What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-10-19 11:41:36 | Google Play Protect obtient une numérisation de code en temps réel Google Play Protect Gets Real-Time Code Scanning (lien direct) |
> Google améliore les appareils Android \\ 'Proactive Proactive Protections contre les logiciels malveillants avec une numérisation en temps réel au niveau du code.
>Google improves Android devices\' proactive protections against malware with real-time scanning at code level. |
Malware | ★★ | |
 |
2023-10-19 07:36:37 | Le rapport de menace par e-mail de VIPRE Security Group \\'s Q3 2023 révèle les PDF, le phishing de rappel et les logiciels malveillants via Google Drive en popularité parmi les criminels VIPRE Security Group\\'s Q3 2023 Email Threat Report Reveals PDFs, Callback Phishing and Malware Via Google Drive Growing in Popularity Among Criminals (lien direct) |
VIPRE SECURITY GROUP \'s Q3 2023 Le rapport de menace par e-mail révèle les PDF, le phishing de rappel et les logiciels malveillants via Google Drive en popularité parmi les criminels
-
rapports spéciaux
/ /
affiche
VIPRE Security Group\'s Q3 2023 Email Threat Report Reveals PDFs, Callback Phishing and Malware Via Google Drive Growing in Popularity Among Criminals - Special Reports / affiche |
Threat Malware Studies | ★★★★ | |
 |
2023-10-19 02:00:00 | Startup de sécurité AirGap Networks apporte des technologies de télécommunications au LAN Security startup Airgap Networks brings telco technologies to the LAN (lien direct) |
Les logiciels malveillants générateurs de l'AI, l'usurpation de faux identité profonde et les ransomwares parrainés par l'État ne sont que quelques-unes des dernières méthodes que les attaquants utilisent pour contourner les outils de cybersécurité traditionnels.Ritesh Agrawal, PDG de Cybersecurity Startup AirGap Networks, a remarqué que de nombreuses attaques qui compromettent les réseaux d'entreprise ne parviennent pas à pénétrer les réseaux de télécommunications et de prestataires de services. «Même s'ils déploient les mêmes routeurs, les mêmes routeurs, les commutateurs, et des pare-feu, il y a quelque chose de fondamentalement différent dans les réseaux de télécommunications qui les protègent de nombreuses menaces pour les Lans d'entreprise », a déclaré Argawal.Agrawal a 20 ans d'expérience avec la cybersécurité, le réseautage d'entreprise et le cloud computing, la plupart du temps passé avec les réseaux de genévriers en se concentrant sur les télécommunications et les grands clients d'entreprise. Pour lire cet article en totalité, veuillez cliquer ici
AI-generating malware, deep fake identity spoofing, and state-sponsored ransomware are just a few of the latest methods that attackers are using to bypass traditional cybersecurity tools. Ritesh Agrawal, CEO of cybersecurity startup Airgap Networks, noticed that many of the attacks that compromise enterprise networks fail to penetrate telco and service provider networks.“Even though they\'re deploying the same routers, switches, and firewalls, there\'s something fundamentally different about telco networks that shields them from many threats to enterprise LANs,” Argawal said. Agrawal has 20 years of experience with cybersecurity, enterprise networking, and cloud computing, most of that time spent with Juniper Networks focusing on telco and large enterprise clients.To read this article in full, please click here |
Ransomware Malware Cloud Tool | ★★ | |
 |
2023-10-18 19:05:59 | Qubitsstrike malware frappe Jupyter Notebooks pour le cryptojacking et les données cloud Qubitstrike Malware Hits Jupyter Notebooks for Cryptojacking and Cloud Data (lien direct) |
> Par deeba ahmed
Qubitsstrike malware utilise la discorde pour les communications C2 dans la campagne de cryptojacking ciblant les cahiers de jupyter.
Ceci est un article de HackRead.com Lire la publication originale: Qubitsstrike malware frappe Jupyter Notebooks for Cryptojacking and Cloud Data
>By Deeba Ahmed Qubitstrike Malware Uses Discord for C2 Communications in Cryptojacking Campaign Targeting Jupyter Notebooks. This is a post from HackRead.com Read the original post: Qubitstrike Malware Hits Jupyter Notebooks for Cryptojacking and Cloud Data |
Malware Cloud | ★★ | |
 |
2023-10-18 18:32:18 | Android va désormais scanner les applications d'élevés de touche pour les logiciels malveillants à l'heure de l'installation Android will now scan sideloaded apps for malware at install time (lien direct) |
Les installations d'application d'élevés de touche peuvent être retardées par une interface de scanner virus plein écran.
Sideloaded app installs can be delayed by a fullscreen virus-scanner interface. |
Malware | ★★★ | |
 |
2023-10-18 18:30:05 | Le phishing attaque de 173% au troisième trimestre, 2023;Les menaces de logiciels malveillants montent sur 110% Phishing Attacks Surge By 173% In Q3, 2023; Malware Threats Soar By 110% (lien direct) |
Malware Studies | ★★★ | ||
 |
2023-10-18 18:26:28 | Netskope Threat Labs Stats for September 2023 (lien direct) | > Netskope Threat Labs publie un article de blog de résumé mensuel des principales menaces que nous suivons sur la plate-forme Netskope.Le but de cet article est de fournir des renseignements stratégiques et exploitables sur les menaces actives contre les utilisateurs d'entreprise du monde entier.Résumé Les téléchargements de logiciels malveillants de SharePoint ont doublé, causé par une campagne de logiciels malveillants de Darkgate qui attire les victimes de téléchargement [& # 8230;]
>Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. The purpose of this post is to provide strategic, actionable intelligence on active threats against enterprise users worldwide. Summary Malware downloads from SharePoint doubled, caused by a DarkGate malware campaign that lures victims into downloading […] |
Threat Malware Studies | ★★★★ | |
 |
2023-10-18 16:11:47 | Kimsuky de la Corée du Nord se double de la commande de bureau à distance North Korea\\'s Kimsuky Doubles Down on Remote Desktop Control (lien direct) |
L'APT sophistiqué utilise diverses tactiques pour abuser des fenêtres et d'autres protocoles intégrés avec des logiciels malveillants personnalisés et publics pour prendre le contrôle des systèmes de victimes.
