and at times increasing, stream of this activity. While our researchers have consistently observed TA427 rely on social engineering tactics and regularly rotating its email infrastructure, in December 2023 the threat actor began to abuse lax Domain-based Message Authentication, Reporting and Conformance (DMARC) policies to spoof various personas and, in February 2024, began incorporating web beacons for target profiling. It is this initial engagement, and the tactics successfully leveraged by TA427, which this blog is focused on. Figure 1. Volume of TA427 phishing campaigns observed between January 2023 and March 2024. Social engineering TA427 is a savvy social engineering expert whose campaigns are likely in support of North Korea\'s strategic intelligence collection efforts on US and ROK foreign policy initiatives. Based on the targets identified and the information sought, it is believed that TA427\'s goal is to augment North Korean intelligence and inform its foreign policy negotiation tactics (example Figure 2). TA427 is known to engage its targets for extended periods of time through a series of benign conversations to build a rapport with targets that can occur over weeks to months. They do so by constantly rotating which aliases are used to engage with the targets on similar subject matter. Figure 2. Example of TA427 campaign focused on US policy during an election year. Using timely, relevant lure content (as seen in Figure 3) customized for each victim, and often spoofing individuals in the DPRK research space with whom the victim is familiar to encourage engagement, targets are often requested to share their thoughts on these topics via email or a formal research paper or article. Malware or credential harvesting are never directly sent to the targets without an exchange of multiple messages, and based on Proofpoint visibility, rarely utilized by the threat actor. It is possible that TA427 can fulfill its intelligence requirements by directly asking targets for their opinions or analysis rather than from an infection. Additionally, insight gained from the correspondence is likely used to improve targeting of the victim organization and establish rapport for later questions and engagement. Figure 3. Timeline of real-world events based on international press reporting, side-by-side with Proofpoint observed subject lures. Lure content often includes invitations to attend events about North Korean policies regarding international affairs, questions regarding topics such as how deterr | Malware Tool Threat Conference | APT 37 APT 43 | ★★ |
|
2024-04-15 16:31:28 | Les nouvelles attaques de Steganoamor utilisent la stéganographie pour cibler 320 organisations dans le monde entier New SteganoAmor attacks use steganography to target 320 orgs globally (lien direct) |
Une nouvelle campagne menée par le groupe de piratage TA558 cache du code malveillant à l'intérieur d'images en utilisant la stéganographie pour fournir divers outils de logiciels malveillants sur des systèmes ciblés.[...]
A new campaign conducted by the TA558 hacking group is concealing malicious code inside images using steganography to deliver various malware tools onto targeted systems. [...] |
Malware Tool | ★★ | |
|
2024-04-15 15:15:00 | Faits saillants hebdomadaires, 15 avril 2024 Weekly OSINT Highlights, 15 April 2024 (lien direct) |
## Snapshot Last week\'s OSINT reporting reveals a landscape of diverse cyber threats characterized by sophisticated attack tactics and adaptable threat actors. One key trend was the increasing use of artificial intelligence (AI) by cybercriminals, including AI-powered malvertising on social media platforms and suspected LLM-generated content in a malware campaign targeting German organizations. Additionally, several OSINT articles reported on the trend of exploiting popular platforms like YouTube and GitHub to distribute malware. Threat actors demonstrate a keen understanding of user behavior, leveraging enticing content and fake webpages to lure victims into downloading malicious payloads, highlighting the importance of proactive defense strategies to mitigate evolving threats effectively. ## Description 1. **[German Organizations Targeted with Rhadamanthys Malware](https://security.microsoft.com/intel-explorer/articles/119bde85):** Proofpoint identifies TA547 launching an email campaign targeting German organizations with Rhadamanthys malware, representing a shift in techniques for the threat actor. The campaign involves impersonating a German retail company in emails containing password-protected ZIP files containing LNK files triggering PowerShell scripts to load Rhadamanthys into memory, bypassing disk writing. The incorporation of suspected LLM-generated content into the attack chain provides insight into how threat actors are leveraging LLM-generated content in malware campaigns. 