What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-02-14 14:41:00 | Attacks on industrial infrastructure on the rise, defenses struggle to keep up (lien direct) | The last year saw a rise in the sophistication and number of attacks targeting industrial infrastructure, including the discovery of a modular malware toolkit that's capable of targeting tens of thousands of industrial control systems (ICS) across different industry verticals. At the same time, incident response engagements by industrial cybersecurity firm Dragos showed that 80% of impacted environments lacked visibility into ICS traffic and half had network segmentation issues and uncontrolled external connections into their OT networks."A number of the threats that Dragos tracks may evolve their disruptive and destructive capabilities in the future because adversaries often do extensive research and development (R&D) and build their programs and campaigns over time," the Dragos researchers said in a newly released annual report. "This R&D informs their future campaigns and ultimately increases their disruptive capabilities."To read this article in full, please click here | Malware Industrial | ★★ | |
|
2023-02-09 07:58:00 | HTML smuggling campaigns impersonate well-known brands to deliver malware (lien direct) | Trustwave SpiderLabs researchers have cited an increased prevalence of HTML smuggling activity whereby cybercriminal groups abuse the versatility of HTML in combination with social engineering to distribute malware. The firm has detailed four recent HTML smuggling campaigns attempting to lure users into saving and opening malicious payloads, impersonating well-known brands such as Adobe Acrobat, Google Drive, and the US Postal Service to increase the chances of users falling victim.HTML smuggling uses HTML5 attributes that can work offline by storing a binary in an immutable blob of data (or embedded payload) within JavaScript code, which is decoded into a file object when opened via a web browser. It is not a new attack method, but it has grown in popularity since Microsoft started blocking macros in documents from the internet by default, Trustwave SpiderLabs wrote. The four malware strains that have recently been detected using HTML smuggling in their infection chain are Cobalt Strike, Qakbot, IcedID, and Xworm RAT, the firm added.To read this article in full, please click here | Malware | ★★ | |
|
2023-02-08 11:13:00 | Threat group targets over 1,000 companies with screenshotting and infostealing malware (lien direct) | Researchers warn that a new threat actor has been targeting over a thousand organizations since October with the goal of deploying credential-stealing malware. The attack chain also involves reconnaissance components including a Trojan that takes screenshots of the desktops of infected computers.Tracked as TA866 by researchers from security firm Proofpoint, the group's tooling seems to have similarities to other campaigns reported in the past under different names going as far back as 2019. Even though this latest activity appears to be financially motivated, some of the possibly related attacks seen in the past suggest that espionage was also a motivation at the time.To read this article in full, please click here | Malware Threat | ★★★ | |
|
2023-01-25 11:06:00 | Attackers move away from Office macros to LNK files for malware delivery (lien direct) | For years attackers have used Office documents with malicious macros as one of the primary methods of infecting computers with malware. Microsoft finally took steps to disable such scripts by default in documents downloaded from the internet, forcing many groups to change tactics and increasingly choose LNK (shortcut) files as a delivery mechanism.This trend has led to the creation of paid tools and services dedicated to building malicious LNK files. Some of these builders include MLNK Builder, Quantum Builder, Macropack, LNKUp, Lnk2pwn, SharPersist, and RustLnkBuilder, but their use can provide opportunities for easier detection by security products.To read this article in full, please click here | Malware Prediction | ★ | |
|
2023-01-19 04:27:00 | Chinese hackers targeted Iranian government entities for months: Report (lien direct) | Chinese advanced persistent threat actor, Playful Taurus, targeted several Iranian government entities between July and December 2022, according to a Palo Alto Networks report. The Chinese threat actor also known as APT15, KeChang, NICKEL, BackdoorDiplomacy, and Vixen Panda, was observed attempting to connect government domains to malware infrastructure previously associated with the APT group, according to the report.“Playful Taurus continues to evolve their tactics and their tooling. Recent upgrades to the Turian backdoor and new C2 infrastructure suggest that these actors continue to see success during their cyber espionage campaigns,” Palo Alto Networks said in a blog. To read this article in full, please click here | Malware Threat | APT 15 APT 25 | ★★★ |
|
2023-01-17 13:53:00 | How attackers might use GitHub Codespaces to hide malware delivery (lien direct) | Attackers could start abusing GitHub Codespaces, a new service that allows developers to create and test applications inside development containers running on GitHub's servers. Developers can make their applications accessible via public GitHub URLs for preview by others, a functionality that can be abused to distribute malware payloads in a stealthy way."If the application port is shared privately, browser cookies are used and required for authentication," researchers from security firm Trend Micro said in a new report. "However, if ports are shared with the public (that is, without authentication or authentication context), attackers can abuse this feature to host malicious content such as scripts and malware samples."To read this article in full, please click here | Malware Prediction | ★ | |
|