The sophisticated APT employs various tactics to abuse Windows and other built-in protocols with both custom and public malware to take over victim systems. |
Malware | APT 43 | ★★ |
 |
2023-10-18 14:03:28 | La fausse arnaque de mise à jour du navigateur obtient une cure de jouvence The Fake Browser Update Scam Gets a Makeover (lien direct) |
L'une des astuces de logiciels malveillants les plus anciennes du livre - des sites Web piratés affirmant que les visiteurs doivent mettre à jour leur navigateur Web avant de pouvoir afficher n'importe quel contenu - a repris la vie au cours des derniers mois.De nouvelles recherches montrent que les attaquants derrière un tel schéma ont développé une façon ingénieuse de garder leurs logiciels malveillants à être abattus par des experts en sécurité ou des forces de l'ordre: en hébergeant les fichiers malveillants sur une blockchain de crypto-monnaie anonyme décentralisée.
One of the oldest malware tricks in the book -- hacked websites claiming visitors need to update their Web browser before they can view any content -- has roared back to life in the past few months. New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from being taken down by security experts or law enforcement: By hosting the malicious files on a decentralized, anonymous cryptocurrency blockchain. |
Malware | ★★ | |
 |
2023-10-18 12:00:27 | Google Play amélioré Protéger la numérisation en temps réel pour les installations d'applications Enhanced Google Play Protect real-time scanning for app installs (lien direct) |
Posted by Steve Kafka, Group Product Manager and Roman Kirillov, Senior Engineering Manager
Mobile devices have supercharged our modern lives, helping us do everything from purchasing goods in store and paying bills online to storing financial data, health records, passwords and pictures. According to Data.ai, the pandemic accelerated existing mobile habits – with app categories like finance growing 25% year-over-year and users spending over 100 billion hours in shopping apps. It\'s now even more important that data is protected so that bad actors can\'t access the information.
Powering up Google Play Protect
Google Play Protect is built-in, proactive protection against malware and unwanted software and is enabled on all Android devices with Google Play Services. Google Play Protect scans 125 billion apps daily to help protect you from malware and unwanted software. If it finds a potentially harmful app, Google Play Protect can take certain actions such as sending you a warning, preventing an app install, or disabling the app automatically.
To try and avoid detection by services like Play Protect, cybercriminals are using novel malicious apps available outside of Google Play to infect more devices with polymorphic malware, which can change its identifiable features. They\'re turning to social engineering to trick users into doing something dangerous, such as revealing confidential information or downloading a malicious app from ephemeral sources – most commonly via links to download malicious apps or downloads directly through messaging apps.
For this reason, Google Play Protect has always also offered users protection outside of Google Play. It checks your device for potentially harmful apps regardless of the install source when you\'re online or offline as well. Previously, when installing an app, Play Protect conducted a real-time check and warned users when it identified an app known to be malicious from existing scanning intelligence or was identified as suspicious from our on-device machine learning, similarity comparisons, and other techniques that we are always evolving.
Today, we are making Google Play Protect\'s security capabilities even more powerful with real-time scanning at the code-level to combat novel malicious apps. Google Play Protect will now recommend a real-time app scan when installing apps that have never been scanned before to help detect emerging threats.
Scanning will extract important signals from the app and send them to the Play Protect backend infrastructure for a code-level evaluation. Once the real-time analysis is complete, users will get a result letting them know if the app looks safe to install or if the scan determined the app is potentially harmful. This enhancement will help better protect users against malicious polymorphic apps that leverage various methods, such as AI, to be altered to avoid detection.
Our security protections and machine learning algorithms learn from each app |
Spam Malware | ★★ | |
 |
2023-10-18 12:00:00 | Google Play Protect ajoute une numérisation en temps réel pour lutter contre les logiciels malveillants Android Google Play Protect adds real-time scanning to fight Android malware (lien direct) |
Google a annoncé de nouvelles fonctionnalités de numérisation en temps réel pour Google Play Protect qui rend plus difficile pour les applications malveillantes en utilisant le polymorphisme pour échapper à la détection.[...]
Google has announced new, real-time scanning features for Google Play Protect that make it harder for malicious apps employing polymorphism to evade detection. [...] |
Malware | ★★ | |
|
2023-10-18 11:17:34 | Mata Malware Framework exploite EDR dans les attaques contre les entreprises de défense MATA malware framework exploits EDR in attacks on defense firms (lien direct) |
Une version mise à jour du cadre de porte dérobée MATA a été repérée dans les attaques entre août 2022 et mai 2023, ciblant les entreprises pétrolières et gazières et l'industrie de la défense en Europe de l'Est.[...]
An updated version of the MATA backdoor framework was spotted in attacks between August 2022 and May 2023, targeting oil and gas firms and the defense industry in Eastern Europe. [...] |
Malware | ★★ | |
|
2023-10-18 10:02:04 | Signe unique et l'écosystème de la cybercriminalité Single Sign On and the Cybercrime Ecosystem (lien direct) |
L'une des tendances stimulant une augmentation est le compromis des applications de connexion unique en entreprise (SSO) sont les attaques malveillantes du voleur d'informations.En savoir plus sur Flare sur cet écosystème de cybercriminalité.[...]
One of the trends driving an increase is the compromise of enterprise single sign on (SSO) applications are info-stealer malware attacks. Learn more from Flare about this cybercrime ecosystem. [...] |
Malware | ★★ | |
 |
2023-10-18 10:00:51 | MATA MATA attaque les sociétés industrielles en Europe de l'Est Updated MATA attacks industrial companies in Eastern Europe (lien direct) |
Début septembre 2022, nous avons découvert plusieurs nouveaux échantillons de logiciels malveillants appartenant au cluster MATA.La campagne avait été lancée à la mi-août 2022 et ciblée sur une douzaine de sociétés en Europe de l'Est du secteur pétrolier et gazier et de l'industrie de la défense.