2. **[Russian-Language Cybercrime Operation Leveraging Fake Web3 Gaming Projects](https://security.microsoft.com/intel-explorer/articles/0cdc08b5):** The Insikt Group uncovers a large-scale Russian-language cybercrime operation distributing infostealer malware through fake Web3 gaming projects targeting both macOS and Windows users. Threat actors entice users with the potential for cryptocurrency earnings, distributing malware like Atomic macOS Stealer (AMOS), Stealc, Rhadamanthys, or RisePro upon visiting imitation Web3 gaming projects\' webpages. 3. **[AI-Powered Malvertising Campaigns on Social Media](https://security.microsoft.com/intel-explorer/articles/1e1b0868):** Bitdefender discusses the use of artificial intelligence (AI) by cybercriminals in malvertising campaigns on social media platforms, impersonating popular AI software to distribute stealers like Rilide, Vidar, IceRAT, and Nova Stealer. These campaigns target European users through fake AI software webpages on Facebook, organized by taking over existing accounts and boosting page popularity through engaging content. 4. **[Exploitation of YouTube Channels for Infostealer Distribution](https://security.microsoft.com/intel-explorer/articles/e9f5e219):** AhnLab identifies a trend where threat actors exploit YouTube channels to distribute Infostealers like Vidar and LummaC2, disguising them as cracked versions of legitimate software. Attackers hijack popular channels with hundreds of thousands of subscribers, distributing malicious links through video descriptions and comments, highlighting concerns about the potential reach and impact of distributed malware. 5. **[VenomRAT Distribution via Phishing Email with Malicious SVG Files](https://security.microsoft.com/intel-explorer/articles/98d69c76):** FortiGuard Labs reveals a threat actor distributing VenomRAT and other plugins through phishing emails containing malicious Scalable Vector Graphics (SVG) files. The email attachment downloads a ZIP file containing an obfuscated Batch file, subsequently loading VenomRAT using ScrubCrypt to maintain a connection with a command and control (C2) server and install plugins on victims\' environments. 6. **[Malware Distribution through GitHub Repositories Manipulation](https://security.microsoft.com/intel-explorer/articles/4d0ffb2c):** Checkmarx reports a cybercriminal attack campaign manipulating GitHub\'s search functionality to distribute malware through repositories. Attackers create repositories with popular names and topics, hiding malicious code withi | Ransomware Spam Malware Tool Threat Prediction | ★★ | |
|
2024-04-15 12:51:28 | Destructif ics malware \\ 'Fuxnet \\' utilisé par l'Ukraine contre l'infrastructure russe Destructive ICS Malware \\'Fuxnet\\' Used by Ukraine Against Russian Infrastructure (lien direct) |
ics malware Fuxnet prétendument utilisé par le groupe de blackjack ukrainien pour perturber les capteurs industriels et autres systèmes appartenant à une entreprise d'infrastructure de Moscou.
ICS malware Fuxnet allegedly used by Ukrainian Blackjack group to disrupt industrial sensors and other systems belonging to a Moscow infrastructure firm. |
Malware Industrial | ★★★ | |
 |
2024-04-15 01:58:06 | US House approuve FISA Renewal & # 8211;surveillance sans mandat et tout US House approves FISA renewal – warrantless surveillance and all (lien direct) |
plus: le fabricant de puces chinois Nexperia a attaqué;Une porte dérobée signée par Microsoft;CISA commence à scanner votre malware;et plus infosec en bref Le Congrès américain a presque tué une réautorisation de la section 702 de la FISA la semaine dernière pour craindre qu'il continue de permettre la surveillance sans mandat des Américains, mais un amendement pour exiger unLe mandat n'a pas réussi.…
PLUS: Chinese chipmaker Nexperia attacked; A Microsoft-signed backdoor; CISA starts scanning your malware; and more Infosec in brief US Congress nearly killed a reauthorization of FISA Section 702 last week over concerns that it would continue to allow warrantless surveillance of Americans, but an amendment to require a warrant failed to pass.… |
Malware | ★★ | |
|
2024-04-15 01:12:41 | Package «totalement inattendu» Packware à l'aide du plug-in Modified Notepad ++ (Wikiloader) “Totally Unexpected” Package Malware Using Modified Notepad++ Plug-in (WikiLoader) (lien direct) |
Ahnlab Security Intelligence Center (ASEC) a récemment identifié la distribution d'une version modifiée de & # 8220;mimetools.dll & # 8221;, un plug-in.Le fichier malveillant mimetools.dll en question a été inclus dans le fichier d'installation du package d'une certaine version du package Notepad ++ et déguisé en fichier de package légitime.Comme indiqué dans l'image ci-dessous, MiMetools est un module pour effectuer un codage Base64 et d'autres tâches.Il est inclus par défaut et ne nécessite pas que l'utilisateur l'ajoute manuellement ....