2023-01-13 12:01:00 | Attackers deploy sophisticated Linux implant on Fortinet network security devices (lien direct) | In December network security vendor Fortinet disclosed that a critical vulnerability in its FortiOS operating system was being exploited by attackers in the wild. This week, after additional analysis, the company released more details about a sophisticated malware implant that those attackers deployed through the flaw.Based on currently available information, the original zero-day attack was highly targeted to government-related entities. However, since the vulnerability has been known for over a month, all customers should patch it as soon as possible as more attackers could start using it.Remote code execution in FortiOS SSL-VPN The vulnerability, tracked as CVE-2022-42475, is in the SSL-VPN functionality of FortiOS and can be exploited by remote attackers without authentication. Successful exploitation can result in the execution of arbitrary code and commands.To read this article in full, please click here | Malware Vulnerability | ★★★ | |
|
2023-01-12 09:58:00 | BrandPost: The Unrelenting Rise of Botnet Threats (lien direct) | As the world has moved to scalable online services for everything from video streaming to gaming to messaging, it's really no surprise that malware has followed close behind. Specifically, threats such as botnets are evolving and scaling at such speeds that it's more important than ever to proactively manage potential security threats. Botnets, a portmanteau or blend of the phrase robot networks, are collections of malware-infected computing resources that can be used to attack any connected target system. They're a growing risk for every organization, enabling cyber criminals to steal passwords and gain access to corporate systems, deploy disruptive attacks that shut down entire network, or even hijack corporate data with ransomware.To read this article in full, please click here | Malware | ★★★ | |
|
2023-01-05 04:00:00 | NATO tests AI\'s ability to protect critical infrastructure against cyberattacks (lien direct) | Autonomous intelligence, artificial intelligence (AI) that can act without human intervention, can help identify critical infrastructure cyberattack patterns and network activity, and detect malware to enable enhanced decision-making about defensive responses. That's according to the preliminary findings of an international experiment of AI's ability to secure and defend systems, power grids and other critical assets by cyber experts at the North Atlantic Treaty Organization's (NATO) Cyber Coalition 2022 event late last year.The simulated experiment saw six teams of cyber defenders from NATO allies tasked with setting up computer-based systems and power grids at an imaginary military base and keeping them running during a cyberattack. If hackers interfered with system operations or the power went down for more than 10 minutes, critical systems could go offline. The differentiator was that three of the teams had access to a novel Autonomous Intelligence Cyberdefense Agent (AICA) prototype developed by the US Department of Energy's (DOE) Argonne National Laboratory, while the other three teams did not.To read this article in full, please click here | Malware | ★★★ | |
|
2022-12-06 08:28:00 | Flaws in MegaRAC baseband management firmware impact many server brands (lien direct) | Researchers have found three vulnerabilities in AMI MegaRAC, a baseband management controller (BMC) firmware used by multiple server manufacturers. If exploited, the flaws could allow attackers to remotely control servers, deploy malware and firmware implants, or trigger damaging actions that leave them inoperable.BMCs are microcontrollers present on server motherboards that have their own firmware, dedicated memory, power, and network ports and are used for out-of-band management of servers when their main operating systems are shut down. They are essentially small independent computers running inside bigger computers that allow administrators to remotely perform a variety of maintenance and diagnostic tasks including reinstalling operating systems, restarting servers when they're unresponsive, deploying firmware updates and more.To read this article in full, please click here | Malware | ★★★ | |
|
2022-11-30 02:00:00 | What is Ransom Cartel? A ransomware gang focused on reputational damage (lien direct) | Ransom Cartel, a ransomware-as-a-service (RaaS) operation, has stepped up its attacks over the past year after the disbanding of prominent gangs such as REvil and Conti. Believed to have launched in December 2021, Ransom Cartel has made victims of organizations from among the education, manufacturing, utilities, and energy sectors with aggressive malware and tactics that resemble those used by REvil.To read this article in full, please click here | Ransomware Malware | ★★ | |
|
2022-11-25 05:05:00 | Cybercriminals are increasingly using info-stealing malware to target victims (lien direct) | Cybercriminals are increasingly shifting from automated scam-as-a-service to more advanced info stealer malware distributors as the competition for resources increases, and they look for new way to make profits, according to a report by Group-IB. The cybersecurity company has identified 34 Russian-speaking groups distributing info-stealing malware under the stealer-as-a-service model.Info stealer malware collects users' credentials stored in browsers, gaming accounts, email services, social media, bank card details, and crypto wallet information from infected computers, and sends the data to the malware operator. This data is then sold or used for fraud on the dark web. To read this article in full, please click here | Malware | ||
|
