What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2025-05-05 13:21:50 | L'Azerbaïdjan blâme les pirates d'État russes pour les cyberattaques sur les médias locaux Azerbaijan blames Russian state hackers for cyberattacks on local media (lien direct) |
Le groupe de piratage soutenu par le Kremlin, connu sous le nom d'APT29, était responsable d'une cyberattaque de février sur les médias locaux, a déclaré le gouvernement de l'Azerbaïdjan, qui a décidé de réduire l'influence russe récemment.
The Kremlin-backed hacking group known as APT29 was responsible for a February cyberattack on local media, said Azerbaijan\'s government, which has moved to reduce Russian influence recently. |
APT 29 | ★★★ | |
 |
2025-04-21 08:11:18 | Les pirates russes ciblent les diplomates européens avec des escroqueries de phishing \\ ' Russian Hackers Target European Diplomats with \\'Wine-Tasting\\' Phishing Scams (lien direct) |
> Un groupe de piratage lié à l'État russe accélère ses cyberattaques contre des cibles diplomatiques à travers l'Europe, en utilisant un nouvel outil de logiciel malveillant furtif connu sous le nom de «grapeloader» pour fournir des charges utiles malveillantes par des e-mails de phishing intelligemment déguisés. Selon Check Point Research, la campagne a commencé en janvier 2025 et est réalisée par APT29 - également connue sous le nom de […]
>A Russian state-linked hacking group is ramping up its cyberattacks against diplomatic targets across Europe, using a new stealthy malware tool known as “GrapeLoader” to deliver malicious payloads through cleverly disguised phishing emails. According to Check Point Research, the campaign began in January 2025 and is being carried out by APT29 - also known as […] |
Malware Tool | APT 29 | ★★★ |
 |
2025-04-20 10:28:00 | APT29 déploie des logiciels malveillants de grapeloder ciblant les diplomates européens à travers des leurres de dégustation de vin APT29 Deploys GRAPELOADER Malware Targeting European Diplomats Through Wine-Tasting Lures (lien direct) |
L'acteur de menace parrainé par l'État russe connu sous le nom d'APT29 a été lié à une campagne de phishing avancée qui ciblait les entités diplomatiques à travers l'Europe avec une nouvelle variante de Wineloader et un chargeur de logiciel malveillant non signalé auparavant Grapelaader.
"Alors que la variante améliorée de Wineloader est toujours une porte dérobée modulaire utilisée à des stades ultérieurs, Grapeloader est un outil à étage initial nouvellement observé
The Russian state-sponsored threat actor known as APT29 has been linked to an advanced phishing campaign that\'s targeting diplomatic entities across Europe with a new variant of WINELOADER and a previously unreported malware loader codenamed GRAPELOADER. "While the improved WINELOADER variant is still a modular backdoor used in later stages, GRAPELOADER is a newly observed initial-stage tool |
Malware Tool Threat | APT 29 | ★★ |
 |
2025-04-19 18:13:05 | Le leurre à vin confortable Drops Vineloader malware sur les diplomates de l'UE Cozy Bear\\'s Wine Lure Drops WineLoader Malware on EU Diplomats (lien direct) |
Midnight Blizzard (APT29 / Cozy Bear) cible les ambassades et les ministères européens des affaires étrangères avec des e-mails de phishing sophistiqués déguisés en…
Midnight Blizzard (APT29/Cozy Bear) targets European embassies and Ministries of Foreign Affairs with sophisticated phishing emails disguised as… |
Malware | APT 29 | ★★★ |
 |
2025-04-16 12:29:09 | Les Russes attirent les diplomates européens dans un piège malveillant avec une invitation à la dégustation du vin Russians lure European diplomats into malware trap with wine-tasting invite (lien direct) |
Le cépage du phishing vintage s'est amélioré avec l'âge La Russie n'arrête jamais d'utiliser des tactiques éprouvées, et son ours confortable, alias APT 29, les cyber-espaces essaient à nouveau d'attirer les diplomates européens pour télécharger des logiciels malveillants avec une invitation lux.…
Vintage phishing varietal has improved with age Russia never stops using proven tactics, and its Cozy Bear, aka APT 29, cyber-spies are once again trying to lure European diplomats into downloading malware with a phony invitation to a lux event.… |
Malware | APT 29 | ★★★ |
|
2025-04-16 10:01:45 | Les pirates APT29 utilisent le grapeloader dans une nouvelle attaque contre les diplomates européens APT29 Hackers Use GRAPELOADER in New Attack Against European Diplomats (lien direct) |
> Check Point Research (RCR) a découvert une nouvelle campagne de phishing ciblée en utilisant Grapeloader, un téléchargeur de stade initial sophistiqué, lancé par le célèbre groupe de piratage lié à la russe, APT29, connu alternativement sous le nom de Midnight Blizzard ou Cozy Bear. Cette campagne, identifiée depuis janvier 2025, se concentre principalement sur les gouvernements européens et les entités diplomatiques. Présentation de la campagne APT29, reconnue pour son cyber sophistiqué […]
>Check Point Research (CPR) has uncovered a new targeted phishing campaign employing GRAPELOADER, a sophisticated initial-stage downloader, launched by the notorious Russian-linked hacking group APT29, known alternatively as Midnight Blizzard or Cozy Bear. This campaign, identified since January 2025, primarily focuses on European governments and diplomatic entities. Campaign Overview APT29, recognized for its sophisticated cyber […] |
APT 29 | ★★★ | |
 |
2025-04-15 16:11:23 | Vague d'attaques de phishing inspirées du vin cible les diplomates de l'UE Wave of Wine-Inspired Phishing Attacks Targets EU Diplomats (lien direct) |
La dernière campagne d'APT29 \\ soutenue par la Russie utilise à nouveau des invitations malveillantes à des événements de dégustation de vin comme leurre, mais cette fois cible un ensemble différent de millésimes - Errr, victimes - et livre une nouvelle porte dérobée, grapeloader.