AhnLab SEcurity intelligence Center (ASEC) has recently identified the distribution of a modified version of “mimeTools.dll”, a default Notepad++ plug-in. The malicious mimeTools.dll file in question was included in the package installation file of a certain version of the Notepad++ package and disguised as a legitimate package file. As shown in the image below, mimeTools is a module for conducting Base64 encoding and other tasks. It is included by default and does not require the user to add it manually.... |
Malware | ★★ | |
 |
2024-04-12 21:26:14 | Raspberry Robin – Le malware furtif qui esquive les antivirus (lien direct) | Raspberry Robin, un malware furtif, revient dans une nouvelle campagne en utilisant des fichiers WSF malveillants pour éviter la détection des antivirus et déployer diverses charges utiles dangereuses sur les systèmes Windows. | Malware | ★★ | |
|
2024-04-12 20:50:01 | La plate-forme d'analyse des logiciels malveillants de CISA \\ pourrait favoriser une meilleure menace Intel CISA\\'s Malware Analysis Platform Could Foster Better Threat Intel (lien direct) |
Mais la façon dont le gouvernement différencie sa plate-forme des options similaires du secteur privé reste à voir.
But just how the government differentiates its platform from similar private-sector options remains to be seen. |
Malware Threat | ★★ | |
|
2024-04-12 19:25:21 | GitHub a exploité dans des campagnes de distribution de logiciels malveillants grâce à la manipulation de recherche GitHub Exploited in Malware Distribution Campaigns through Search Manipulation (lien direct) |
## Instantané
CheckMarx rapporte une récente campagne d'attaque où les cybercriminels ont manipulé les fonctionnalités de recherche de GitHub \\ et ont utilisé des référentiels pour distribuer des logiciels malveillants.
## Description
Les attaquants ont créé des référentiels avec des noms et des sujets populaires, en utilisant des techniques telles que des mises à jour automatisées et en utilisant de faux comptes pour ajouter de faux stargazers aux projets pour augmenter les classements de recherche et tromper les utilisateurs.Le code malveillant a été caché dans les fichiers du projet Visual Studio pour échapper à la détection, exécutant automatiquement lorsque le projet est construit.Les attaquants ont également rembourré l'exécutable avec de nombreux zéros, une technique utilisée pour augmenter artificiellement la taille du fichier.
CheckMarx rapporte que le fichier exécutable rembourré partage des similitudes avec les logiciels malveillants "Keyzetsu Clipper", ciblant les portefeuilles de crypto-monnaie.Le logiciel malveillant établit une persistance sur les machines Windows infectées en créant une tâche planifiée qui exécute l'exécutable malveillant quotidiennement à 4 heures du matin sans confirmation de l'utilisateur.
## Recommandations
CheckMarx recommande pour empêcher la victime de la victime d'attaques similaires pour garder un œil sur les propriétés suspectes suivantes d'un repo:
1. Commissez la fréquence: le repo a-t-il un nombre extraordinaire de validations par rapport à son âge?Ces engagements modifient-ils le même fichier avec des modifications très mineures?
2. Stargazers: Qui met en vedette ce dépôt?La plupart des Stargazers semblent-ils avoir eu des comptes créés à peu près au même moment?
En étant conscients de ces drapeaux rouges, les utilisateurs peuvent mieux se protéger des téléchargements et exécuter par inadvertance des logiciels malveillants.