2022-11-24 02:00:00 | DUCKTAIL malware campaign targeting Facebook business and ads accounts is back (lien direct) | A group of attackers, likely based in Vietnam, that specializes in targeting employees with potential access to Facebook business and ads management accounts, has re-emerged with changes to its infrastructure, malware, and modus operandi after being initially outed a few months ago.Dubbed DUCKTAIL by researchers from WithSecure, the group uses spear phishing to target individuals on LinkedIn who have job descriptions that could suggest they have access to manage Facebook business accounts. More recently, the attackers were also observed targeting victims via WhatsApp. The compromised Facebook business accounts are used to run ads on the platform for attackers' financial gain.To read this article in full, please click here | Malware | ||
|
2022-11-21 07:02:00 | Luna Moth callback phishing campaign leverages extortion without malware (lien direct) | Palo Alto's Unit 42 has investigated several incidents linked to the Luna Moth group callback phishing extortion campaign targeting businesses in multiple sectors, including legal and retail. The analysis discovered that the threat actors behind the campaign leverage extortion without malware-based encryption, have significantly invested in call centers and infrastructure unique to attack targets, and are evolving their tactics over time. Unit 42 stated that the campaign has cost victims hundreds of thousands of dollars and is expanding in scope.Luna Moth removes malware portion of phishing callback attack Callback phishing – or telephone-oriented attack delivery (TOAD) – is a social engineering attack that requires a threat actor to interact with the target to accomplish their objectives. It is more resource intensive but less complex than script-based attacks and it tends to have a much higher success rate, Unit 42 wrote in a blog posting. Actors linked to the Conti ransomware group had success with this type of attack with the BazarCall campaign, which focused on tricking victims into downloading the BazarLoader malware. This malware element is synonymous with traditional callback phishing attacks. Interestingly, in this campaign, Luna Moth does away with the malware portion of the attack, instead using legitimate and trusted systems management tools to interact directly with a victim's computer to manually exfiltrate data for extortion. “As these tools are not malicious, they're not likely to be flagged by traditional antivirus products,” the researchers wrote.To read this article in full, please click here | Ransomware Malware Threat | ||
|
2022-11-16 08:47:00 | BrandPost: Insider Risk vs. Malware – Why Insider Risk Requires a New Approach (lien direct) | Security teams focused on mitigating data loss threats are increasingly facing challenges that come from the way their own coworkers across the business get their jobs done. Years of digitization, hybrid and remote work, and empowering employees to collaborate effectively from anywhere has changed the structure of data in most organizations.Annual Code42 Data Exposure Report research shows the Insider Risk problem keeps getting bigger. Employees are 85% more likely to leak or take data today than pre-pandemic, and there's a 1 in 3 chance that you're losing critical intellectual property every time an employee leaves the company. But it's not just the proliferation of cloud tools and remote work that's accelerating the problem. In many ways, the mindset and strategies that security teams use to attack insider threats are actually aggravating the issue.To read this article in full, please click here | Malware | ||
|
2022-11-16 05:15:00 | Palo Alto releases PAN-OS 11.0 Nova with new evasive malware, injection attack protection (lien direct) | Palo Alto Networks has announced PAN-OS 11.0 Nova, the latest version of its PAN-OS software, featuring new product updates and features. These include the Advanced WildFire cloud-delivered security service to help protect against evasive malware and the Advanced Threat Prevention (ATP) service, which protects against injection attacks. The cybersecurity vendor also revealed new web proxy support and enhanced cloud access security broker (CASB) integration with new SaaS security posture management (SSPM) capabilities.In a press release, Anand Oswal, senior VP network security at Palo Alto Networks, said that the new version of Nova is now able to stop 26% more zero-day malware than traditional sandboxes and detect 60% more injection attacks. The updates are the latest in a series of security releases from Palo Alto in 2022.To read this article in full, please click here | Malware Threat | ||
|
2022-11-03 10:41:00 | Mondelez and Zurich\'s NotPetya cyber-attack insurance settlement leaves behind no legal precedent (lien direct) | Multinational food and beverage company Mondelez International and Zurich American Insurance have settled their multiyear litigation surrounding the cyberattack coverage – or lack of such coverage – following the NotPetya malware attack that damaged the Mondelez network and infrastructure. The specifics of the settlement are unknown, but that it would come mid-trial has caught everyone's attention.The pain was felt on June 27, 2017, when NotPetya wiped out 24,000 laptops and 1,700 servers within the Mondelez network. The malware, designed to destroy, did just that. Mondelez estimated damages would approach $100 million USD.To read this article in full, please click here | Malware | NotPetya NotPetya | ★★★★ |
|
2022-10-28 10:01:00 | Phishing attacks increase by over 31% in third quarter: Report (lien direct) | Email security and threat detection company Vade has found that phishing emails in the third quarter this year increased by more than 31% quarter on quarter, with the number of emails containing malware in the first three quarters surpassing the 2021 level by 55.8 million.Malware emails in the third quarter of 2022 alone increased by 217% compared to same period in 2021. Malware email volume peaked in July, reaching 19.2 million, before month-over-month declines in August and September, with numbers dropping to 16.8 million and 16.5 million respectively.To read this article in full, please click here | Malware Threat | ★★★★ | |
|