In early September 2022, we discovered several new malware samples belonging to the MATA cluster. The campaign had been launched in mid-August 2022 and targeted over a dozen corporations in Eastern Europe from the oil and gas sector and defense industry. |
Malware Industrial | ★★★ | |
 |
2023-10-18 09:15:08 | Les escrocs malveillants trouvent une mise à jour de fausses navigateurs, au cas où les vrais ne seraient pas assez mauvais Malware crooks find an in with fake browser updates, in case real ones weren\\'t bad enough (lien direct) |
Les chercheurs disent que le ransomware pourrait être à l'horizon si le succès se poursuit Une augmentation des cybercriminels masquant les téléchargements malveillants car de fausses mises à jour du navigateur sont repérées par des chercheurs en sécurité.…
Researchers say ransomware could be on the horizon if success continues An uptick in cybercriminals masking malicious downloads as fake browser updates is being spotted by security researchers.… |
Ransomware Malware | ★★ | |
|
2023-10-18 06:00:00 | Qubitstrike attaque les serveurs Linux Jupyter Linux pour voler des informations d'identification Qubitstrike attacks rootkit Jupyter Linux servers to steal credentials (lien direct) |
Les pirates scannent pour des cahiers de jupyter exposés à Internet pour violer les serveurs et déployer un cocktail de logiciels malveillants composé d'un linux rootkit, de mineurs cryptographiques et de scripts de vol de mot de passe.[...]
Hackers are scanning for internet-exposed Jupyter Notebooks to breach servers and deploy a cocktail of malware consisting of a Linux rootkit, crypto miners, and password-stealing scripts. [...] |
Malware | ★ | |
|
2023-10-18 05:55:43 | Où est parti le logiciel malveillant du document MS Office? Where Has the MS Office Document Malware Gone? (lien direct) |
InfostEllers, qui volent les informations d'identification du compte utilisateur enregistrées dans les navigateurs Web ou les clients de messagerie, constituent la majorité des attaques ciblées ciblant les ciblage des attaquesutilisateurs généraux ou d'entreprise.Les informations connexes ont été partagées via le blog ASEC en décembre de l'année dernière.[1] Bien que la méthode de distribution des logiciels malveillants nommés diffère légèrement en fonction de leurs principales caractéristiques, les logiciels malveillants de type infoséaler utilisent généralement des sites malveillants déguisés en pages pour télécharger des programmes légitimes comme voie de distribution.Ils sont également activement distribués via des pièces jointes de spam ou MS ...
Infostealers, which steal user account credentials saved in web browsers or email clients, constitute the majority of attacks targeting general or corporate users. Related information was shared through the ASEC Blog in December of last year. [1] While the distribution method for the named malware differs slightly depending on their main features, Infostealer-type malware typically uses malicious sites disguised as pages for downloading legitimate programs as their distribution route. They are also actively distributed through spam email attachments or MS... |
Spam Malware | ★★★ | |
 |
2023-10-17 20:14:06 | Le nouveau rapport NetSkope expose une utilisation croissante des applications cloud pour répandre les logiciels malveillants New Netskope Report Exposes Increasing Use of Cloud Apps to Spread Malware (lien direct) |
Microsoft OneDrive représente 26% de l'utilisation globale des applications de stockage cloud pour héberger des logiciels malveillants, devant Microsoft PowerPoint et GitHub.
Microsoft OneDrive accounts for 26% of the overall usage of cloud storage apps to host malware, ahead of Microsoft PowerPoint and GitHub. |
Malware Cloud Studies | ★★★★ | |
|
2023-10-17 16:34:38 | Attention: les attaquants cachent des logiciels malveillants dans les mises à jour du navigateur \\ '\\' Watch Out: Attackers Are Hiding Malware in \\'Browser Updates\\' (lien direct) |
La mise à jour de votre navigateur lorsque vous êtes invité est une bonne pratique, assurez-vous simplement que la notification vient du vendeur lui-même.
Updating your browser when prompted is a good practice, just make sure the notification comes from the vendor themselves. |
Malware | ★★ | |
 |
2023-10-17 16:21:48 | Watch Out: Attackers Are Hiding Malware in \'Browser Updates\' (lien direct) | La mise à jour de votre navigateur lorsque vous êtes invité est une bonne pratique, assurez-vous simplement que la notification vient du vendeur lui-même.
Updating your browser when prompted is a good practice, just make sure the notification comes from the vendor themselves. |
Malware | ★★ | |
 |
2023-10-17 15:30:00 | Fausses mises à jour du navigateur utilisées dans la distribution de logiciels malveillants Fake Browser Updates Used in Malware Distribution (lien direct) |
Proofpoint a identifié au moins quatre grappes de menaces distinctes
Proofpoint have identified at least four distinct threat clusters |
Threat Malware | ★★ | |
|
2023-10-17 15:09:01 | Amazon ajoute la prise en charge de Passkey comme une nouvelle option de connexion sans mot de passe Amazon adds passkey support as new passwordless login option (lien direct) |
Amazon a discrètement ajouté la prise en charge de Passkey en tant que nouvelle option de connexion sans mot de passe pour les clients, offrant une meilleure protection contre les logiciels malveillants et les attaques de phishing.[...]
Amazon has quietly added passkey support as a new passwordless login option for customers, offering better protection from information-stealing malware and phishing attacks. [...] |
Malware | ★★ | |
|
2023-10-17 11:54:11 | Spynote Android Malware se propage via de fausses alertes d'éruption du volcan SpyNote Android malware spreads via fake volcano eruption alerts (lien direct) |
Android Malware \\ 'Spynote \' a été vu dans une campagne axée sur l'Italie qui utilise un site Web de services de service d'alerte publique bidon \\ 'IT-ALERT \' pour infecter les visiteurs.[...]
Android malware \'SpyNote\' was seen in an Italy-focused campaign that uses a phony \'IT-alert\' public alert service website to infect visitors. [...] |
Malware | ★★ | |
|
2023-10-17 11:11:43 | Vulnérabilité de sécurité du système de vote électronique de Suisse \\ Security Vulnerability of Switzerland\\'s E-Voting System (lien direct) |
Le vote en ligne n'est pas en sécurité, point final.Cela n'empêche pas les organisations et les gouvernements de l'utiliser.(Et pour les élections à faible enjeux, il est probablement bien.Ed Appel explique pourquoi et c'est et c'est et c'est pourquoi et c'est# 8217; est une mauvaise idée:
L'année dernière, j'ai publié Une série en 5 parties sur le système de vote électronique de Suisse \\ .Comme tout système de vote sur Internet, il a des vulnérabilités de sécurité inhérentes: s'il y a des initiés malveillants, ils peuvent corrompre le nombre de votes;Et si des milliers d'ordinateurs d'électeurs sont piratés par des logiciels malveillants, les logiciels malveillants peuvent modifier les votes lorsqu'ils sont transmis.La Suisse & # 8220; résout & # 8221;Le problème des initiés malveillants dans leur bureau d'impression en déclarant officiellement qu'ils ne considéraient pas ce modèle de menace dans leur évaluation de la cybersécurité ...