## Les références
[https://checkmarx.com/blog/new-technique-to-trick-develovers-detected-in-an-open-source-supply-chain-attattaque/#new_tab/ New-technique-to-trick-développateurs détecté dans une ouvrition d'ouvre-aventure-chain-attaque / # new_tab)
## Snapshot Checkmarx reports a recent attack campaign where cybercriminals manipulated GitHub\'s search functionality and used repositories to distribute malware. ## Description The attackers created repositories with popular names and topics, using techniques like automated updates and using fake accounts to add fake stargazers to projects to boost search rankings and deceive users. Malicious code was hidden within Visual Studio project files to evade detection, automatically executing when the project is built. The attackers also padded the executable with many zeros, a technique used to artificially boost the file size. Checkmarx reports the padded executable file shares similarities with the "Keyzetsu clipper" malware, targeting cryptocurrency wallets. The malware establishes persistence on infected Windows machines by creating a scheduled task that runs the malicious executable daily at 4AM without user confirmation. ## Recommendations Checkmarx reccomends to prevent falling victim to similar attacks to keep an eye on the following suspicious properties of a repo: 1. Commit frequency: Does the repo have an extraordinary number of commits relative to its age? Are these commits changing the same file with very minor changes? 2. Stargazers: Who is starring this repo? Do most of the stargazers appear to have had accounts created around the same time? By being aware of these red flags, users can better protect themselves from inadvertently downloading and executing malware. ## References [https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/#new_tab](https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attac |
Malware | ★★ | |
|
2024-04-12 18:11:30 | TA547 cible les organisations allemandes avec Rhadamanthys Stealer TA547 Targets German Organizations with Rhadamanthys Stealer (lien direct) |
#### Géolocations ciblées
- Allemagne
## Instantané
Proofpoint a identifié TA547 lancement d'une campagne de courriel ciblant les organisations allemandes avec Rhadamanthys malware, marquant la première utilisation connue de Rhadamanthys par cet acteur de menace.La campagne consistait à usurper l'identité d'une entreprise de vente au détail allemande dans des e-mails contenant des fichiers ZIP protégés par mot de passe prétendument liés aux factures, ciblant plusieurs industries en Allemagne.
## Description
Les fichiers zip contenaient des fichiers LNK qui, lorsqu'ils sont exécutés, ont déclenché un script PowerShell pour exécuter un script distant chargeant des Rhadamanthys en mémoire, en contournant l'écriture de disque.Le script PowerShell affichait des caractéristiques suggérant un contenu généré par la machine, potentiellement à partir de modèles de langues grands (LLM).
La récente campagne en Allemagne représente un changement dans les techniques de TA547, y compris l'utilisation de LNK comprimés et du voleur Rhadamanthys non observé auparavant.L'incorporation de contenu suspecté de LLM dans la chaîne d'attaque donne un aperçu de la façon dont les acteurs de la menace tirent parti du contenu généré par LLM dans les campagnes de logiciels malveillants, bien qu'il n'ait pas modifié la fonctionnalité ou l'efficacité du malware ou la façon dont les outils de sécurité ont défendu contre lui.
## Recommandations
[Consultez la rédaction de Microsoft \\ sur les voleurs d'informations ici.] (Https://sip.security.microsoft.com/intel-profiles/2296d491ea381b532b24f2575f9418d4b6723c17b8a1f507d20c2140a75d16d6)
[Consultez OSINT supplémentaire sur Rhadamanthys ici.] (Https://sip.security.microsoft.com/intel-explorer/articles/0131b256)
## Les références
[https://www.poolinpoint.com/us/blog/thereat-insight/security-brief-ta547-targets-geman-organizations-rhadamanthys-tealermenace-insight / sécurité-Brief-Ta547-Targets-German-Organisations-Rhadamanthys-Stealer)