2022-10-20 06:00:00 | Attackers switch to self-extracting password-protected archives to distribute email malware (lien direct) | Distributing malware inside password-protected archives has long been one of the main techniques used by attackers to bypass email security filters. More recently, researchers have spotted a variation that uses nested self-extracting archives that no longer require victims to input the password.“This is significant because one of the most difficult obstacles threat actors face when conducting this type of spam campaign is to convince the target to open the archive using the provided password,” researchers from Trustwave SpiderLabs said in a new report.To read this article in full, please click here | Spam Malware Threat | ||
|
2022-10-18 09:47:00 | BrandPost: Why Unified Platforms Are the Future of Network Security (lien direct) | Today's complex cybersecurity landscape regularly exposes the weaknesses of disconnected security solutions. In breach after breach, we see attackers taking advantage of gaps and vulnerabilities in legacy systems and devices, underscoring the reality that a pieced-together security infrastructure is woefully inadequate for stopping modern, sophisticated threats.The lack of visibility and fragmented oversight across poorly integrated systems limits insights and compromises security across all environments. With network attacks booming, endpoints under duress from ransomware, and massive amounts of malware hiding in encrypted traffic, it's never been more important to centralize and unify the security of network environments, users, and devices.To read this article in full, please click here | Malware | ||
|
2022-10-10 02:00:00 | Secure web browsers for the enterprise compared: How to pick the right one (lien direct) | The web browser has long been the security sinkhole of enterprise infrastructure. While email is often cited as the most common entry point, malware often enters via the browser and is more difficult to prevent. Phishing, drive-by attacks, ransomware, SQL injections, man-in-the-middle (MitM), and other exploits all take advantage of the browser's creaky user interface and huge attack surface, and the gullibility of most end users.It is this last item -- humans -- that is the problem, and we need to be protected against ourselves. This is especially true as SaaS applications grow in usage, not to mention that every piece of hardware seems to come with a web server (and therefore a browser) to configure it. These use cases are aided and abetted by the increasing number of work-from-home staffers who depend on more browser-based apps, thanks to the pandemic.To read this article in full, please click here | Malware | ||
|
2022-10-03 08:42:00 | LiveAction adds new SOC-focused features to ThreatEye NDR platform (lien direct) | End-to-end network security and performance visibility vendor LiveAction has announced new security operations center (SOC) focused updates to its Network Detection and Response (NDR) platform, ThreatEye. In a press release, the firm stated that the platform features a new user interface (UI) designed to enhance the ability of SOC analysts to correlate findings and policy violations to track incidents.The platform offers enhanced predicative threat intelligence capabilities that allow SOC analysts to identify and track domains and IP addresses not yet active but registered by threat actors and associated malware campaigns. It also includes packet-based behavioral fingerprinting to identify behavior in encrypted traffic streams and host-based behavioral analysis, LiveAction added.To read this article in full, please click here | Malware Threat | ||
|
2022-09-30 13:12:00 | Cyberespionage group developed backdoors tailored for VMware ESXi hypervisors (lien direct) | Researchers have identified a new malware family that was designed to backdoor and create persistence on VMware ESXi servers by leveraging legitimate functionality the hypervisor software supports. According to researchers from Mandiant who found and analyzed the backdoors, they were packaged and deployed on infected servers as vSphere Installation Bundles (VIBs). VIBs are software packages used to distribute components that extend VMware ESXi functionality. The malicious VIBs provided hackers with remote command execution and persistence capabilities on the servers and the ability to execute commands on the guest virtual machines running on the servers.To read this article in full, please click here | Malware | ||
|
2022-09-28 08:03:00 | UK organizations, Ukraine\'s allies warned of potential "massive" cyberattacks by Russia (lien direct) | The head of the UK National Cyber Security Centre (NCSC) Lindy Cameron has given an update on Russia's cyber activity amid its war with Ukraine. Her speech at Chatham House today comes just a few days after Ukraine's military intelligence agency issued a warning that Russia was “preparing massive cyberattacks on the critical infrastructure of Ukraine and its allies.” This coincides with a new Forrester report that reveals the extent to which the cyber impact of the Russia-Ukraine conflict has expanded beyond the conflict zone with malware attacks propagating into European entities.UK NCSC CEO urges UK businesses to prepare for elevated alert Addressing Russian cyber activity this year, Cameron stated that, while we have not seen the “cyber-Armageddon” some predicted, there has been a “very significant conflict in cyberspace – probably the most sustained and intensive cyber campaign on record – with the Russian State launching a series of major cyberattacks in support of their illegal invasion in February.”To read this article in full, please click here | Malware | ||
|