Russia-backed APT29\'s latest campaign once again uses malicious invites to wine-tasting events as its lure, but this time targets a different set of vintages - errr, victims - and delivers a novel backdoor, GrapeLoader. |
APT 29 | ★★★ | |
 |
2025-04-15 13:00:52 | Démasking APT29: La campagne de phishing sophistiquée ciblant la diplomatie européenne Unmasking APT29: The Sophisticated Phishing Campaign Targeting European Diplomacy (lien direct) |
> La recherche sur le point de contrôle des exécutions exécutive a observé une campagne de phishing sophistiquée menée par Advanced Persistance Menace (APT) 29, un groupe de menaces lié à la Russie. L'opération a ciblé les organisations diplomatiques à travers l'Europe. La campagne semble poursuivre une opération précédente appelée Wineloader, qui imite un grand ministère européen des Affaires étrangères pour distribuer de fausses invitations aux événements diplomatiques, le plus souvent des événements de dégustation du vin. La campagne, qui a été répandue par e-mails de phishing, a utilisé un nouveau logiciel malveillant surnommé Grapeloader. Une nouvelle variante de Wineloader a également été découverte, probablement utilisée à un stade ultérieur de la campagne. INTRODUCTION CHECK Point Research (RCR) a identifié une vague significative de […]
>Executive Summary Check Point Research has been observing a sophisticated phishing campaign conducted by Advanced Persistent Threat (APT) 29, a Russian-linked threat group. The operation targeted diplomatic organizations throughout Europe. The campaign appears to continue a previous operation called Wineloader, which impersonates a major European foreign affairs ministry to distribute fake invitations to diplomatic events, most commonly wine-tasting events. The campaign, which was spread via phishing emails, used a new malware dubbed Grapeloader. A new variant of Wineloader was also discovered, likely used in a later stage of the campaign. Introduction Check Point Research (CPR) identified a significant wave of […] |
Malware Threat | APT 29 | ★★★ |
|
2025-04-15 13:00:37 | Campagne de phishing renouvelée APT29 contre les diplomates européens Renewed APT29 Phishing Campaign Against European Diplomats (lien direct) |
> FAITES POURRIEURS INTRODUCTION À partir de janvier 2025, Check Point Research (RCR) a suivi une vague d'attaques de phishing ciblées destinées aux gouvernements européens et aux diplomates. Les techniques, tactiques et procédures (TTP) observées dans cette campagne s'alignent avec les campagnes de Wineloader, qui ont été attribuées à l'APT29, un groupe de menaces liées à la Russie. APT29, également communément appelé Midnight Blizzard […]
>Highlights Introduction Starting in January 2025, Check Point Research (CPR) has been tracking a wave of targeted phishing attacks aimed at European governments and diplomats. The Techniques, Tactics and Procedures (TTPs) observed in this campaign align with the WINELOADER campaigns, which were attributed to APT29, a Russia linked threat group. APT29, also commonly referred to as Midnight Blizzard […] |
Threat | APT 29 | ★★★ |
 |
2025-02-11 20:00:00 | Cybercrime: A Multifaceted National Security Threat (lien direct) | Executive Summary Cybercrime makes up a majority of the malicious activity online and occupies the majority of defenders\' resources. In 2024, Mandiant Consulting responded to almost four times more intrusions conducted by financially motivated actors than state-backed intrusions. Despite this overwhelming volume, cybercrime receives much less attention from national security practitioners than the threat from state-backed groups. While the threat from state-backed hacking is rightly understood to be severe, it should not be evaluated in isolation from financially motivated intrusions. A hospital disrupted by a state-backed group using a wiper and a hospital disrupted by a financially motivated group using ransomware have the same impact on patient care. Likewise, sensitive data stolen from an organization and posted on a data leak site can be exploited by an adversary in the same way data exfiltrated in an espionage operation can be. These examples are particularly salient today, as criminals increasingly target and leak data from hospitals. Healthcare\'s share of posts on data leak sites has doubled over the past three years, even as the number of data leak sites tracked by Google Threat Intelligence Group has increased by nearly 50% year over year. The impact of these attacks mean that they must be taken seriously as a national security threat, no matter the motivation of the actors behind it. Cybercrime also facilitates state-backed hacking by allowing states to purchase cyber capabilities, or co-opt criminals to conduct state-directed operations to steal data or engage in disruption. Russia has drawn on criminal capabilities to fuel the cyber support to their war in Ukraine. GRU-linked APT44 (aka Sandworm), a unit of Russian military intelligence, has employed malware available from cybercrime communities to conduct espionage and disruptive operations in Ukraine and CIGAR (aka RomCom), a group that historically focused on cybercrime, has conducted espionage operations against the Ukrainian government since 2022. However, this is not limited to Russia. Iranian threat groups deploy ransomware to raise funds while simultaneously conducting espionage, and Chinese espionage groups often supplement their income with cybercrime. Most notably, North Korea uses state-backed groups to directly generate revenue for the regime. North Korea has heavily targeted cryptocurrencies, compromising exchanges and individual victims\' crypto wallets. Despite the overlaps in effects and collaboration with states, tackling the root causes of cybercrime requires fundamentally different solutions. Cybercrime involves collaboration between disparate groups often across borders and without respect to sovereignty. Any solution requires international cooperation by both law enforcement and intelligence agencies to track, arrest, and prosecute these criminals. Individual takedowns can have important temporary effects, but the collaborative nature of cybercrime means that the disrupted group will be quickly replaced by others offering the same service. Achieving broader success will require collaboration between countries and public and private sectors on systemic solutions such as increasing education and resilience efforts. aside_block | Ransomware Malware Tool Vulnerability Threat Legislation Medical Cloud Technical | APT 41 APT 38 APT 29 APT 43 APT 44 | ★★★ |
|
2024-12-18 16:45:00 | APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP (lien direct) | The Russia-linked APT29 threat actor has been observed repurposing a legitimate red teaming attack methodology as part of cyber attacks leveraging malicious Remote Desktop Protocol (RDP) configuration files.