Online voting is insecure, period. This doesn’t stop organizations and governments from using it. (And for low-stakes elections, it’s probably fine.) Switzerland—not low stakes—uses online voting for national elections. Ed Appel explains why it’s a bad idea: Last year, I published a 5-part series about Switzerland\'s e-voting system. Like any internet voting system, it has inherent security vulnerabilities: if there are malicious insiders, they can corrupt the vote count; and if thousands of voters\' computers are hacked by malware, the malware can change votes as they are transmitted. Switzerland “solves” the problem of malicious insiders in their printing office by officially declaring that they won\'t consider that threat model in their cybersecurity assessment... |
Threat Malware Vulnerability | ★★ | |
 |
2023-10-17 10:00:00 | Réévaluer les risques dans l'âge de l'intelligence artificielle Re-evaluating risk in the artificial intelligence age (lien direct) |
Introduction It is common knowledge that when it comes to cybersecurity, there is no one-size-fits all definition of risk, nor is there a place for static plans. New technologies are created, new vulnerabilities discovered, and more attackers appear on the horizon. Most recently the appearance of advanced language models such as ChatGPT have taken this concept and turned the dial up to eleven. These AI tools are capable of creating targeted malware with no technical training required and can even walk you through how to use them. While official tools have safeguards in place (with more being added as users find new ways to circumvent them) that reduce or prevent them being abused, there are several dark web offerings that are happy to fill the void. Enterprising individuals have created tools that are specifically trained on malware data and are capable of supporting other attacks such as phishing or email-compromises. Re-evaluating risk While risk should always be regularly evaluated it is important to identify when significant technological shifts materially impact the risk landscape. Whether it is the proliferation of mobile devices in the workplace or easy access to internet-connected devices with minimal security (to name a few of the more recent developments) there are times when organizations need to completely reassess their risk profile. Vulnerabilities unlikely to be exploited yesterday may suddenly be the new best-in-breed attack vector today. There are numerous ways to evaluate, prioritize, and address risks as they are discovered which vary between organizations, industries, and personal preferences. At the most basic level, risks are evaluated by multiplying the likelihood and impact of any given event. These factors may be determined through numerous methods, and may be affected by countless elements including: Geography Industry Motivation of attackers Skill of attackers Cost of equipment Maturity of the target’s security program In this case, the advent of tools like ChatGPT greatly reduce the barrier to entry or the “skill” needed for a malicious actor to execute an attack. Sophisticated, targeted, attacks can be created in minutes with minimal effort from the attacker. Organizations that were previously safe due to their size, profile, or industry, now may be targeted simply because it is easy to do so. This means all previously established risk profiles are now out of date and do not accurately reflect the new environment businesses find themselves operating in. Even businesses that have a robust risk management process and mature program may find themselves struggling to adapt to this new reality. Recommendations While there is no one-size-fits-all solution, there are some actions businesses can take that will likely be effective. First, the business should conduct an immediate assessment and analysis of their currently identified risks. Next, the business should assess whether any of these risks could be reasonably combined (also known as aggregated) in a way that materially changes their likelihood or impact. Finally, the business must ensure their executive teams are aware of the changes to the businesses risk profile and consider amending the organization’s existing risk appetite and tolerances. Risk assessment & analysis It is important to begin by reassessing the current state of risk within the organization. As noted earlier, risks or attacks that were previously considered unlikely may now be only a few clicks from being deployed in mass. The organization should walk through their risk register, if one exists, and evaluate all identified risks. This may be time consuming, and the organization should of course prioritize critical and high risks first, but it is important to ensure the business has the information they need to effectively address risks. Risk aggregation Onc | Malware Tool Vulnerability | ChatGPT | ★★★★ |
|
2023-10-17 05:00:21 | Êtes-vous sûr que votre navigateur est à jour?Le paysage actuel des fausses mises à jour du navigateur Are You Sure Your Browser is Up to Date? The Current Landscape of Fake Browser Updates (lien direct) |
Key Takeaways Proofpoint is tracking multiple different threat clusters that use similar themes related to fake browser updates. Fake browser updates abuse end user trust with compromised websites and a lure customized to the user\'s browser to legitimize the update and fool users into clicking. Threat actors do not send emails to share the compromised websites. The threat is only in the browser and can be initiated by a click from a legitimate and expected email, social media site, search engine query, or even just navigating to the compromised site. The different campaigns use similar lures, but different payloads. It is important to identify which campaign and malware cluster the threat belongs to help guide defender response. Overview Proofpoint is currently tracking at least four distinct threat clusters that use fake browser updates to distribute malware. Fake browser updates refer to compromised websites that display what appears to be a notification from the browser developer such as Chrome, Firefox, or Edge, informing them that their browser software needs to be updated. When a user clicks on the link, they do not download a legitimate browser update but rather harmful malware. Based on our research, TA569 has used fake browser updates for over five years to deliver SocGholish malware, but recently other threat actors have been copying the lure theme. Each threat actor uses their own methods to deliver the lure and payload, but the theme takes advantage of the same social engineering tactics. The use of fake browser updates is unique because it abuses the trust end users place in both their browser and the known sites that they visit. Threat actors that control the fake browser updates use JavaScript or HTML injected code that directs traffic to a domain they control, which can potentially overwrite the webpage with a browser update lure specific to the web browser that the potential victim uses. A malicious payload will then automatically download, or the user will receive a prompt to download a “browser update,” which will deliver the payload. Fake browser update lure and effectiveness The fake browser update lures are effective because threat actors are using an end-user\'s security training against them. In security awareness training, users are told to only accept updates or click on links from known and trusted sites, or individuals, and to verify sites are legitimate. The fake browser updates abuse this training because they compromise trusted sites and use JavaScript requests to quietly make checks in the background and overwrite the existing, website with a browser update lure. To an end user, it still appears to be the same website they were intending to visit and is now asking them to update their browser. Proofpoint has not identified threat actors directly sending emails containing malicious links, but, due to the nature of the threat, compromised URLs are observed in email traffic in a variety of ways. They are seen in normal email traffic by regular end users who are unaware of the compromised websites, in monitoring emails such as Google alerts, or in mass automated email campaigns like those distributing newsletters. This creates a situation where these emails are considered to be malicious during the time the site is compromised. Organizations should not treat the fake browser update threats as only an email problem, as end users could visit the site from another source, such as a search engine, social media site, or simply navigate to the site directly and receive the lure and potentially download the malicious payload. Each campaign uniquely filters traffic to hide from researchers and delay discovery, but all the methods are effective at filtering. While this may reduce the potential spread of malicious payloads, it enables actors to maintain their access to the compromised sites for longer periods of time. This can complicate the response, because with the multiple campaigns and changing payloads, responders must take time to | Threat Malware Studies Tool | ★★★★ | |
|
2023-10-16 17:29:48 | Discord toujours un foyer d'activité malveillante - maintenant les aptes rejoignent le plaisir Discord still a hotbed of malware activity - Now APTs join the fun (lien direct) |
Discord continue d'être un terrain reproducteur pour une activité malveillante par les pirates et maintenant des groupes APT, avec elle couramment utilisée pour distribuer des logiciels malveillants, exfilter les données et ciblé par les acteurs de la menace pour voler des jetons d'authentification.[...]