2022-09-23 13:42:00 | SEO poisoning campaign directs search engine visitors from multiple industries to JavaScript malware (lien direct) | Researchers have discovered a high-effort search engine optimization (SEO) poisoning campaign that seems to be targeting employees from multiple industries and government sectors when they search for specific terms that are relevant to their work. Clicking on the malicious search results, which are artificially pushed higher in ranking, lead visitors to a known JavaScript malware downloader."Our findings suggest the campaign may have foreign intelligence service influence through analysis of the blog post subjects," researchers from security firm Deepwatch said in a new report. "The threat actors used blog post titles that an individual would search for whose organization may be of interest to a foreign intelligence service e.g., 'Confidentiality Agreement for Interpreters.' The Threat Intel Team discovered the threat actors highly likely created 192 blog posts on one site."To read this article in full, please click here | Malware Threat Guideline | ||
|
2022-09-08 14:14:00 | North Korean state-sponsored hacker group Lazarus adds new RAT to its malware toolset (lien direct) | Security researchers have discovered a new remote access Trojan (RAT) being used in attack campaigns this year by Lazarus, a threat actor tied to the North Korean government. The new RAT has been used alongside other malware implants attributed to Lazarus and it's mainly used in the first stages of an attack.Dubbed MagicRAT, the new Lazarus malware program was developed using Qt, a framework commonly used to develop graphical user interfaces for cross-platform applications. Since the Trojan doesn't have a GUI, researchers from Cisco Talos believe the reason for using Qt was to make detection harder.To read this article in full, please click here | Malware Threat | APT 38 | |
|
2022-09-01 06:15:00 | BrandPost: CIS Hardened Images Built on Google Cloud\'s Shielded VMs (lien direct) | Today, attackers use various types of malware to target organizations' cloud environments. Those threats include rootkits and bootkits. According to Malwarebytes, rootkits are tools through which cyber threat actors (CTAs) can achieve root (i.e. the highest level) permissions on an infected system for conducting reconnaissance, moving laterally to other network devices, and/or stealing sensitive information. Bootkits are similar to rootkits, noted Positive Technologies, the major difference being that bootkits activate before an operating system (OS) and, by extension, its various security mechanisms finish booting up.To read this article in full, please click here | Malware Threat | ★★ | |
|
2022-08-30 03:37:00 | Multi-stage crypto-mining malware hides in legitimate apps with month-long delay trigger (lien direct) | Researchers have discovered a new multi-stage malware delivery campaign that relies on legitimate application installers distributed through popular software download sites. The malicious payload delivery, which includes a cryptocurrency mining program, is done in stages with long delays that can add up to almost a month."After the initial software installation, the attackers delayed the infection process for weeks and deleted traces from the original installation," researchers from security firm Check Point Software Technologies said in a new report. "This allowed the campaign to successfully operate under the radar for years."To read this article in full, please click here | Malware | ||
|
2022-08-25 06:00:00 | DNS data indicates increased malicious domain activity, phishing toolkit reuse (lien direct) | New research from cybersecurity vendor Akamai has revealed that 12.3% of monitored devices communicated with domains associated with malware or ransomware at least once during the second quarter of 2022. This represented a 3% increase compared to Q1 2022, the firm stated, with phishing toolkits playing a key role in malicious domain-related activity. The findings are based on DNS data and Akamai's visibility into carrier and enterprise traffic across different industries and geographies.Increased malware, phishing, C2 domain activity detected in Q2 2022 In a blog post detailing its research, Akamai stated that, in addition to the devices it detected communicating with domains associated with malware/ransomware, a further 6.2% of devices accessed phishing domains with 0.8% accessing command-and-control (C2)-associated domains (both small increases on Q1 2022). “While this number might seem insignificant, the scale here is in the millions of devices,” the firm wrote. “When this is considered, with C2 being the most malignant of threats, this is not only significant, it's cardinal.”To read this article in full, please click here | Ransomware Malware | ||
|
2022-08-10 04:08:00 | OPSWAT launches new malware analysis capabilities for ICS, OT networks (lien direct) | Critical infrastructure cybersecurity vendor OPSWAT has announced new malware analysis capabilities for IT and operational technology (OT). Revealed at the Black Hat USA 2022 Conference, enhancements include OPSWAT Sandbox for OT with detection of malicious communications on OT network protocols and support for open-source third-party tools in OPSWAT's MetaDefender Malware Analyzer platform, the firm stated. The release comes amid increasing cyberthreats surrounding OT networks in industrial control systems (ICS).To read this article in full, please click here | Malware | ||
|
2022-07-29 02:00:00 | July was a hot month for cybersecurity research (lien direct) | While summer may be vacation season, criminals never take a day off. Researchers are also always busy following their methods and digging into their possible path for exploit. Here are a few interesting research initiatives making headlines this month.Fake Android apps keep popping up in Google Play When folks download mobile applications from a trusted app source, obviously the expectation is the apps with be safe to use. But unfortunately, that is not always the case.While it is not a new issue, recent findings from both Zscaler ThreatLabz and Pradeo reveal that malware-laden Android apps in Google's app store-Google Play-continue to be a problem. The latest findings point to multiple instances of apps with the Joker, Facestealer, and Coper malware families in the marketplace. To read this article in full, please click here | Malware | ||