The activity, which has targeted governments and armed forces, think tanks, academic researchers, and Ukrainian entities, entails adopting a "rogue RDP" technique that was previously
The Russia-linked APT29 threat actor has been observed repurposing a legitimate red teaming attack methodology as part of cyber attacks leveraging malicious Remote Desktop Protocol (RDP) configuration files. The activity, which has targeted governments and armed forces, think tanks, academic researchers, and Ukrainian entities, entails adopting a "rogue RDP" technique that was previously |
Threat | APT 29 | ★★★ |
|
2024-10-30 18:26:32 | Russian Cozy Bear Hackers Secteurs critiques Phish avec Microsoft, LS LURS Russian Cozy Bear Hackers Phish Critical Sectors with Microsoft, AWS Lures (lien direct) |
Les pirates russes parrainés par l'État, Cozy Bear, ciblent plus de 100 organisations dans le monde avec une nouvelle campagne de phishing.Ce sophistiqué & # 8230;
Russian state-sponsored hackers Cozy Bear are targeting over 100 organizations globally with a new phishing campaign. This sophisticated… |
APT 29 | ★★ | |
 |
2024-10-30 10:00:00 | La campagne APT29 Spearphishing cible des milliers de personnes avec des fichiers RDP APT29 Spearphishing Campaign Targets Thousands with RDP Files (lien direct) |
Microsoft a repéré une grande campagne de espionnage du groupe russe APT29 en utilisant RDP pour compromis
Microsoft has spotted a major spearphishing campaign from the Russian APT29 group using RDP for compromise |
APT 29 | ★★ | |
 |
2024-10-28 22:05:17 | (Déjà vu) Amazon a identifié les domaines Internet maltraités par APT29 Amazon identified internet domains abused by APT29 (lien direct) |
## Snapshot Amazon, building on reporting by the Computer Emergency Response Team of Ukraine (CERT-UA), identifed and disrupted a phishing campaign attributed to [Midnight Blizzard](https://security.microsoft.com/intel-explorer/articles/2c8cb717). ## Description The campaign, active since at least August 2024, has a broad target set and includes entities related to government, enterprise, and military in countries of interest to Russia. The group leveraged Ukrainian language phishing emails to collect its targets\' Windows credentials through Microsoft Remote Desktop. Many of the domains used by Midnight Blizzard spoofed Amazon Web Services (AWS), among other organizations. Amazon has siezed many of the domains to disrupt the campaign. ## Microsoft Analysis and Additional OSINT Context Microsoft attributes this malicious activity to [Midnight Blizzard](https://security.microsoft.com/intel-explorer/articles/2c8cb717) based on the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) reported by Amazon and CERT-UA. The actor Microsoft tracks as Midnight Blizzard is known to primarily target governments, diplomatic entities, NGOs, and IT service providers in primarily the United States and Europe. Their focus is to collect intelligence through longstanding and dedicated espionage of foreign interests that can be traced to early 2018 by leveraging the use of identity. Midnight Blizzard is consistent and persistent in their operational targeting and their objectives rarely change. They utilize diverse initial access methods ranging from stolen credentials to supply chain attacks, exploitation of on-premises environments to laterally move to the cloud, exploitation of service providers\' trust chain to gain access to downstream customers, and the Active Directory Federation Services (ADFS) malware known as FOGGYWEB and MAGICWEB. Midnight Blizzard is tracked by partner security companies as APT29, UNC2452, and Cozy Bear. ## Recommendations Microsoft recommends the following mitigations to reduce the impact of this threat. - Turn on [cloud-delivered protection](https://learn.microsoft.com/en-us/defender-endpoint/linux-preferences) in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats. - Run [EDR in block mode](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/edr-in-block-mode?view=o365-worldwide?ocid=magicti_ta_learndoc) so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach. - Allow [investigation and remediation](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/automated-investigations?view=o365-worldwide?ocid=magicti_ta_learndoc) in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume. - [Enable](https://learn.microsoft.com/en-us/defender-endpoint/enable-controlled-folders) controlled folder access. - Ensure that [tamper protection](https://learn.microsoft.com/en-us/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection#how-do-i-configure-or-manage-tamper-protection) is enabled in Microsoft Defender for Endpoint. - Enable [network protection](https://learn.microsoft.com/en-us/defender-endpoint/enable-network-protection) in Microsoft Defender for Endpoint. - Follow the credential hardening recommendations in the [on-premises credential theft overview](https://security.microsoft.com/threatanalytics3/9382203e-5155-4b5e-af74-21562b1004d5/analystreport) to defend against common credential theft techniques like LSASS access. - [Enable](https://learn.microsoft.com/en-u | Ransomware Malware Tool Threat Cloud | APT 29 | ★★★ |
|
2024-10-25 20:22:37 | L'APT29 de la Russie imite AWS pour voler des informations d'identification Windows Russia\\'s APT29 Mimics AWS to Steal Windows Credentials (lien direct) |
Kremlin Intelligence a mené une campagne de phishing à grande échelle contrairement à ses opérations habituelles et plus ciblées.
Kremlin intelligence carried out a wide-scale phishing campaign in contrast to its usual, more targeted operations. |
APT 29 | ★★★ | |
|
2024-10-14 21:26:20 | Faits saillants hebdomadaires, 14 octobre 2024 Weekly OSINT Highlights, 14 October 2024 (lien direct) |
## Snapshot Last week\'s OSINT reporting highlights a complex landscape of cyber threats with a focus on APT groups, sophisticated malware, and exploitation of vulnerabilities. Many attacks are espionage-focused, with China-aligned groups like CeranaKeeper, Iran\'s Hazel Sandstorm, and Russia\'s Midnight Blizzard (SVR) leveraging spearphishing and vulnerability exploitation for intelligence gathering. Ransomware also remains a dominant attack type, with threat actors leveraging double extortion tactics to maximize pressure on victims. A surge in reporting on malware distribution was also observed, including Lua-based malware in the education sector and Pronsis Loader delivering Lumma Stealer. Additionally, multiple reports detail widespread campaigns leveraging phishing, malvertising, and cryptomining, with key targets being government institutions, financial services, and critical infrastructure. Attackers employ diverse techniques such as DNS tunneling, USB-based malware, and exploit known vulnerabilities like EternalBlue (CVE-2017-0144) and FortiOS (CVE-2024-23113). ## Description Last week\'s OSINT reporting highlights a complex landscape of cyber threats with a focus on APT groups, sophisticated malware, and exploitation of vulnerabilities. Many attacks are espionage-focused, with China-aligned groups like CeranaKeeper, Iran\'s Hazel Sandstorm, and Russia\'s Midnight Blizzard (SVR) leveraging spearphishing and vulnerability exploitation for intelligence gathering. Ransomware also remains a dominant attack type, with threat actors leveraging double extortion tactics to maximize pressure on victims. A surge in reporting on malware distribution was also observed, including Lua-based malware in the education sector and Pronsis Loader delivering Lumma Stealer. Additionally, multiple reports detail widespread campaigns leveraging phishing, malvertising, and cryptomining, with key targets being government institutions, financial services, and critical infrastructure. Attackers employ diverse techniques such as DNS tunneling, USB-based malware, and exploit known vulnerabilities like EternalBlue (CVE-2017-0144) and FortiOS (CVE-2024-23113). 