#### Targeted Geolocations - Germany ## Snapshot Proofpoint has identified TA547 launching an email campaign targeting German organizations with Rhadamanthys malware, marking the first known use of Rhadamanthys by this threat actor. The campaign involved impersonating a German retail company in emails containing password-protected ZIP files purportedly related to invoices, targeting multiple industries in Germany. ## Description The ZIP files contained LNK files which, when executed, triggered a PowerShell script to run a remote script loading Rhadamanthys into memory, bypassing disk writing. The PowerShell script displayed characteristics suggestive of machine-generated content, potentially from large language models (LLMs). The recent campaign in Germany represents a shift in techniques for TA547, including the use of compressed LNKs and the previously unobserved Rhadamanthys stealer. The incorporation of suspected LLM-generated content into the attack chain provides insight into how threat actors are leveraging LLM-generated content in malware campaigns, although it did not change the functionality or efficacy of the malware or the way security tools defended against it. ## Recommendations [Check out Microsoft\'s write-up on information stealers here.](https://sip.security.microsoft.com/intel-profiles/2296d491ea381b532b24f2575f9418d4b6723c17b8a1f507d20c2140a75d16d6) [Check out additional OSINT on Rhadamanthys here.](https://sip.security.microsoft.com/intel-explorer/articles/0131b256) ## References [https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-organizations-rhadamanthys-stealer](https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-organizations-rhadamanthys-stealer) |
Malware Tool Threat | ★★ | |
 |
2024-04-12 14:05:06 | La visite exotique comprend des logiciels malveillants XploitSpy & # 8211;Semaine en sécurité avec Tony Anscombe eXotic Visit includes XploitSPY malware – Week in security with Tony Anscombe (lien direct) |
Près de 400 personnes en Inde et au Pakistan ont été victimes d'une campagne d'espionnage Android en cours appelée Exotic Visit
Almost 400 people in India and Pakistan have fallen victim to an ongoing Android espionage campaign called eXotic Visit |
Malware Mobile | ★★ | |
 |
2024-04-12 13:18:43 | Les militants des droits de l'homme du Sahara occidental sont ciblés par des logiciels malveillants mobiles Human rights activists in Western Sahara are being targeted by mobile malware (lien direct) |
Près de 400 personnes en Inde et au Pakistan ont été victimes d'une campagne d'espionnage Android en cours appelée Exotic Visit
Almost 400 people in India and Pakistan have fallen victim to an ongoing Android espionage campaign called eXotic Visit |
Malware Mobile | ★★★ | |
|
2024-04-12 10:39:00 | Écumoire de carte de crédit sournois déguisée en tracker Facebook inoffensif Sneaky Credit Card Skimmer Disguised as Harmless Facebook Tracker (lien direct) |
Les chercheurs en cybersécurité ont découvert un skimmer de la carte de crédit qui est caché dans un faux script de tracker Meta Pixel et NBSP; dans une tentative d'éliminer la détection.
SUCURI a déclaré que les logiciels malveillants sont injectés dans des sites Web via des outils qui permettent un code personnalisé, tels que des plugins WordPress comme & nbsp; Simple personnalisé CSS et JS et nbsp; ou la section "Scripts divers" du panneau d'administration Magento.
"
Cybersecurity researchers have discovered a credit card skimmer that\'s concealed within a fake Meta Pixel tracker script in an attempt to evade detection. Sucuri said that the malware is injected into websites through tools that allow for custom code, such as WordPress plugins like Simple Custom CSS and JS or the "Miscellaneous Scripts" section of the Magento admin panel. " |
Malware Tool | ★★★ | |
|
2024-04-12 09:55:57 | Les acteurs de la menace manipulent la recherche GitHub pour fournir des logiciels malveillants Threat Actors Manipulate GitHub Search to Deliver Malware (lien direct) |
> CheckMarx met en garde contre une nouvelle attaque en s'appuyant sur la manipulation de la recherche GitHub pour livrer du code malveillant.
>Checkmarx warns of a new attack relying on GitHub search manipulation to deliver malicious code. |
Malware Threat | ★★ | |
 |
2024-04-12 08:01:00 | Le groupe de menaces Fin7 cible l'industrie automobile américaine Threat Group FIN7 Targets the U.S. Automotive Industry (lien direct) |
Les analystes de BlackBerry ont identifié une campagne de phisces de lance du groupe de menaces FIN7 qui ciblait un grand constructeur automobile basé aux États-Unis.FIN7 a utilisé le leurre d'un outil de numérisation IP gratuit pour exécuter des logiciels malveillants et prendre pied initial.
