What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-06-07 22:28:02 | Le nouveau kit de phishing V3B cible les clients de 54 banques européennes New V3B phishing kit targets customers of 54 European banks (lien direct) |
#### Targeted Geolocations - Northern Europe - Western Europe - Southern Europe - Eastern Europe #### Targeted Industries - Financial Services ## Snapshot Cybercriminals are actively promoting a new phishing kit called \'V3B\' on Telegram, designed for mobile and desktop platforms, specifically targeting customers of 54 major financial institutions across Europe. One threat actor going by the alias "Vssrtje", launched operations in March 2023. The V3B phishing kit is priced between $130-$450 per month, offering advanced obfuscation, localization options, one time password (OTP)/TAN/2FA support, live chat with victims, and various evasion mechanisms. ## Description Resecurity researchers who discovered V3B note that its Telegram channel has over 1,250 members, suggesting rapid adoption in the cybercrime community. The kit employs heavily obfuscated JavaScript code on a custom CMS to avoid detection by anti-phishing and search engine bots. It includes professionally translated pages in multiple languages to facilitate multi-country phishing campaigns. V3B can intercept banking account credentials and credit card details. Stolen information is transmitted back to cybercriminals through the Telegram API. Notable features include real-time interaction with victims via a chat system which allows fraudsters to obtain OTPs via custom notifications. Additional notable features include QR code login jacking and support for PhotoTAN and Smart ID, enabling bypassing of advanced authentication technologies used by German and Swiss banks. According to Resecurity researchers, the kit\'s author regularly releases updates and new features to further evade detection. Phishing kits like V3B empower low-skilled threat actors to launch damaging attacks against unsuspecting bank customers. Law enforcement recently took down LabHost, one of the largest Phishing-as-a-Service (PhaaS) operations targeting U.S. and Canadian banks, resulting in the arrest of 37 individuals, including the original developer. ## Recommendations Recommendations to protect against phishing attacks Implement multifactor authentication (MFA) to mitigate credential theft from phishing attacks. MFA can be complemented with the following solutions and best practices to protect organizations: - Activate conditional access policies. [Conditional access](https://learn.microsoft.com/azure/active-directory/conditional-access/overview?ocid=magicti_ta_learndoc) policies are evaluated and enforced every time an attacker attempts to use a stolen session cookie. Organizations can protect themselves from attacks that leverage stolen credentials by activating policies regarding compliant devices or trusted IP address requirements. - Configure [continuous access evaluation](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-continuous-access-evaluation?ocid=magicti_ta_learndoc) in your tenant. - Invest in advanced anti-phishing solutions that monitor incoming emails and visited websites. [Microsoft Defender for Office](https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-security-center-mdo?ocid=magicti_ta_learndoc) 365 brings together incident and alert management across email, devices, and identities, centralizing investigations for threats in email. Organizations can leverage web browsers that automatically [identify and block malicious websites](https://learn.microsoft.com/deployedge/microsoft-edge-security-smartscreen?ocid=magicti_ta_learndoc), including those used in this phishing campaign. To build resilience against phishing attacks in general, organizations can use [anti-phishing policies](https://docs.microsoft.com/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=o365-worldwide "https://docs.microsoft.com/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=o365-worldwide") to enable mailbox intelligence settings, as well as configure impersonati | Threat Legislation Mobile | ★★★★ | |
|
2024-06-03 12:56:15 | Les efforts d'influence russe convergent les Jeux olympiques de Paris 2024 Russian Influence efforts converge on 2024 Paris Olympics Games (lien direct) |
## Snapshot In the summer of 2023, a curious set of videos crept into social media platforms. Telegram feeds that normally promoted pro-Kremlin narratives suddenly began promoting a film called “Olympics Has Fallen.” Users were encouraged to scan a QR code that directed them to a Telegram channel of the same name. Upon arriving at this channel, viewers encountered a feature-length film with a similar aesthetic and a play on the title of the American political action movie “Olympus Has Fallen,” released more than a decade earlier.