Discord continues to be a breeding ground for malicious activity by hackers and now APT groups, with it commonly used to distribute malware, exfiltrate data, and targeted by threat actors to steal authentication tokens. [...] |
Threat Malware | ★★★ | |
|
2023-10-16 15:15:09 | Bloodalchemy fournit des secrets nations de la porte dérobée aux nations d'Asie du Sud-Est \\ ' BLOODALCHEMY provides backdoor to southeast Asian nations\\' secrets (lien direct) |
De développeurs de logiciels malveillants sophistiqués qui seraient à l'origine du dernier ajout à l'ensemble d'outils d'attaquants alignés en Chine Les chercheurs en sécurité ont découvert une porte dérobée utilisée dans les attaques contre les gouvernements et les organisations de l'Association des Nations d'Asie du Sud-Est (ASEAN).… | Malware | ★★★ | |
 |
2023-10-16 10:29:00 | La chaîne intelligente de Binance \\ est exploitée dans la nouvelle campagne \\ 'EtherHiding \\' malware Binance\\'s Smart Chain Exploited in New \\'EtherHiding\\' Malware Campaign (lien direct) |
Des acteurs de menace ont été observés au service de code malveillant en utilisant des contrats de chaîne intelligente de Binance \\ de Binance (BSC) dans ce qui a été décrit comme le «niveau suivant de l'hébergement pare-balles».
La campagne, détectée il y a deux mois, a été nommée EtherHiding par Guardio Labs.
Le roman Twist marque la dernière itération d'une campagne en cours qui exploite des sites WordPress compromis pour servir sans méfiance
Threat actors have been observed serving malicious code by utilizing Binance\'s Smart Chain (BSC) contracts in what has been described as the "next level of bulletproof hosting." The campaign, detected two months ago, has been codenamed EtherHiding by Guardio Labs. The novel twist marks the latest iteration in an ongoing campaign that leverages compromised WordPress sites to serve unsuspecting |
Threat Malware | ★★ | |
 |
2023-10-16 09:31:32 | Clearfake: un nouveau venu dans les «fausses mises à jour» menace le paysage ClearFake: a newcomer to the “fake updates” threats landscape (lien direct) |
Clearfake est un nouveau framework JavaScript malveillant déployé sur des sites Web compromis pour fournir d'autres logiciels malveillants à l'aide de la technique de téléchargement.Ce blog vise à présenter une analyse technique du flux d'installation de Clearfake, les logiciels malveillants livrés par Clearfake, l'infrastructure C2 et les opportunités de suivi.
la publication Suivante clearfake: un newcomersaux & # 8220; fausses mises à jour & # 8221;Menaces Paysage est un article de blog Sekoia.io .
ClearFake is a new malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. This blogpost aims at presenting a technical analysis of the ClearFake installation flow, the malware delivered by ClearFake, the C2 infrastructure and tracking opportunities. La publication suivante ClearFake: a newcomer to the “fake updates” threats landscape est un article de Sekoia.io Blog. |
Threat Malware | ★★★ | |
|
2023-10-16 02:58:14 | Le régulateur, les assureurs et les clients viennent tous pour les progrès après la violation de Moveit Regulator, insurers and customers all coming for Progress after MOVEit breach (lien direct) |
De plus, CISA catalogage de nouveaux points de données de ransomware, des sites WP 17K détournés par malware en septembre, et des vulns plus critiques infosec en bref les retombées de l'exploitation des boguesIn Progress Software \'s Moveit File Transfer Software se poursuit, la Commission américaine des Securities and Exchange (SEC) enquête désormais sur l'affaire et de nombreuses parties touchées à la rémunération.…
Also, CISA cataloging new ransomware data points, 17k WP sites hijacked by malware in Sept., and more critical vulns Infosec in brief The fallout from the exploitation of bugs in Progress Software\'s MOVEit file transfer software continues, with the US Securities and Exchange Commission (SEC) now investigating the matter, and lots of affected parties seeking compensation. … |
Ransomware Malware | ★★★ | |
|
2023-10-15 11:12:06 | Steam applique la vérification des SMS pour limiter les mises à jour des logiciels malveillants Steam enforces SMS verification to curb malware-ridden updates (lien direct) |
Valve a annoncé la mise en œuvre de mesures de sécurité supplémentaires pour les développeurs publiant des jeux sur Steam, y compris les codes de confirmation basés sur SMS.Il s'agit de faire face à une récente épidémie de mises à jour malveillantes poussant les logiciels malveillants à partir de comptes d'éditeurs compromis.[...]