BlackBerry analysts have identified a spear-phishing campaign by threat group FIN7 that targeted a large automotive manufacturer based in the United States. FIN7 used the lure of a free IP scanning tool to run malware and gain an initial foothold. |
Malware Tool Threat | ★★ | |
|
2024-04-12 06:00:03 | Arrêt de cybersécurité du mois: vaincre les attaques de création d'applications malveillantes Cybersecurity Stop of the Month: Defeating Malicious Application Creation Attacks (lien direct) |
This blog post is part of a monthly series, Cybersecurity Stop of the Month, which explores the ever-evolving tactics of today\'s cybercriminals. It focuses on the critical first three steps in the attack chain in the context of email threats. The goal of this series is to help you understand how to fortify your defenses to protect people and defend data against emerging threats in today\'s dynamic threat landscape. The critical first three steps of the attack chain-reconnaissance, initial compromise and persistence. So far in this series, we have examined these types of attacks: Supplier compromise EvilProxy SocGholish eSignature phishing QR code phishing Telephone-oriented attack delivery (TOAD) Payroll diversion MFA manipulation Supply chain compromise Multilayered malicious QR code attack In this post, we examine an emerging threat-the use of malicious cloud applications created within compromised cloud tenants following account takeover. We refer to it as MACT, for short. Background Cloud account takeover (ATO) attacks are a well-known risk. Research by Proofpoint found that last year more than 96% of businesses were actively targeted by these attacks and about 60% had at least one incident. Financial damages reached an all-time high. These findings are unsettling. But there is more for businesses to worry about. Cybercriminals and state-sponsored entities are rapidly adopting advanced post-ATO techniques. And they have embraced the use of malicious and abused OAuth apps. In January 2024, Microsoft revealed that a nation-state attacker had compromised its cloud environments and stolen valuable data. This attack was attributed to TA421 (aka Midnight Blizzard and APT29), which are threat groups that have been attributed to Russia\'s Foreign Intelligence Service (SVR). Attackers exploited existing OAuth apps and created new ones within hijacked cloud tenants. After the incident, CISA issued a new advisory for businesses that rely on cloud infrastructures. Proofpoint threat researchers observed attackers pivoting to the use of OAuth apps from compromised-and often verified-cloud tenants. Threat actors take advantage of the trust that\'s associated with verified or recognized identities to spread cloud malware threats as well as establish persistent access to sensitive resources. The scenario Proofpoint monitors a malicious campaign named MACT Campaign 1445. It combines a known tactic used by cloud ATO attackers with new tactics, techniques and procedures. So far, it has affected dozens of businesses and users. In this campaign, attackers use hijacked user accounts to create malicious internal apps. In tandem, they also conduct reconnaissance, exfiltrate data and launch additional attacks. Attackers use a unique anomalous URL for the malicious OAuth apps\' reply URL-a local loopback with port 7823. This port is used for TCP traffic. It is also associated with a known Windows Remote Access Trojan (RAT). Recently, Proofpoint researchers found four accounts at a large company in the hospitality industry compromised by attackers. In a matter of days, attackers used these accounts to create four distinct malicious OAuth apps. The threat: How did the attack happen? Here is a closer look at how the attack unfolded. Initial access vectors. Attackers used a reverse proxy toolkit to target cloud user accounts. They sent individualized phishing lures to these users, which enabled them to steal their credentials as well as multifactor authentication (MFA) tokens. A shared PDF file with an embedded phishing URL that attackers used to steal users\' credentials. Unauthorized access (cloud account takeover). Once attackers had stolen users\' credentials, they established unauthorized access to the four targeted accounts. They logged in to several native Microsoft 365 sign-in apps, including “Azure Portal” and “Office Home.” Cloud malware (post-access OAuth app creat | Spam Malware Tool Threat Cloud | APT 29 | ★★★ |
 |
2024-04-12 00:00:00 | Importance de la numérisation des fichiers sur les applications de téléchargeur Importance of Scanning Files on Uploader Applications (lien direct) |
Plongez dans la pratique cruciale de la numérisation des fichiers dans les applications du téléchargeur et apprenez des mesures défensives pour protéger les menaces malveillantes comme les logiciels malveillants.
Delve into the crucial practice of file scanning within uploader applications, and learn defensive measures to safeguards against malicious threats like malware. |
Malware | ★★ | |
|
2024-04-11 19:26:57 | La campagne cybercriminale propage les infostelleurs, mettant en évidence les risques pour le jeu Web3 Cybercriminal Campaign Spreads Infostealers, Highlighting Risks to Web3 Gaming (lien direct) |
## Instantané
Le groupe INSIKT a découvert une opération de cybercriminalité en langue russe à grande échelle qui tire parti de faux projets de jeu Web3 pour distribuer des logiciels malveillants infoséaler ciblant les utilisateurs de macOS et Windows.