|
2022-07-27 03:55:00 | Sophisticated UEFI rootkit of Chinese origin shows up again in the wild after 3 years (lien direct) | A sophisticated rootkit that's able to insert itself into the lowest levels of Windows computers -- the motherboard firmware -- has been making victims since 2020 after disappearing from the radar for around three years. The rootkit, dubbed CosmicStrand by researchers from Kaspersky Lab, is stealthy and highly persistent since its code is stored deep in the UEFI, outside the detection scope of most security programs.The Unified Extensible Firmware Interface (UEFI) is the modern equivalent to the BIOS. It's the firmware that contains the necessary drivers to initialize and configure all hardware components of a computer before the main operating system starts and takes over. While BIOS rootkits used to be a relatively common occurrence many years ago, the UEFI has better security protections, so UEFI malware is relatively rare.To read this article in full, please click here | Malware | ||
|
2022-07-26 13:16:00 | New Facebook malware targets business accounts (lien direct) | Helsinki-based cybersecurity vendor WithSecure (formerly F-Secure Business) says it has discovered an operation, dubbed “DUCKTAIL,” that uses social media-based spear phishing attacks to gain access to Facebook Business accounts.The company said that it has “high confidence” that a Vietnamese threat actor is behind the attacks, which aim malicious messages at LinkedIn users who are likely to have admin access to their companies' Facebook accounts. The threat actor also targets email addresses of potential victims directly.What makes the attack unique, according to WithSecure, is the infostealer malware component, which is designed specifically to gain access to Facebook Business accounts. Previous attacks targeting Facebook did not target Facebook Business accounts in particular. If a victim can be induced to open a malicious link, the malware scans the infected computer for browsers and extracts cookies that indicate authenticated Facebook sessions for use in gaining access to those accounts. Command and control is handled via the Telegram messaging service, using the Telegram Bot system, and private data is also sent back to the hacker in this way.To read this article in full, please click here | Malware Threat | ||
|
2022-07-22 11:20:00 | Cybercrime escalates as barriers to entry crumble (lien direct) | An underground economy that mirrors its legitimate ecommerce counterpart is supercharging online criminal behavior, according to a report released Thursday by HP Wolf Security in collaboration with Forensic Pathways. Cybercriminals are now operating on a professional footing with easy-to-launch malware and ransomware attacks being offered on a software-as-a-service (SaaS) basis, allowing people with even rudimentary IT skills to launch cyberattacks at targets of their choosing, the report notes.It found that competition in the underground has driven down the price of malicious tools, making them affordable to anyone. In an analysis of 174 exploits advertised on the dark web, HP Wolf researchers found an overwhelming number (91%) were selling for less than $10. A look at 1,653 malware ads revealed more than three quarters (76%) selling for under $10. And on average, information stealers were selling for $5, remote access Trojans (RATs) for $3, exploits for $2.23, and crypters for $1.To read this article in full, please click here | Ransomware Malware | ||
|
2022-07-20 06:00:00 | Perception Point launches managed security service to help eliminate web browser threats (lien direct) | Perception Point has announced the launch of a new managed security service designed to eliminate web browser threats to organizations. According to the firm, Perception Point Advanced Browser Security adds managed, enterprise-grade security to native Chrome and Edge browsers allowing users to browse the web or access SaaS applications without exposing enterprise data to risk. The release is reflective of a growing trend of security products coming to market to provide advanced security for native browsers.Advanced Browser Security designed to isolate, detect and remediate web threats In a press release, Perception Point said the new solution fuses patented browser security technology powered by web isolation platform Hysolate, which it acquired earlier this year, and its own multi-layer detection engines. This combination delivers the ability to isolate, detect and remediate threats from the web, including phishing, ransomware, malware and APTs. Advanced Browser Security also secures access to sensitive corporate apps via an isolated, trusted Chrome or Edge browser, the firm added.To read this article in full, please click here | Malware | ||
|
2022-07-08 13:08:00 | Feds wave red flag over Maui ransomware (lien direct) | A cybersecurity advisory about the ransomware known as Maui has been issued by the FBI, CISA and U.S. Treasury Department. The agencies assert that North Korean state-sponsored cyber actors have used the malware since at least May 2021 to target healthcare and public health sector organizations.The FBI surmises that the threat actors are targeting healthcare organizations because those entities are critical to human life and health, so they're more likely to pay ransoms rather than risk disruption to their services. For that reason, the FBI and other agencies issuing the advisory maintain the state-sponsored actors will continue to target healthcare organizations.To read this article in full, please click here | Ransomware Malware Threat | ||
|