Valve has announced implementing additional security measures for developers publishing games on Steam, including SMS-based confirmation codes. This is to deal with a recent outbreak of malicious updates pushing malware from compromised publisher accounts. [...] |
Malware | ★★ | |
|
2023-10-15 10:16:32 | Sommet des dirigeants politiques des femmes ciblées dans le phishing malware romcom Women Political Leaders Summit targeted in RomCom malware phishing (lien direct) |
Une nouvelle variante légère de la porte arrière ROMCOM a été déployée contre les participants au Sommet des femmes politiques (WPL) à Bruxelles, un sommet axé sur l'égalité des sexes et les femmes en politique.[...]
A new, lightweight variant of the RomCom backdoor was deployed against participants of the Women Political Leaders (WPL) Summit in Brussels, a summit focusing on gender equality and women in politics. [...] |
Malware | ★★★ | |
|
2023-10-14 10:09:08 | Darkgate Malware se propage à travers des comptes Skype compromis DarkGate malware spreads through compromised Skype accounts (lien direct) |
Entre juillet et septembre, les attaques de logiciels malveillants de Darkgate ont utilisé des comptes Skype compromis pour infecter les cibles via des messages contenant des pièces jointes de script de chargeur VBA.[...]
Between July and September, DarkGate malware attacks have used compromised Skype accounts to infect targets through messages containing VBA loader script attachments. [...] |
Malware | ★★★ | |
|
2023-10-13 17:42:00 | Shellbot fissure les serveurs SSH Linux, fait ses débuts à une nouvelle tactique d'évasion ShellBot Cracks Linux SSH Servers, Debuts New Evasion Tactic (lien direct) |
Le botnet - construit pour les DDOS, la résidence en arrière et la suppression des logiciels malveillants - échappe aux détections de signature d'URL standard avec une nouvelle approche.
The botnet - built for DDoS, backdooring, and dropping malware - is evading standard URL signature detections with a novel approach. |
Malware | ★★★ | |
|
2023-10-13 16:06:00 | Darkgate malware se propage via des services de messagerie se faisant passer pour des fichiers PDF DarkGate Malware Spreading via Messaging Services Posing as PDF Files (lien direct) |
Une partie de logiciels malveillants connue sous le nom de Darkgate a été observée répartie via des plates-formes de messagerie instantanées telles que Skype et Microsoft Teams.
Dans ces attaques, les applications de messagerie sont utilisées pour livrer un script de chargeur de base visuel pour les applications (VBA) qui se dégage d'un document PDF, qui, une fois ouvert, déclenche le téléchargement et l'exécution d'un script automatique conçu pour lancer le malware.
"C'est
A piece of malware known as DarkGate has been observed being spread via instant messaging platforms such as Skype and Microsoft Teams. In these attacks, the messaging apps are used to deliver a Visual Basic for Applications (VBA) loader script that masquerades as a PDF document, which, when opened, triggers the download and execution of an AutoIt script designed to launch the malware. "It\'s |
Malware | ★★ | |
|
2023-10-12 20:50:56 | L'opérateur de Darkgate utilise Skype, équipes Messages pour distribuer des logiciels malveillants DarkGate Operator Uses Skype, Teams Messages to Distribute Malware (lien direct) |
Une pluralité des cibles de la campagne en cours a été basée dans les Amériques.
A plurality of the targets in the ongoing campaign have been based in the Americas. |
Malware | ★★ | |
|
2023-10-12 20:23:45 | Microsoft réglé pour prendre sa retraite VBScript de l'ère grunge, à Cybercrime \\'s Chagrin Microsoft Set to Retire Grunge-Era VBScript, to Cybercrime\\'s Chagrin (lien direct) |
Les logiciels malveillants populaires comme Qakbot et Darkgate reposent sur VBScript, qui remonte à 1996 - mais leurs jours sont numérotés maintenant que Microsoft déprécie enfin la programmation Windows.langue.
Popular malware like QakBot and DarkGate rely on VBScript, which dates back to 1996 - but their days are numbered now that Microsoft is finally deprecating the Windows programming. language. |
Malware | ★ | |
|
2023-10-12 14:46:00 | Les chercheurs découvrent des logiciels malveillants qui se font passer pour un plugin de mise en cache WordPress Researchers Uncover Malware Posing as WordPress Caching Plugin (lien direct) |
Les chercheurs en cybersécurité ont fait la lumière sur une nouvelle souche sophistiquée de logiciels malveillants qui masquait un plugin WordPress pour créer furtivement des comptes d'administrateur et contrôler à distance un site compromis.
"Complet avec un commentaire d'ouverture professionnel qui implique qu'il s'agit d'un plugin de mise en cache, ce code voyou contient de nombreuses fonctions, ajoute des filtres pour empêcher de ne pas être inclus dans la liste
Cybersecurity researchers have shed light on a new sophisticated strain of malware that masquerades a WordPress plugin to stealthily create administrator accounts and remotely control a compromised site. "Complete with a professional looking opening comment implying it is a caching plugin, this rogue code contains numerous functions, adds filters to prevent itself from being included in the list |
Malware | ★ | |
|
2023-10-12 14:06:50 | Backdoor se cache derrière le plugin de mise en cache WordPress aux sites Web de détournement Backdoor Lurks Behind WordPress Caching Plugin to Hijack Websites (lien direct) |
Les logiciels malveillants évasifs déguisés en plugin de mise en cache permettent aux attaquants de créer un compte d'administration sur un site WordPress, puis de prendre le relais et de monétiser les sites au détriment du référencement légitime et de la confidentialité des utilisateurs.
Evasive malware disguised as a caching plugin allows attackers to create an admin account on a WordPress site, then take over and monetize sites at the expense of legitimate SEO and user privacy. |
Malware | ★★ | |
|
2023-10-12 13:41:38 | MALWOIRE MALWORE DE BAILDOOR Trouvé sur le site Web WordPress déguisé en plugin légitime Backdoor Malware Found on WordPress Website Disguised as Legitimate Plugin (lien direct) |
Une porte dérobée déployée sur un site Web WordPress compromis se présente comme un plugin légitime pour cacher sa présence.