## Description
Ces jeux Web3, basés sur la technologie de la blockchain, attirent les utilisateurs avec le potentiel de gains de crypto-monnaie.La campagne consiste à créer des projets de jeu d'imitation Web3 avec des modifications mineures pour paraître légitimes, ainsi que de faux comptes de médias sociaux pour améliorer leur crédibilité.Lors de la visite des principales pages Web de ces projets, les utilisateurs sont invités à télécharger des logiciels malveillants tels que le voleur atomique MacOS (AMOS), le Stealc, Rhadamanthys ou Risepro, selon leur système d'exploitation.Les acteurs de la menace ont établi une infrastructure résiliente et ciblent les joueurs Web3, exploitant leur manque potentiel d'hygiène de la cyber dans la poursuite de gains financiers.
Les variantes de logiciels malveillants, y compris AMOS, sont capables d'infecter à la fois Intel et Apple M1 Mac, indiquant une large vulnérabilité parmi les utilisateurs.L'objectif principal de la campagne semble être le vol de portefeuilles de crypto-monnaie, posant un risque important pour la sécurité financière.Les acteurs de la menace \\ 'Origine russe sont allumés par des artefacts dans le code HTML, bien que leur emplacement exact reste incertain.
## Les références
[https://www.recordedfuture.com/cybercriminal-campaign-spreads-infostealers-highlighting-risks-to-web3-gamingrisques-web3-gaming)
## Snapshot The Insikt Group has uncovered a large-scale Russian-language cybercrime operation that leverages fake Web3 gaming projects to distribute infostealer malware targeting both macOS and Windows users. ## Description These Web3 games, based on blockchain technology, entice users with the potential for cryptocurrency earnings. The campaign involves creating imitation Web3 gaming projects with minor modifications to appear legitimate, along with fake social media accounts to enhance their credibility. Upon visiting the main webpages of these projects, users are prompted to download malware such as Atomic macOS Stealer (AMOS), Stealc, Rhadamanthys, or RisePro, depending on their operating system. The threat actors have established a resilient infrastructure and are targeting Web3 gamers, exploiting their potential lack of cyber hygiene in pursuit of financial gains. The malware variants, including AMOS, are capable of infecting both Intel and Apple M1 Macs, indicating a broad vulnerability among users. The primary objective of the campaign appears to be the theft of cryptocurrency wallets, posing a significant risk to financial security. The threat actors\' Russian origin is hinted at by artifacts within the HTML code, although their exact location remains uncertain. ## References [https://www.recordedfuture.com/cybercriminal-campaign-spreads-infostealers-highlighting-risks-to-web3-gaming](https://www.recordedfuture.com/cybercriminal-campaign-spreads-infostealers-highlighting-risks-to-web3-gaming) |
Malware Vulnerability Threat | ★★★ | |
|
2024-04-11 18:27:13 | CISA rend le système d'analyse de la nouvelle génération "malware" accessible au public CISA makes its "Malware Next-Gen" analysis system publicly available (lien direct) |
L'Agence américaine de sécurité de la cybersécurité et de l'infrastructure (CISA) a publié une nouvelle version de "malware de Next-Gen", permettant désormais au public de soumettre des échantillons de logiciels malveillants pour analyse par CISA.[...]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a new version of "Malware Next-Gen," now allowing the public to submit malware samples for analysis by CISA. [...] |
Malware | ★★ | |
|
2024-04-11 18:22:12 | Le service redis expiré a maltraité pour utiliser Metasploit Meterpreter malicieusement Expired Redis Service Abused to Use Metasploit Meterpreter Maliciously (lien direct) |
Les attaquants ont compromis une version de 8 ans de la plate-forme cloud pour distribuer divers logiciels malveillants qui peuvent reprendre les systèmes infectés.
Attackers have compromised an 8-year-old version of the cloud platform to distribute various malware that can take over infected systems. |
Malware Cloud | ★★★ | |
 |
2024-04-11 16:37:18 | HP Détails Evolution du malware de Raspberry Robin, décalage dans la méthode de distribution et le paysage des menaces HP details evolution of Raspberry Robin malware, shift in distribution method and threat landscape (lien direct) |
Les chercheurs de l'équipe de recherche sur les menaces HP ont observé un changement dans la méthode de distribution de Raspberry Robin ...