1. [CeranaKeeper Targets Thai Government](https://sip.security.microsoft.com/intel-explorer/articles/b3aa72ef): ESET uncovered a new China-aligned APT, CeranaKeeper, targeting government institutions in Thailand, using unique tools for data exfiltration via cloud services. The group adapts its malware for stealth and has been mistakenly linked to Mustang Panda due to some shared methods. 2. [Largest DDoS Attack Mitigated](https://sip.security.microsoft.com/intel-explorer/articles/74f06d55): Cloudflare mitigated the largest publicly disclosed DDoS attack, peaking at 3.8 Tbps, which targeted financial services, internet, and telecom organizations globally. Akamai also identified a critical vulnerability in CUPS servers, potentially creating a new vector for DDoS amplification. 3. [Cuckoo Spear\'s Sophisticated Tools](https://sip.security.microsoft.com/intel-explorer/articles/d47fc595): Cybereason exposed the Cuckoo Spear campaign by APT10, using NOOPLDR and NOOPDOOR to conduct espionage against Japanese industries and governments. These advanced tools employ anti-detection techniques and facilitate network pivoting for exfiltration. 4. [Mamba 2FA Phishing Campaign](https://sip.security.microsoft.com/intel-explorer/articles/bfcb80ed): Sekoia identified a phishing campaign using Mamba 2FA, a PhaaS platform, to steal credentials and session cookies from Microsoft services. Attackers exploited MFA weaknesses and used Telegram bots for data exfiltration. 5. [Golden Jackal\'s Air-Gapped System Attacks](https://sip.security.microsoft.com/intel-explorer/articles/f0234a25): ESET researchers discovered Golden Jackal targeting European government organizations with tools designed to breach air-gapped systems. The group uses USB-based malware for espionage and data exfiltration. 6. [Awaken Likho Targets Russian Agencies](https://sip.security.microsoft.com/in | Ransomware Malware Tool Vulnerability Threat Patching Industrial Medical Cloud | APT 29 APT 10 GoldenJackal | ★★ |
|
2024-10-11 09:45:00 | Le SVR de la Russie cible Zimbra, Serveurs TeamCity pour le cyber-espionnage Russia\\'s SVR Targets Zimbra, TeamCity Servers for Cyber Espionage (lien direct) |
L'APT29 soutenu par le Russie espère les organisations américaines et européennes depuis au moins 2021, a déclaré un avis commun de l'US-UK
Russian-backed APT29 has been spying on US and European organizations since at least 2021, a US-UK joint advisory said |
APT 29 | ★★ | |
|
2024-10-11 00:28:23 | Mise à jour sur les opérations de cyber et des exploitations de vulnérabilité SVR Update on SVR Cyber Operations and Vulnerability Exploitations (lien direct) |
#### Targeted Industries - Government Agencies & Services - Information Technology - Financial Services ## Snapshot Russia\'s Foreign Intelligence Service (SVR), also tracked as [Midnight Blizzard](https://sip.security.microsoft.com/intel-profiles/d825313b053efea45228ff1f4cb17c8b5433dcd2f86353e28be2d484ce874616) or APT29, has persistently targeted global entities in defense, technology, and finance sectors to gather intelligence and support cyber operations, including those related to the invasion of Ukraine. The U.S. and U.K. cyber agencies, including the NSA, FBI, U.S. Cyber Command\'s Cyber National Mission Force, and the U.K.\'s NCSC, have issued a joint advisory warning network defenders of these ongoing attacks. ## Description SVR actors exploit vulnerabilities for initial access, use techniques such as spearphishing and password spraying, and rely on obfuscation methods, including The Onion Router (TOR) network and proxies, to evade detection. The group\'s tactics, techniques, and procedures (TTPs) highlight a focus on exploiting known vulnerabilities, particularly through unpatched systems and weak authentication measures. For initial access, the actors leverage vulnerabilities like [CVE-2022-27924](https://sip.security.microsoft.com/intel-explorer/cves/CVE-2022-27924/) (Zimbra mail server) and [CVE-2023-42793](https://sip.security.microsoft.com/intel-profiles/CVE-2023-42793) (JetBrains TeamCity), allowing them to bypass authentication and execute arbitrary code. These vulnerabilities enable access to credentials, emails, and other sensitive data without victim interaction. Furthermore, SVR cyber actors engage in mass scanning to identify exposed systems and prioritize targets based on opportunity, often using compromised systems as infrastructure for subsequent attacks or as a launchpad for deeper network compromises. SVR also employs a range of techniques to maintain persistence and escalate privileges in victim networks. These include spearphishing via platforms like Microsoft Teams, where they impersonate technical support to gain account access, and password spraying to infiltrate poorly secured accounts. Once inside a network, SVR actors utilize living-off-the-land techniques, leveraging existing tools and software to blend into normal operations and evade detection. They also frequently lease infrastructure through resellers, relying on compromised accounts to maintain anonymity. In cases where detection is suspected, they act swiftly to destroy infrastructure and erase evidence, demonstrating a sophisticated approach to operational security. ## Microsoft Analysis Midnight Blizzard (NOBELIUM) is known to primarily target governments, diplomatic entities, NGOs, and IT service providers in primarily the United States and Europe. Their focus is to collect intelligence through longstanding and dedicated espionage of foreign interests that can be traced to early 2018 by leveraging the use of identity. Midnight Blizzard (NOBELIUM) is consistent and persistent in their operational targeting and their objectives rarely change. They utilize diverse initial access methods ranging from stolen credentials to supply chain attacks, exploitation of on-premises environments to laterally move to the cloud, exploitation of service providers\' trust chain to gain access to downstream customers, and the Active Directory Federation Services (ADFS) malware known as FOGGYWEB and MAGICWEB. Midnight Blizzard is tracked by partner security companies as APT29, UNC2452, and Cozy Bear. ## Recommendations Microsoft recommends the following mitigations to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations. While multi-factor authentication (MFA) has largely reduced the number of compromised organizations, threat actors like Midnight Blizzard constantly seek new ways to circumvent this barrier. Piloting and deploying [phishing-resistant authentication methods](https://l | Malware Tool Vulnerability Threat Cloud Technical | APT 29 | ★★★ |
 |
2024-10-10 14:49:36 | États-Unis, UK avertissant des pirates russes de l'APT29 ciblant Zimbra, TeamCity Serveurs US, UK warn of Russian APT29 hackers targeting Zimbra, TeamCity servers (lien direct) |
Les cyber-agences des États-Unis et du Royaume-Uni ont averti aujourd'hui que les pirates de pirates APT29 liés au service de renseignement étranger de Russie (SVR) ciblent les serveurs vulnérables de Zimbra et JetBrains TeamCity "à grande échelle".[...]