2022-06-27 02:00:00 | 5 years after NotPetya: Lessons learned (lien direct) | On June 27, 2017, the eve of Ukraine's Constitution Day holiday, a major global cyberattack was launched, infecting more than 80 companies in that country using a brand-new cyber pathogen that became known as NotPetya. NotPetya didn't stay within Ukraine's borders but spilled out to infect and cause havoc for thousands of organizations across Europe and worldwide.NotPetya was so named because it was similar to but different from Petya, a self-propagating ransomware virus discovered in 2016 that, unlike other nascent forms of ransomware at the time, was incapable of being decrypted. In another departure from the earlier forms of ransomware, Petya also overwrote and encrypted master boot records and was, therefore, considered more a form of wiper malware than bona fide ransomware.To read this article in full, please click here | Ransomware Malware | NotPetya NotPetya | |
|
2022-06-21 21:00:00 | BrandPost: What Every Enterprise Can Learn from Russia\'s Cyber Assault on Ukraine (lien direct) | In January, the Microsoft Threat Intelligence Center (MSTIC) discovered wiper malware in more than a dozen networks in Ukraine. Designed to look like ransomware but lacking a ransom recovery mechanism, we believe this malware was intended to be destructive and designed to render targeted devices inoperable rather than obtain a ransom. We alerted the Ukrainian government and published our findings.To read this article in full, please click here | Ransomware Malware Threat | ||
|
2022-06-21 13:28:00 | APT actor ToddyCat hits government and military targets in Europe and Asia (lien direct) | Researchers from Kaspersky Lab have published an analysis of a previously undocumented advanced persistent threat (APT) group that they have dubbed ToddyCat.The threat actor, which has targeted high-profile organizations in Asia and Europe, often breaks into organizations by hacking into internet-facing Microsoft Exchange servers, following up with a multi-stage infection chain that deploys two custom malware programs."We still have little information about this actor, but we know that its main distinctive signs are two formerly unknown tools that we call 'Samurai backdoor' and 'Ninja Trojan'," the researchers said.To read this article in full, please click here | Malware Tool Threat | ||
|
2022-06-15 08:43:00 | New peer-to-peer botnet Panchan hijacks Linux servers (lien direct) | Researchers warn of a new worm that's infecting Linux servers by brute-forcing and stealing SSH credentials. The hijacked servers are joined in a botnet and are used to mine cryptocurrency by loading mining programs directly in memory with no files on disk.Dubbed Panchan by researchers from Akamai, the malware is written in the Go programming language, which allows it to be platform independent. It first appeared in late March and has infected servers in all regions of the world since then, though Asia does seem to have a bigger concentration. The most impacted vertical seems to be education."This might be due to poor password hygiene, or it could be related to the malware's unique lateral movement capability with stolen SSH keys," the Akamai team said in a blog post. "Researchers in different academic institutions might collaborate more frequently, and require credentials to authenticate to machines that are outside of their organization/network, than employees in the business sector. To strengthen that hypothesis, we saw that some of the universities involved were from the same country - Spain, or others from the same region, like Taiwan and Hong Kong."To read this article in full, please click here | Malware | ||
|
2022-06-10 02:00:00 | 9 types of computer virus and how they do their dirty work (lien direct) | The human mind loves to categorize things, and malware is no exception. We here at CSO have done our part: our malware explainer breaks down malware based on how it spreads (self-propagating worms, viruses piggybacking on other code, or sneakily disguised Trojans) as well as by what it does to infected machines (rootkits, adware, ransomware, cryptojacking, and malvertising, oh my).To read this article in full, please click here | Malware | ||
|
2022-06-09 07:48:00 | Hackers using stealthy Linux backdoor Symbiote to steal credentials (lien direct) | Researchers have come across a stealthy Linux backdoor that uses sophisticated techniques to hide itself on compromised servers and steal credentials. Dubbed Symbiote because it injects itself into existing processes, the threat has been in development since at least November 2021 and seems to have been used against the financial sector in Latin America."Symbiote is a malware that is highly evasive," researchers from BlackBerry said in a new report. "Since the malware operates as a userland level rootkit, detecting an infection may be difficult. Network telemetry can be used to detect anomalous DNS requests and security tools such as AVs and EDRs should be statically linked to ensure they are not “infected” by userland rootkits."To read this article in full, please click here | Malware Tool Threat | ||
|
2022-06-09 02:00:00 | 11 infamous malware attacks: The first and the worst (lien direct) | Viruses and other malware spreading for sinister or baffling reasons has been a staple of cyberpunk novels and real-life news stories alike for decades. And in truth, there have been computer viruses on the internet since before it was the internet. This article will take a look at some of the most important milestones in the evolution of malware: These entries each represent a novel idea, a lucky break that revealed a gaping security hole, or an attack that turned to be particularly damaging-and sometimes all three.To read this article in full, please click here | Malware | ||
|