(1) AI-generated audio impersonating the voice of film actor Tom Cruise narrated a strange, meandering script disparaging the International Olympic Committee\'s leadership. Nearly a year later and with less than 80 days until the opening of the 2024 Paris Olympic Games, the Microsoft Threat Analysis Center (MTAC) has observed a network of Russia-affiliated actors pursuing a range of malign influence campaigns against France, French President Emmanuel Marcon, the International Olympic Committee (IOC), and the Paris Games. These campaigns may forewarn coming online threats to this summer\'s international competition. ## Activity Overview ### Russia\'s long history of disparaging the Olympic Games Modern Russia, as well as its predecessor the Soviet Union, has a longstanding tradition of seeking to undermine the Olympic Games. If they cannot participate in or win the Games, then they seek to undercut, defame, and degrade the international competition in the minds of participants, spectators, and global audiences. The Soviet Union boycotted the 1984 Summer Games held in Los Angeles and sought to influence other countries to do the same. US State Department officials linked Soviet actors to a campaign that covertly distributed leaflets to Olympic committees in countries including Zimbabwe, Sri Lanka, and South Korea.(2) The leaflets claimed non-white competitors would be targeted by US extremists-a claim that follows a tried-and-true active measures strategy: using divisive social issues to sow discord among a target audience.(3) A recurring aspect of Russian malign influence is its ability to resurface themes at a later time in a different country. Remarkably, four decades later, we are witnessing similar claims of anticipated extremist violence emerging in the context of the Paris Games this summer. Separately, in 2016, Russian hackers penetrated the World Anti-Doping Agency and revealed private medical information about American athletes Serena Williams, Venus Williams, and Simone Biles.(4) Two years later, the “Olympic Destroyer” cyberattack against the 2018 Winter Olympics in Pyeongchang, South Korea, managed to take some of the Winter Games\' internal servers offline. The US Department of Justice charged two Russian GRU officers in connection to the hack in 2020.(5) The slow burn of Russian President Vladimir Putin and the Kremlin\'s displeasure with the IOC and the ability to participate in the Olympics-an event of longstanding pride to the Russian government-has intensified in recent years. In 2017, the IOC concluded extensive investigations into Russia\'s state-sponsored use of performance-enhancing drugs across several Olympic Games in 2017 which resulted in Russia being formally barred from participating in the 2018 Winter Games.(6) Last year, in 2023, the IOC confirmed that Russian citizens would be allowed to compete in Paris but only as neutral athletes prohibited from sporting the flag or colors of the Russian Federation.(7) Shortly after this decision, MTAC began detecting a range of foreign malign influence operations that continue today, and we suspect may intensify as the 2024 Paris Opening Ceremony approaches.(8) ### Old world tactics meet the age of AI Starting in June 2023, prolific Russian influence actors-which Microsoft tracks as Storm-1679 and Storm-1099-pivoted their operations to take aim at the 2024 Olympic Games and French President Emmanuel Macron. These ongoing Russian influence operations have two cent | Hack Tool Threat Legislation Medical | ★★★ | |
|
2024-05-22 16:31:26 | Grandoreiro Banking Trojan Resurfaces dans Global Campaign Grandoreiro Banking Trojan Resurfaces in Global Campaign (lien direct) |
## Instantané Depuis mars 2024, IBM X-Force a suivi des campagnes de phishing à grande échelle distribuant le cheval de Troie bancaire Grandoreiro, considéré comme un logiciel malveillant en tant que service (MAAS). Lisez la rédaction de Microsoft \\ sur Grandoreiro [ici] (https://security.microsoft.com/intel-explorer/articles/f07d1d16). ## Description Grandoreiro a connu des mises à jour importantes, notamment le décryptage amélioré des chaînes et un nouvel algorithme générateur de domaine (DGA).Le malware exploite également les clients Microsoft Outlook sur les hôtes infectés pour diffuser des e-mails de phishing. Historiquement, les campagnes ont été principalement limitées à l'Amérique latine, à l'Espagne et au Portugal.Mais la dernière variante est conçue pour cibler spécifiquement plus de 1500 banques mondiales, permettant aux attaquants de commettre une fraude bancaire dans plus de 60 pays, élargissant la portée du malware à des régions comme l'Amérique centrale et du Sud, l'Afrique, l'Europe et l'Indo-Pacifique.Selon IBM, les logiciels malveillants évolués et le ciblage élargi peuvent être en réponse à des mesures d'application de la loi contre Grandoreiro. La chaîne d'infection de Grandoreiro \\ commence par un chargeur personnalisé, qui vérifie si la victime est une cible légitime et non un chercheur ou dans un bac à sable.Il rassemble des données de base de la victime, l'envoie au serveur de commandement et de contrôle (C2) et télécharge le Trojan.La variante récente du Malware \\ comprend un mécanisme de décryptage de chaîne retravaillé, en utilisant un processus complexe et en plusieurs étapes impliquant le cryptage Base64 et AES. Le Troie profil les victimes pour adapter les attaques, ciblant des applications bancaires spécifiques et des portefeuilles de crypto-monnaie.Son algorithme DGA avancé génère plusieurs domaines C2 quotidiennement, améliorant sa résilience.Grandoreiro peut exécuter un large éventail de commandes, de la télécommande et de la gestion des fichiers aux campagnes de spam de keylogging et d'Outlook.Cette capacité à envoyer des e-mails de phishing des clients Infected Outlook contribue à sa propagation. ## Microsoft Intelligence En plus de suivre l'activité de Grandoreiro en Europe, en Afrique et en Amérique latine, Microsoft Threat Intelligence a observé un ciblage de Grandoreiro aux États-Unis. ## Détections ** Microsoft Defender Antivirus ** Microsoft Defender Antivirus détecte