U.S. and U.K. cyber agencies warned today that APT29 hackers linked to Russia\'s Foreign Intelligence Service (SVR) target vulnerable Zimbra and JetBrains TeamCity servers "at a mass scale." [...] |
APT 29 | ★★ | |
|
2024-09-09 11:04:46 | Faits saillants hebdomadaires OSINT, 9 septembre 2024 Weekly OSINT Highlights, 9 September 2024 (lien direct) |
## Snapshot Last week\'s OSINT reporting highlights a broad spectrum of cyber threats with notable trends in malware campaigns, espionage, and ransomware attacks. Phishing remains a dominant attack vector, delivering a variety of payloads like custom backdoors, infostealers, and ransomware. Nation-state actors such as Russia\'s APT29 (Midnight Blizzard) and China\'s Earth Lusca were prominent, focusing on espionage and targeting specific regions like East Asia and the Middle East. Other notable threats included the use of deepfakes for scam campaigns and the exploitation of unpatched vulnerabilities in widely used software like Microsoft Office and WPS Office. The targeting of organizations ranged from government entities to private sector businesses, with some attacks focusing on specific industries like finance, healthcare, and technology. ## Description 1. [Unique Malware Campaign \'Voldemort\'](https://sip.security.microsoft.com/intel-explorer/articles/3cc65ab7): Proofpoint researchers uncovered a phishing campaign distributing custom malware via emails impersonating tax authorities across multiple countries. The malware, likely motivated by espionage, uses advanced techniques like abusing Google Sheets for command-and-control (C2) to avoid detection. 2. [Python-Based Infostealer \'Emansrepo\'](https://sip.security.microsoft.com/intel-explorer/articles/94d41800): FortiGuard Labs identified Emansrepo, a Python-based infostealer targeting browser data and files via phishing emails. The malware has evolved into a sophisticated multi-stage tool, expanding its capabilities to steal sensitive data like cryptocurrency wallets. 3. [Deepfake Scams Using Public Figures](https://sip.security.microsoft.com/intel-explorer/articles/6c6367c7): Palo Alto Networks researchers discovered deepfake scams impersonating public figures to promote fake investment schemes. These scams, involving a single threat actor group, target global audiences with AI-generated videos hosted on domains with significant traffic. 4. [Zero-Day Vulnerabilities in WPS Office](https://sip.security.microsoft.com/intel-explorer/articles/f897577d): ESET researchers identified two zero-day vulnerabilities in Kingsoft WPS Office exploited by the APT-C-60 group. The vulnerabilities allowed attackers to execute arbitrary code in targeted East Asian countries, using malicious documents to deliver a custom backdoor. 5. [KTLVdoor Malware Campaign](https://sip.security.microsoft.com/intel-explorer/articles/222628fc): Trend Micro uncovered KTLVdoor, a highly obfuscated backdoor developed by Earth Lusca, targeting Windows and Linux systems. The malware allows attackers to fully control infected systems and is primarily linked to Chinese-speaking actors. 6. [Fake Palo Alto GlobalProtect Tool](https://sip.security.microsoft.com/intel-explorer/articles/22951902): Trend Micro identified a campaign targeting Middle Eastern organizations with a fake version of Palo Alto GlobalProtect. The malware executes remote PowerShell commands and exfiltrates files while masquerading as a legitimate security solution. 7. [APT29 Targets Mongolian Government Websites](https://sip.security.microsoft.com/intel-explorer/articles/12b5ac31): Google TAG discovered that Russian APT29 used iOS and Chrome exploits to target Mongolian government websites. The attack, linked to commercial surveillance vendors, involved watering hole attacks to steal authentication cookies from targeted users. 8. [MacroPack-Abused Malicious Documents](https://sip.security.microsoft.com/intel-explorer/articles/cd8dec3b): Cisco Talos found malicious documents leveraging MacroPack to deliver payloads like Havoc and PhantomCore RAT. These documents used obfuscated macros and lures in multiple languages, complicating attribution to any single threat actor. 9. [Underground Ransomware by RomCom Group](https://sip.security.microsoft.com/intel-explorer/articles/e2a44c7c): FortiGuard Labs identified the Underground ransomware targeting Windows systems, deployed by the Russia-based RomCom | Ransomware Malware Tool Vulnerability Threat Prediction Medical Commercial | APT 38 APT 29 | ★★ |
|
2024-09-04 02:45:48 | Les attaquants soutenus par l'État et les vendeurs de surveillance commerciale utilisent à plusieurs reprises les mêmes exploits State-backed attackers and commercial surveillance vendors repeatedly use the same exploits (lien direct) |
## Snapshot Google\'s Threat Analysis Group (TAG) uncovered in-the-wild exploit campaigns targeting Mongolian government websites between November 2023 and July 2024. TAG attributes the attack to the Russian government-backed actor APT29, tracked by Microsoft as [Midnight Blizzard](https://sip.security.microsoft.com/intel-profiles/d825313b053efea45228ff1f4cb17c8b5433dcd2f86353e28be2d484ce874616). The attackers utilized exploits similar to those used by commercial surveillance vendors Intellexa and NSO Group. ## Description These campaigns delivered n-day exploits for iOS and Chrome, affecting unpatched devices. The initial infection vector was a watering hole attack on compromised websites that delivered iOS WebKit and Chrome exploits. The iOS campaigns delivered an exploit via [CVE-2023-41993](https://sip.security.microsoft.com/intel-explorer/cves/CVE-2023-41993/) targeting iPhone users running older versions. TAG\'s analysis revealed that the exploit is nearly identical to one used by commercial vendor Intellexa. This exploit loaded the same cookie stealer framework that TAG observed in March 2021, when a Russian