2022-06-02 02:00:00 | Ransomware roundup: System-locking malware dominates headlines (lien direct) | As we head into the unofficial start of summer, it does not appear the criminal groups that run ransomware schemes are planning to take any time to rest. Ransomware was all over the infosec news headlines in the past week, with one new report revealing that its presence has grown more in the last year than in the past several years combined.Here's roundup of noteworthy ransomware stories you might have missed.DBIR finds ransomware increased by double digits Verizon Business' annual Data Breach Investigations Report (DBIR) is out and confirms what many CISOs already know: ransomware continues to plague business. Ransomware-related breach instances rose 13%, an increase larger than in the past 5 years combined.To read this article in full, please click here | Ransomware Data Breach Malware | ||
|
2022-05-30 02:00:00 | Linux malware is on the rise-6 types of attacks to look for (lien direct) | Linux is a coveted target. It is the host operating system for numerous application backends and servers and powers a wide variety of internet of things (IoT) devices. Still, not enough is done to protect the machines running it."Linux malware has been massively overlooked," says Giovanni Vigna, senior director of threat intelligence at VMware. "Since most of the cloud hosts run Linux, being able to compromise Linux-based platforms allows the attacker to access an enormous amount of resources or to inflict substantial damage through ransomware and wipers."To read this article in full, please click here | Malware Threat | ||
|
2022-05-25 07:02:00 | Chaos ransomware explained: A rapidly evolving threat (lien direct) | The Chaos ransomware builder started out last year as a buggy and unconvincing impersonation of the notorious Ryuk ransomware kit. It has since gone through active development and rapid improvements that have convinced different attacker groups to adopt it. The latest version, dubbed Yashma, was first observed in the wild in mid-May and contains several enhancements.One successful ransomware operation known as Onyx hit U.S.-based emergency services, medical facilities and organizations from several other industries over the past year. It uses a variation of the Chaos ransomware, according to security researchers."What makes Chaos/Yashma dangerous going forward is its flexibility and its widespread availability," researchers from BlackBerry said in a new report. "As the malware is initially sold and distributed as a malware builder, any threat actor who purchases the malware can replicate the actions of the threat group behind Onyx, developing their own ransomware strains and targeting chosen victims."To read this article in full, please click here | Ransomware Malware Threat | ||
|
2022-05-18 04:31:00 | BrandPost: The Evolving Role of the Firewall in a Hybrid Workplace (lien direct) | The workplace is indelibly changing, according to the latest data from Gallup [1]. Organizations expect that moving forward only 23% of their employees will be fully on-site, 24% will be exclusively remote, and 53% will split their time between working at home and in the office.This widely distributed workforce model offers benefits for both employers and employees - including greater flexibility and productivity. However, there are new IT challenges, too, such as the need to provide high-performance remote access for increased video and audio conferencing.Many mid-range enterprise firewalls weren't designed for the volume of throughput necessary to support a hybrid workforce. On top of that, all the filtering and processing it must do to protect against malware over encrypted traffic ultimately slows down Internet speed.To read this article in full, please click here | Malware | ||
|
2022-05-18 02:00:00 | Top Linux endpoint protection software (lien direct) | I've been running the Linux desktop since the great desktop debate was between C Shell and Bash. I've never felt a need for a Linux antivirus program. But, that's not to say that I thought I could get away without Linux desktop or server security. Far from it! While I use third-party programs like the ones below, I rely on good security practices to secure my system.Mind you, in recent years we've seen an enormous increase in Linux malware. According to security company Crowdstrike, Linux malware increased by 35% in 2021 compared to 2020. Before you tear your hair out keep in mind that the vast majority of these attacks are not targeting Linux servers or cloud instances. Instead, Crowdstrike reports, XorDDoS, Mirai and Mozi, the biggest Linux-based malware families, go after the low-hanging fruit of internet of things (IoT) devices.To read this article in full, please click here | Malware | ||
|
2022-05-11 03:54:00 | New RAT malware uses sophisticated evasion techniques, leverages COVID-19 messaging (lien direct) | Researchers at cybersecurity vendor Proofpoint have analyzed a new remote access Trojan (RAT) malware campaign using sophisticated evasion techniques and leveraging COVID-19 themed messaging to target global organizations. The malware, dubbed “Nerbian RAT” and written in the Go programming language, uses significant anti-analysis and anti-reversing capabilities and open-source Go libraries to conduct malicious activities, the researchers stated.The campaign was first analyzed by Proofpoint in late April and disproportionately impacts entities in Italy, Spain and the UK. In a statement, Proofpoint Vice President Threat Research and Detection Sherrod DeGrippo said the research demonstrates how malware authors continue to operate at the intersection of open-source capability and criminal opportunity.To read this article in full, please click here | Malware Threat | ||
|
2020-12-21 02:00:00 | How to prepare for the next SolarWinds-like threat (lien direct) | The insertion of malware into SolarWinds' popular Orion network management software sent the federal government and major parts of corporate America scrambling this week to investigate and mitigate what could be the most damaging breach in US history. The malware, which cybersecurity company FireEye (itself the first public victim of the supply chain interference) named SUNBURST, is a backdoor that can transfer and execute files, profile systems, reboot machines and disable system services. | Malware Threat | Solardwinds |
To see everything:
Our RSS (filtrered)