les composants de menace comme le FOLlowing malware: - * [Trojanspy: Win32 / Grandoreiro] (https://www.microsoft.com/en-us/wdsi/Threats/Malware-encyClopedia-Description?name=trojanspy:win32/grandoreiro& ;TheRatid=-2147235291) * - * [Trojan: Win32 / Grandoreiro] (https://www.microsoft.com/en-us/wdsi/Threats/Malware-encyClopedia-Description?name=trojan:win32/Grandoreiro.MBJr!Mtb& ;heterid=-2147060695) * - * [Trojandownloader: VBS / Grandoreiro] (https://www.microsoft.com/en-us/wdssi/Therets/Malware-encyClopedia-Description?name=trojandownOader:win32/grandoreiro.zy!SMS& ;Thereatid=-2147059024) * - * [Trojan: Win64 / Grandoreiro] (https://www.microsoft.com/en-us/wdsi/Therets/Malware-encyClopedia-dercription?name=trojan:win64/grandoreiro.psye!mtb& ;theatid=-2147128454)* - * [Comportement: win32 / Grandoreiro] (https://www.microsoft.com/en-us/wdsi/therets/malware-encycopedia-dercription?name=behavior:win32/grandoreiro.f & menaceId = -2147139055) * - * [Spyware: win32 / Grandoreiro] (https://www.microsoft.com/en-us/wdsi/Threats/Malware-encycopedia-dercription?naME = Spyware: Win32 / Grandoreiro! Mclg & menaceID = 325649) * ** Microsoft Defender pour le point de terminaison ** Les alertes avec les titres suivants dans le centre de sécurité peuvent indiquer une activité de menace sur votre réseau: - * Activité possible de Grandoreiro * ## Recommandations Microsoft recommande les atténuations sui | Spam Malware Tool Threat Legislation | ★★ | |
|
2024-03-06 01:05:06 | Faits saillants hebdomadaires d'osint, 4 mars 2024 Weekly OSINT Highlights, 4 March 2024 (lien direct) |
## Weekly OSINT Highlights, 4 March 2024 Ransomware loomed large in cyber security research news this week, with our curated OSINT featuring research on Abyss Locker, BlackCat, and Phobos. Phishing attacks, information stealers, and spyware are also in the mix, highlighting the notable diversity in the cyber threat landscape. The OSINT reporting this week showcases the evolving tactics of threat actors, with operators increasingly employing multifaceted strategies across different operating systems. Further, the targets of these attacks span a wide range, from civil society figures targeted by spyware in the Middle East and North Africa to state and local governments victimized by ransomware. The prevalence of attacks on sectors like healthcare underscores the significant impact on critical infrastructure and the potential for substantial financial gain through ransom payments. 1. [**Abyss Locker Ransomware Evolution and Tactics**](https://ti.defender.microsoft.com/articles/fc80abff): Abyss Locker ransomware, derived from HelloKitty, exfiltrates victim data before encryption and targets Windows systems, with a subsequent Linux variant observed. Its capabilities include deleting backups and employing different tactics for virtual machines, indicating a growing sophistication in ransomware attacks. 2. [**ALPHV Blackcat Ransomware-as-a-Service (RaaS)**:](https://ti.defender.microsoft.com/articles/b85e83eb) The FBI and CISA warn of ALPHV Blackcat RaaS, which targets multiple sectors, particularly healthcare. Recent updates to ALPHV Blackcat include improved defense evasion, encryption capabilities for Windows and Linux, reflecting the increasing sophistication in ransomware operations. 3. [**Phobos RaaS Model**](https://ti.defender.microsoft.com/articles/ad1bfcb4): Phobos ransomware, operating as a RaaS model, frequently targets state and local governments. Its use of accessible open-source tools enhances its popularity among threat actors, emphasizing the ease of deployment and customization for various environments. 4. [**TimbreStealer Phishing Campaign**](https://ti.defender.microsoft.com/articles/b61544ba): Talos identifies a phishing campaign distributing TimbreStealer, an information stealer disguised as Mexican tax-related themes. The threat actor was previously associated with banking trojans, underscoring the adaptability and persistence of malicious actors. 5. [**Nood RAT Malware Features and Stealth**](https://ti.defender.microsoft.com/articles/cc509147): ASEC uncovers Nood RAT, a Linux-based variant of Gh0st RAT, equipped with encryption and disguised as legitimate software. The malware\'s flexibility in binary creation and process naming underscores the threat actor\'s intent to evade detection and carry out malicious activities with sophistication. 6. [**Predator Spyware Infrastructure and Targeting**](https://ti.defender.microsoft.com/articles/7287eb1b): The Insikt Group\'s discovery highlights the widespread use of Predator spyware, primarily targeting journalists, politicians, and activists in various countries. Despite its purported use for counterterrorism and law enforcement, Predator is employed by threat actors outside these contexts, posing significant privacy and safety risks. ## Learn More For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: [https://aka.ms/threatintelblog](https://aka.ms/threatintelblog) and the following blog posts: - [Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself](https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/?ocid=magicti_ta_blog#defending-against-ransomware) Microsoft customers can use the following reports in Microsoft Defender Threat Intelligence to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this summary. The following | Ransomware Spam Malware Tool Threat Legislation Medical | ★★★★ |
1
We have: 4 articles.
We have: 4 articles.
To see everything:
Our RSS (filtrered)