state-backed attacker exploited [CVE-2021-1879](https://sip.security.microsoft.com/intel-explorer/cves/CVE-2021-1879/) to steal authentication cookies from major sites like LinkedIn, Gmail, and Facebook. Read more [here](https://sip.security.microsoft.com/intel-explorer/articles/4a4ab0bf)about Microsoft\'s coverage of Midnight Blizzard\'s malicious activity exploiting CVE-2021-1879. TAG also discovered a Google Chrome exploit chain that aimed to steal credential cookies from Android users. Similar to the iOS campaigns, this attack began with initial access gained through a watering hole. This attack chain exploited [CVE-2024-5274](http://CVE-2024-5274) to compromise the renderer - an exploit that Chrome Security previously discovered as an in-the-wild 0-day in May 2024 used by the commercial NSO Group. Additionally, the attackers leveraged [CVE-2024-4671](https://sip.security.microsoft.com/intel-explorer/cves/CVE-2024-4671/) to break out of Chrome site isolation. TAG is uncertain how suspected APT29 actors acquired the exploits used by commercial surveillance vendors. ### Additional Analysis Commercial surveillance vendors, including Intellexa and the NSO Group, have been the subject of significant scrutiny and criticism. These companies develop and sell advanced spyware tools to governments and law enforcement agencies for surveillance purposes. However, their products have been linked to unauthorized surveillance activities and [human rights concerns](https://www.siliconrepublic.com/enterprise/amnesty-international-intellexa-ireland-predator-spyware "https://www.siliconrepublic.com/enterprise/amnesty-international-intellexa-ireland-predator-spyware"). The NSO Group, known for its [Pegasus spyware](https://thehill.com/policy/cybersecurity/4053311-khashoggi-widow-suing-israeli-firm-says-spyware-caused-her-to-constantly-be-looking-over-her-shoulder/ "https://thehill.com/policy/cybersecurity/4053311-khashoggi-widow-suing-israeli-firm-says-spyware-caused-her-to-constantly-be-looking-over-her-shoulder/"), has faced criticism for its involvement in illegal surveillance. Similarly, Intellexa has been implicated in scandals involving the use of its Predator spyware to monitor U.S. officials, journalists, and policy experts. Both companies have been [sanctioned](https://www.icij.org/investigations/cyprus-confidential/spyware-firm-intellexa-hit-with-us-sanctions-after-cyprus-confidential-expose/ "https://www.icij.org/investigations/cyprus-confidential/spyware-firm-intellexa-hit-with-us-sanctions-after-cyprus-confidential-expose/") for their roles in distributing spyware to authoritarian regimes ## Recommendations Strengthen operating environment configuration - Keep operating systems and applications up to date. Apply security patches as soon as possible. Ensure that Google Chrome web browser is updated at version [128.0.6613.84](https://ch | Malware Tool Vulnerability Threat Legislation Mobile Commercial | APT 29 | ★★ |
|
2024-08-30 13:26:41 | APT29 russe à l'aide d'exploits de style groupe NSO dans les attaques, Google Russian APT29 Using NSO Group-Style Exploits in Attacks, Google (lien direct) |
Le groupe d'analyse des menaces de Google (TAG) a exposé une nouvelle campagne par APT29 soutenue par l'État russe, également connu sous le nom de Cozy & # 8230;
Google\'s Threat Analysis Group (TAG) has exposed a new campaign by Russian state-backed APT29, also known as Cozy… |
Threat | APT 29 | ★★ |
|
2024-08-30 10:30:00 | Les pirates russes utilisent des exploits commerciaux de logiciels spy pour cibler les victimes Russian Hackers Use Commercial Spyware Exploits to Target Victims (lien direct) |
Dans une campagne ciblant les sites Web du gouvernement mongol, les exploits à effet de levier APT29 soutenus par la Russie précédemment utilisés par Spyware Vendors NSO Group et Intellexa
In a campaign targeting Mongolian government websites, Russian-backed APT29 leveraged exploits previously used by spyware vendors NSO Group and Intellexa |
Commercial | APT 29 | ★★★ |
|
2024-08-29 20:03:11 | Oh, super.Les attaques développées par les vendeurs de logiciels espions sont réutilisées par les crétins confortables de la Russie Oh, great. Attacks developed by spyware vendors are being re-used by Russia\\'s Cozy Bear cretins (lien direct) |
Les chercheurs de Google notent les similitudes, ne peuvent pas trouver un lien Le groupe d'analyse des menaces de Google (TAG) a repéré une similitude inquiétante dans les tactiques d'attaque utilisées par les fournisseurs spyware commerciaux et la Russie-Les gangs d'attaque liés.…
Google researchers note the similarities, can\'t find a link Google\'s Threat Analysis Group (TAG) has spotted a disturbing similarity in attack tactics used by commercial spyware vendors and Russia-linked attack gangs.… |
Threat Commercial | APT 29 | ★★★★ |
 |
2024-08-29 13:00:00 | Google attrape les exploits de réutilisation de Russian APT de Spyware Merchants NSO Group, Intellexa Google Catches Russian APT Reusing Exploits From Spyware Merchants NSO Group, Intellexa (lien direct) |
> Google Tag publie des preuves montrant des similitudes identiques ou frappantes entre les exploits utilisés par les fournisseurs de logiciels espions APT29 et commerciaux de Russie.
>Google TAG publishes evidence showing identical or striking similarities between exploits used by Russia\'s APT29 and commercial spyware vendors. |
Commercial | APT 29 | ★★★ |
|
2024-08-29 09:04:58 | Les pirates russes APT29 utilisent iOS, Chrome Exploits créés par les fournisseurs de logiciels espions Russian APT29 hackers use iOS, Chrome exploits created by spyware vendors (lien direct) |
Le groupe de piratage APT29 parrainé par l'État russe a été observé à l'aide des mêmes exploits iOS et Android créés par des fournisseurs de logiciels spys commerciaux dans une série de cyberattaques entre novembre 2023 et juillet 2024. [...]