A backdoor deployed on a compromised WordPress website poses as a legitimate plugin to hide its presence. |
Malware | ★★ | |
|
2023-10-12 10:09:01 | Les pirates Todycat utilisent \\ 'Disposable \\' malware pour cibler les télécoms asiatiques ToddyCat hackers use \\'disposable\\' malware to target Asian telecoms (lien direct) |
Une campagne nouvellement découverte surnommée "STENET \\ 'Alive" vise les organisations gouvernementales et les fournisseurs de services de télécommunications à travers l'Asie depuis 2021, en utilisant une grande variété de logiciels malveillants "jetables" pour échapper à la détection.[...]
A newly discovered campaign dubbed "Stayin\' Alive" has been targeting government organizations and telecommunication service providers across Asia since 2021, using a wide variety of "disposable" malware to evade detection. [...] |
Malware | ★★★ | |
|
2023-10-12 10:00:25 | Toddycat: Tenez-vous calme et vérifiez les journaux ToddyCat: Keep calm and check logs (lien direct) |
Dans cet article, nous décrivons le nouvel ensemble d'outils Todycat, le malware utilisé pour voler et exfiltrer les données, et les techniques utilisées par ce groupe pour se déplacer latéralement et effectuer des opérations d'espionnage.
In this article, we\'ll describe ToddyCat new toolset, the malware used to steal and exfiltrate data, and the techniques used by this group to move laterally and conduct espionage operations. |
Malware | ★★ | |
|
2023-10-12 10:00:00 | L'évolution des attaques de phishing The evolution of phishing attacks (lien direct) |
A practical guide to phishing and best practices to avoid falling victim. Introduction Over the past several years, remote and hybrid work has quickly gained popularity amongst those seeking a to reduce the amount of time on the road or an improved work/life balance. To accomplish this, users are often working from multiple devices, some of which may be company issued, but others may be privately owned. Cyberattackers have leveraged this trend to bypass traditional security controls using social engineering, with phishing attacks being a favored tactic. In fact, the FBI Internet Crime Report issued in 2022 reported phishing as the top reported internet crime for the past 5 years. Its ability to persuade individuals to divulge sensitive information to seemingly familiar contacts and companies over email and/or SMS text messages has resulted in significant data breaches, both personal and financial, across all industries. Mobile phishing, in particular, is quickly becoming a preferred attack vector among hackers seeking to use them as a jump point to gain access to proprietary data within a company’s network. This article provides an overview of the origins of phishing, its impact on businesses, the types of mobile phishing attacks hackers employ, and ways in which companies can best defend themselves against such attacks. The origins of phishing The belief among many in the cybersecurity industry is that phishing attacks first emerged in the mid-90s when dial-up was the only means of gaining access to the internet. Hackers posing as ISP administrators used fake screen names to establish credibility with the user, enabling them to “phish” for personal log-in data. Once successful, they were able to exploit the victim’s account by sending out phishing emails to other users in their contact list, with the goal of scoring free internet access or other financial gain. Awareness of phishing was still limited until May 2000 when Love Bug entered the picture. Love Bug, a highly effective and contagious virus designed to take advantage of the user’s psyche was unleashed in the Philippines, impacting an estimated 45 million Window PCs globally. Love Bug was sent via email with the subject line reading “ILOVEYOU”. The body of the message simply read “Kindly check the attached LOVELETTER coming from me”. Users who couldn’t resist opening the message unleashed a worm virus infecting and overwriting user’s files with copies of the virus. When the user opened the file, they would reinfect the system. Lovebug elevated phishing to a new level as it demonstrated the ability to target a user’s email mailing list for the purpose of spamming acquaintances thereby incentivizing the reader to open his/her email. This enabled the lovebug worm to infect computer systems and steal other user’s passwords providing the hacker the opportunity to log-in to other user accounts providing unlimited internet access. Since Love Bug, the basic concept and primary goal of phishing tactics has remained consistent, but the tactics and vectors have evolved. The window of opportunity has increased significantly for hackers with the increased use of social media (e.g., Linkedin, Twitter, Facebook). This provides more personal data to the hackers enabling them to exploit their targets with more sophisticated phishing tactics while avoiding detection. Phishing’s impact in the marketplace today Phishing attacks present a significant threat for organizations as their ability to capture proprietary business and financial data are both costly and time consuming for IT organizations to detect and remediate. Based on a | Threat Ransomware Malware Tool Prediction | ★★★ | |
|
2023-10-12 09:27:20 | J'ai été frappé par les ransomwares-temps quoi?Étapes pour gérer les conséquences I\\'ve Been Hit by Ransomware-Now What? Steps for Dealing with the Aftermath (lien direct) |
The following is an excerpt from the Ransomware Survival Guide, our free handbook on preventing, managing and recovering from ransomware threats at every stage of the attack chain. This blog post provides general tips-it is not a substitute for professional cybersecurity and incident response services. The best ransomware strategy is to avoid it in the first place. But increasingly advanced attacks against the software supply chain and end users have shown that even the best-prepared companies can be caught out. Ransomware may not even be the first malware payload to infect your system, because many ransomware gangs now prefer to buy access to targets already infected with Trojans or loader malware. During an attack, you have short-term problems to resolve, like getting computers, phones and networks back online and dealing with ransom demands. But a panicked response won\'t help-and may make things worse. Here are some general steps you can take to contain the threat and start on the road to recovery. Questions to answer during a ransomware attack Before you react to an attack, it\'s important to take a step back and ask questions that will inform your response. Your answers should help network administrators scope the problem, devise an action plan and possibly curtail the spread. Who in your environment is compromised? How widespread are the infections? Is a threat actor actively scouting your environment, exfiltrating data or ready to drop ransomware on other devices? What network permissions do compromised accounts or devices have? Ransomware may have been installed only after attackers had already moved laterally within the network or stolen credentials and other data. What type of attack is it? Is this attack a secondary