Researchers from the HP Threat Research team have observed a shift in the distribution method of Raspberry Robin... |
Malware Threat | ★★ | |
|
2024-04-11 13:27:54 | Revisiter MACT: Applications malveillantes dans des locataires cloud crédibles Revisiting MACT: Malicious Applications in Credible Cloud Tenants (lien direct) |
For years, the Proofpoint Cloud Research team has been particularly focused on the constantly changing landscape of cloud malware threats. While precise future predictions remain elusive, a retrospective examination of 2023 enabled us to discern significant shifts and trends in threat actors\' behaviors, thereby informing our projections for the developments expected in 2024. There is no doubt that one of the major, and most concerning, trends observed in 2023 was the increased adoption of malicious and abused OAuth applications by cybercriminals and state-sponsored actors. In January, Microsoft announced they, among other organizations, were targeted by a sophisticated nation-state attack. It seems that the significant impact of this attack, which was attributed to TA421 (AKA Midnight Blizzard and APT29), largely stemmed from the strategic exploitation of pre-existing OAuth applications, coupled with the creation of new malicious applications within compromised environments. Adding to a long list of data breaches, this incident emphasizes the inherent potential risk that users and organizations face when using inadequately protected cloud environments. Expanding on early insights shared in our 2021 blog, where we first explored the emerging phenomenon of application creation attacks and armed with extensive recent discoveries, we delve into the latest developments concerning this threat in our 2024 update. In this blog, we will: Define key fundamental terms pertinent to the realm of cloud malware and OAuth threats. Examine some of the current tactics, techniques, and procedures (TTPs) employed by threat actors as part of their account-takeover (ATO) kill chain. Provide specific IOCs related to recently detected threats and campaigns. Highlight effective strategies and solutions to help protect organizations and users against cloud malware threats. Basic terminology OAuth (Open Authorization) 2.0. OAuth is an open standard protocol that enables third-party applications to access a user\'s data without exposing credentials. It is widely used to facilitate secure authentication and authorization processes. Line-of-business (LOB) applications. LOB apps (also known as second-party apps) typically refer to applications created by a user within their cloud environment in order to support a specific purpose for the organization. Cloud malware. A term usually referring to malicious applications created, utilized and proliferated by threat actors. Malicious apps can be leveraged for various purposes, such as: mailbox access, file access, data exfiltration, internal reconnaissance, and maintaining persistent access to specific resources. MACT (Malicious Applications Created in Compromised Credible Tenants). A common technique wherein threat actors create new applications within hijacked environments, exploiting unauthorized access to compromised accounts to initiate additional attacks and establish a persistent foothold within impacted cloud tenants. Apphish. A term denoting the fusion of cloud apps-based malware with phishing tactics, mainly by utilizing OAuth 2.0 infrastructure to implement open redirection attacks. Targeted users could be taken to a designated phishing webpage upon clicking an app\'s consent link. Alternatively, redirection to a malicious webpage could follow authorizing or declining an application\'s consent request. Abused OAuth applications. Benign apps that are authorized or used by attackers, usually following a successful account takeover, to perform illegitimate activities. What we are seeing Already in 2020, we witnessed a rise in malicious OAuth applications targeting cloud users, with bad actors utilizing increasingly sophisticated methods such as application impersonation and diverse lures. In October 2022, Proofpoint researchers demonstrated how different threat actors capitalized on the global relevance of the COVID-19 pandemic to spread malware and phishing threats. Proofpoint has also seen this trend include the propagation of malicious OAuth applications seamlessly integ | Malware Threat Prediction Cloud | APT 29 | ★★★ |
 |
2024-04-11 09:40:00 | Game des acteurs de menace Recherche github pour répandre les logiciels malveillants Threat Actors Game GitHub Search to Spread Malware (lien direct) |
CheckMarx avertit la manipulation des résultats de la recherche GitHub conçue pour promouvoir les référentiels malveillants
Checkmarx warns of GitHub search result manipulation designed to promote malicious repositories |
Malware Threat | ★★★ |
To see everything:
Our RSS (filtrered)