The Russian state-sponsored APT29 hacking group has been observed using the same iOS and Android exploits created by commercial spyware vendors in a series of cyberattacks between November 2023 and July 2024. [...] |
Mobile Commercial | APT 29 | ★★★ |
 |
2024-07-16 07:26:11 | Acteurs de menace \\ 'Arsenal: comment les pirates ciblent les comptes cloud Threat Actors\\' Arsenal: How Hackers Target Cloud Accounts (lien direct) |
Introduction In today\'s interconnected world, cloud computing has become the backbone of countless businesses. However, with this rise in cloud adoption, malicious actors have adapted their strategies to compromise sensitive data stored in cloud environments and propagate threats throughout supply chains. One prevalent method is the use of tools specifically designed to automate attacks against cloud accounts, resulting in account takeover (ATO) and business email compromise (BEC) incidents. Keeping up with a tradition of trying to understand the attackers\' perspective, Proofpoint cloud threat researchers have obtained and analyzed various hacking tools used by threat actors. In this blog series, we\'ll showcase a few examples and explore the largely uncovered world of these tools, while examining their functionalities, the risks they pose, and how organizations can defend against them. Understanding toolsets: basic concepts and terminology Attack toolsets are purposefully crafted to enable, automate, and streamline cyber-attacks en masse. These toolsets exploit diverse weaknesses, from frequent misconfigurations to old authentication mechanisms, in order to gain access to selected resources. Often, attack toolsets are designed with specific aims in mind. In recent years, cloud accounts have become prime targets. But getting your hands on effective tools is not so trivial. Some toolsets are only sold or circulated within restricted channels, such as closed Darknet hacking forums, while others (especially older versions) are publicly available online. With a rising demand for hacking capabilities, hacking-as-a-service (HaaS) has become a prominent business model in today\'s cyber threat landscape, providing convenient access to advanced hacking capabilities in exchange for financial gain. As such, it lowers entry barriers for cybercriminals, allowing them to execute attacks with minimal effort. Regardless of their complexity, every attack tool aiming to compromise cloud accounts must utilize an initial threat vector to gain unauthorized access. Proofpoint\'s ongoing monitoring of the cloud threat landscape has led its researchers to categorize the majority of observed attacks into two primary threat vectors: brute-force attacks and precision attacks. In terms of sheer volume, brute-force attacks, encompassing techniques such as password guessing and various other methods, continue to maintain their status as the most prevalent threat vector. Despite the statistical nature of these attacks and their reliance on a "spray and pray" approach, they remain a significant threat. According to our research, roughly 20% of all organizations targeted by brute-force attacks in 2023 experienced at least one successful account compromise instance. The surprising effectiveness of brute-force methods, combined with their relative simplicity, makes this vector appealing not only to common cybercriminals, but also to sophisticated actors. In January 2024, Microsoft disclosed that it had fallen victim to a nation-state attack attributed to the Russian state-sponsored group APT29 (also known as TA421 and Midnight Blizzard). According to Microsoft\'s announcement, the attackers employed password spraying to compromise a legacy, non-production test tenant account that lacked multifactor authentication (MFA). After gaining access, attackers were able to quickly leverage it and hijack additional assets, ultimately exfiltrating sensitive data from various resources. This incident emphasizes the potential risk that brute-force and password spraying attacks pose to inadequately protected cloud environments. A brute-force attack kill chain, targeting cloud environments using leaked credentials and proxy networks. Combo lists, proxy lists and basic authentication Combo lists play a crucial role in facilitating systematic and targeted credential stuffing attacks. These lists, comprised of curated email address and password pairs, serve as the basic ammunition for most tools. Attackers leverage combo lists to automate the pr | Spam Malware Tool Threat Prediction Cloud Technical | APT 29 | ★★★ |
|
2024-07-08 14:00:00 | Enhardi et évolutif: un instantané des cyber-menaces auxquelles l'OTAN est confrontée à l'OTAN Emboldened and Evolving: A Snapshot of Cyber Threats Facing NATO (lien direct) |
Written by: John Hultquist
As North Atlantic Treaty Organization (NATO) members and partners gather for a historic summit, it is important to take stock of one of its most pressing challenges-the cyber threat. The Alliance faces a barrage of malicious cyber activity from all over the globe, carried out by emboldened state-sponsored actors, hacktivists, and criminals who are willing to cross lines and carry out activity that was previously considered unlikely or inconceivable. In addition to military targets, NATO must consider the risks that hybrid threats like malicious cyber activity pose to hospitals, civil society, and other targets, which could impact resilience in a contingency. The war in Ukraine is undoubtedly linked to escalating cyber threat activity, but many of these threats will continue to grow separately and in parallel. NATO must contend with covert, aggressive malicious cyber actors that are seeking to gather intelligence, preparing to or currently attacking critical infrastructure, and working to undermine the Alliance with elaborate disinformation schemes. In order to protect its customers and clients, Google is closely tracking cyber threats, including those highlighted in this report; however, this is just a glimpse at a much larger and evolving landscape. Cyber Espionage NATO\'s adversaries have long sought to leverage cyber espionage to develop insight into the political, diplomatic, and military disposition of the Alliance and to steal its defense technologies and economic secrets. However, intelligence on the Alliance in the coming months will be of heightened importance. This year\'s summit is a transition period, with the appointment of Mark Rutte as the new Secretary General and a number of adaptations expected to be rolled out to shore up the Alliance\'s defense posture and its long-term support for Ukraine. Successful cyber espionage from threat actors could potentially undermine the Alliance\'s strategic advantage and inform adversary leadership on how to anticipate and counteract NATO\'s initiatives and investments. NATO is targeted by cyber espionage activity from actors around the world with varying capabilities. Many still rely on technically simple but operationally effective methods, like social engineering. Others have evolved and elevated their tradecraft to levels that distinguish themselves as formidable adversaries for even the most experienced defenders. APT29 (ICECAP) Publicly attributed to the Russian Foreign Intelligence Services (SVR) by several governments, APT29 is heavily focused on diplomatic and political intelligence collection, principally targeting Europe and NATO member states. APT29 has been involved in multiple high-profile breaches of technology firms that were designed to provide access to the public sector. In the past year, Mandiant has observed APT29 targeting technology companies and IT service providers in NATO member countries to facilitate third-party and software supply chain compromises of government and poli |
Ransomware Malware Tool Vulnerability Threat Legislation Medical Cloud Technical | APT 29 APT 28 | ★★★ |
|
2024-07-01 07:32:38 | TeamViewer Hack est officiellement attribué aux cyberespaces russes TeamViewer Hack Officially Attributed to Russian Cyberspies (lien direct) |
> TeamViewer a confirmé que le groupe de cyberespionnage russe APT29 semble être derrière le récent hack.
>TeamViewer has confirmed that the Russian cyberespionage group APT29 appears to be behind the recent hack. |
Hack | APT 29 | ★★★ |
|
2024-06-28 21:22:05 | TeamViewer crédite la segmentation du réseau pour avoir repoussé l'attaque APT29 TeamViewer Credits Network Segmentation for Rebuffing APT29 Attack (lien direct) |
Malgré les avertissements de Health-ISAC et du groupe NCC, le fabricant de logiciels d'accès à distance a déclaré que les données de la défense en profondeur ont gardé les clients à l'abri de Midnight Blizzard.