infection? Did it come from downloaders, remote access Trojans (RATs) or other malware installed on the infected machine or others on the network? Keep in mind that ransomware spreads quickly and is often a byproduct of other threats. If you see one infection, there are probably others that you don\'t see. Proactively look for other issues within your environment. Now as you take action, there are three general step to follow: Step 1: Isolate infected systems The second employees see the ransomware demand or notice something\'s odd-such as suddenly losing access to their own files-they should disconnect from the network and take the infected machine to the IT department. To prepare for this scenario, we recommend that you keep valuable data and systems separated so that a security issue on one system doesn\'t affect other systems. For example, your sensitive research or business data should not reside on the same server and network segment as your email environment. We advise against having employees reboot their system. Only the IT security team should attempt a reboot, and even that will work only in the event that it is “scareware,” or fake ransomware. "Scareware" is malware that appears to be ransomware but isn\'t. It may lock the user\'s screen with a ransom demand and payment instructions, but the data is not actually encrypted. In those scenarios, standard anti-malware tools can help. Knowing the difference isn\'t always easy. Determine the scope of the problem using threat intelligence and external incident responders or forensic analysts when necessary. While all ransomware is bad, some attacks are worse than others. Your response-including whether to pay the ransom-hinges on several factors. Step 2: Call law enforcement Ransomware-like other forms of theft and extortion-is a crime. Nobody has the right to seize devices, networks or data-let alone demand a ransom in exchange for it. Notifying the proper authorities is a necessary first step. Contact local or federal law enforcement right away. Special departments exist specifically to aid cyber crime victims, so do not be afraid to pick up your phone and call them. They are there to help you and may have access to decryption keys or information on payment recovery after | Threat Ransomware Malware Tool | ★★★ | |
|
2023-10-12 00:53:07 | Shellbot DDOS malware installé via des adresses de notation hexadécimale ShellBot DDoS Malware Installed Through Hexadecimal Notation Addresses (lien direct) |
Ahnlab Security Emergency Response Center (ASEC) a récemment découvert un changement dans la méthode de distribution du shellbot malveillant malveillant les logiciels malveillants shellbot malveillants (ASEC), qui est installé sur des serveurs Linux SSH mal gérés.Le flux global reste le même, mais l'URL de téléchargement utilisé par l'acteur de menace pour installer Shellbot est passé d'une adresse IP ordinaire à une valeur hexadécimale.1. cas passé d'évasion de détection d'URL.format, avec des acteurs de menace utilisant des adresses ...
AhnLab Security Emergency response Center (ASEC) has recently discovered a change in the distribution method of the ShellBot malware, which is being installed on poorly managed Linux SSH servers. The overall flow remains the same, but the download URL used by the threat actor to install ShellBot has changed from a regular IP address to a hexadecimal value. 1. Past Case of URL Detection Evasion Typically, IP addresses are used in the “dot-decimal notation” format, with threat actors using addresses... |
Threat Malware | ★★★ | |
 |
2023-10-12 00:00:00 | Darkgate ouvre des organisations pour attaquer via Skype, équipes DarkGate Opens Organizations for Attack via Skype, Teams (lien direct) |
Nous détaillons une campagne en cours abusant des plates-formes de messagerie Skype et des équipes pour distribuer les logiciels malveillants de Darkgate aux organisations ciblées.Nous avons également découvert qu'une fois que Darkgate est installé sur le système de la victime, des charges utiles supplémentaires ont été introduites dans l'environnement.
We detail an ongoing campaign abusing messaging platforms Skype and Teams to distribute the DarkGate malware to targeted organizations. We also discovered that once DarkGate is installed on the victim\'s system, additional payloads were introduced to the environment. |
Malware | ★★★ | |
|
2023-10-11 21:15:00 | Chinois \\ 'séjour \\' vivant \\ 'attaque danser sur des cibles avec des logiciels malveillants stupides Chinese \\'Stayin\\' Alive\\' Attacks Dance Onto Targets With Dumb Malware (lien direct) |
Un APT sophistiqué connu sous le nom de «Toddycat», parrainé par Pékin, utilise intelligemment des logiciels malveillants non sophistiqués pour empêcher les défenseurs de leur sentier.
A sophisticated APT known as "ToddyCat," sponsored by Beijing, is cleverly using unsophisticated malware to keep defenders off their trail. |
Malware | ★★ | |
 |
2023-10-11 20:30:00 | Mises à jour de Botnet basées à Mirai \\ 'Arsenal of Exploits \\' on Routers, IoT Devices Mirai-based botnet updates \\'arsenal of exploits\\' on routers, IoT devices (lien direct) |
Un botnet de logiciel malveillant basé à Mirai a élargi son arsenal de charge utile pour cibler agressivementDes routeurs et autres appareils orientés Internet, ont découvert des chercheurs.La variante, appelée IZ1H9, était observé Par des chercheurs de Fortinet exploitant les vulnérabilités dans des produits de neuf marques différentes, notamment D-Link, Netis, Sunhillo, Geutebruck, Yealink, Zyxel, TP-Link, KoENIX et Totolink.«Exploitation maximale» des vulnérabilités s'est produite
A Mirai-based malware botnet has expanded its payload arsenal to aggressively target routers and other internet-facing devices, researchers have discovered. The variant, called IZ1H9, was observed by researchers at Fortinet exploiting vulnerabilities in products from nine different brands, including D-Link, Netis, Sunhillo, Geutebruck, Yealink, Zyxel, TP-Link, Korenix and TOTOLINK. “Peak exploitation” of the vulnerabilities occurred |
Malware Vulnerability | ★★★ | |
|
2023-10-11 18:11:00 | Plus de 17 000 sites WordPress compromis par l'injecteur de Balada en septembre 2023 Over 17,000 WordPress Sites Compromised by Balada Injector in September 2023 (lien direct) |
Plus de 17 000 sites Web WordPress ont été compromis au mois de septembre 2023 avec des logiciels malveillants connus sous le nom d'injecteur de Balada, près du double du nombre de détections en août.
Parmi ceux-ci, 9 000 sites Web auraient été infiltrés en utilisant un défaut de sécurité récemment divulgué dans le plugin TagDiv Composer (CVE-2023-3169, score CVSS: 6.1) qui pourrait être exploité par des utilisateurs non authentifiés à
More than 17,000 WordPress websites have been compromised in the month of September 2023 with malware known as Balada Injector, nearly twice the number of detections in August. Of these, 9,000 of the websites are said to have been infiltrated using a recently disclosed security flaw in the tagDiv Composer plugin (CVE-2023-3169, CVSS score: 6.1) that could be exploited by unauthenticated users to |
Malware | ★★ |
To see everything:
Our RSS (filtrered)