Despite warnings from Health-ISAC and the NCC Group, the remote access software maker says defense-in-depth kept customers\' data safe from Midnight Blizzard. |
APT 29 | ★★★ | |
|
2024-06-28 09:09:50 | Russian APT aurait dû à New TeamViewer Hack Russian APT Reportedly Behind New TeamViewer Hack (lien direct) |
> Le réseau d'entreprise de TeamViewer \\ a été piraté et certains rapports indiquent que le groupe russe APT29 est à l'origine de l'attaque.
>TeamViewer\'s corporate network was hacked and some reports say the Russian group APT29 is behind the attack. |
Hack | APT 29 | ★★★ |
|
2024-06-20 19:30:00 | Entités diplomatiques françaises ciblées dans des cyberattaques liées à la russe French Diplomatic Entities Targeted in Russian-Linked Cyber Attacks (lien direct) |
Les acteurs parrainés par l'État ayant des liens avec la Russie ont été liés à des cyberattaques ciblées destinées aux entités diplomatiques françaises, a déclaré l'agence de sécurité de l'information du pays ANSSI dans un avis.
Les attaques ont été attribuées à un cluster suivi par Microsoft sous le nom de Midnight Blizzard (anciennement Nobelium), qui chevauche une activité suivie en APT29, Bluebravo, Ursa camouré, confortable, ours,
State-sponsored actors with ties to Russia have been linked to targeted cyber attacks aimed at French diplomatic entities, the country\'s information security agency ANSSI said in an advisory. The attacks have been attributed to a cluster tracked by Microsoft under the name Midnight Blizzard (formerly Nobelium), which overlaps with activity tracked as APT29, BlueBravo, Cloaked Ursa, Cozy Bear, |
APT 29 | ★★★★ | |
|
2024-04-25 10:00:00 | Pole Voûte: cyber-menaces aux élections mondiales Poll Vaulting: Cyber Threats to Global Elections (lien direct) |
Written by: Kelli Vanderlee, Jamie Collier
Executive Summary The election cybersecurity landscape globally is characterized by a diversity of targets, tactics, and threats. Elections attract threat activity from a variety of threat actors including: state-sponsored actors, cyber criminals, hacktivists, insiders, and information operations as-a-service entities. Mandiant assesses with high confidence that state-sponsored actors pose the most serious cybersecurity risk to elections. Operations targeting election-related infrastructure can combine cyber intrusion activity, disruptive and destructive capabilities, and information operations, which include elements of public-facing advertisement and amplification of threat activity claims. Successful targeting does not automatically translate to high impact. Many threat actors have struggled to influence or achieve significant effects, despite their best efforts. When we look across the globe we find that the attack surface of an election involves a wide variety of entities beyond voting machines and voter registries. In fact, our observations of past cycles indicate that cyber operations target the major players involved in campaigning, political parties, news and social media more frequently than actual election infrastructure. Securing elections requires a comprehensive understanding of many types of threats and tactics, from distributed denial of service (DDoS) to data theft to deepfakes, that are likely to impact elections in 2024. It is vital to understand the variety of relevant threat vectors and how they relate, and to ensure mitigation strategies are in place to address the full scope of potential activity. Election organizations should consider steps to harden infrastructure against common attacks, and utilize account security tools such as Google\'s Advanced Protection Program to protect high-risk accounts. Introduction The 2024 global election cybersecurity landscape is characterized by a diversity of targets, tactics, and threats. An expansive ecosystem of systems, administrators, campaign infrastructure, and public communications venues must be secured against a diverse array of operators and methods. Any election cybersecurity strategy should begin with a survey of the threat landscape to build a more proactive and tailored security posture. The cybersecurity community must keep pace as more than two billion voters are expected to head to the polls in 2024. With elections in more than an estimated 50 countries, there is an opportunity to dynamically track how threats to democracy evolve. Understanding how threats are targeting one country will enable us to better anticipate and prepare for upcoming elections globally. At the same time, we must also appreciate the unique context of different countries. Election threats to South Africa, India, and the United States will inevitably differ in some regard. In either case, there is an opportunity for us to prepare with the advantage of intelligence. |
Ransomware Malware Hack Tool Vulnerability Threat Legislation Cloud Technical | APT 40 APT 29 APT 28 APT 43 APT 31 APT 42 | ★★★ |
|
2024-04-12 06:00:03 | Arrêt de cybersécurité du mois: vaincre les attaques de création d'applications malveillantes Cybersecurity Stop of the Month: Defeating Malicious Application Creation Attacks (lien direct) |
This blog post is part of a monthly series, Cybersecurity Stop of the Month, which explores the ever-evolving tactics of today\'s cybercriminals. It focuses on the critical first three steps in the attack chain in the context of email threats. The goal of this series is to help you understand how to fortify your defenses to protect people and defend data against emerging threats in today\'s dynamic threat landscape. The critical first three steps of the attack chain-reconnaissance, initial compromise and persistence. So far in this series, we have examined these types of attacks: Supplier compromise EvilProxy SocGholish eSignature phishing QR code phishing Telephone-oriented attack delivery (TOAD) Payroll diversion MFA manipulation Supply chain compromise Multilayered malicious QR code attack In this post, we examine an emerging threat-the use of malicious cloud applications created within compromised cloud tenants following account takeover. We refer to it as MACT, for short. Background Cloud account takeover (ATO) attacks are a well-known risk. Research by Proofpoint found that last year more than 96% of businesses were actively targeted by these attacks and about 60% had at least one incident. Financial damages reached an all-time high. These findings are unsettling. But there is more for businesses to worry about. Cybercriminals and state-sponsored entities are rapidly adopting advanced post-ATO techniques. And they have embraced the use of malicious and abused OAuth apps. In January 2024, Microsoft revealed that a nation-state attacker had compromised its cloud environments and stolen valuable data. This attack was attributed to TA421 (aka Midnight Blizzard and APT29), which are threat groups that have been attributed to Russia\'s Foreign Intelligence Service (SVR). Attackers exploited existing OAuth apps and created new ones within hijacked cloud tenants. After the incident, CISA issued a new advisory for businesses that rely on cloud infrastructures. Proofpoint threat researchers observed attackers pivoting to the use of OAuth apps from compromised-and often verified-cloud tenants. Threat actors take advantage of the trust that\'s associated with verified or recognized identities to spread cloud malware threats as well as establish persistent access to sensitive resources. The scenario Proofpoint monitors a malicious campaign named MACT Campaign 1445. It combines a known tactic used by cloud ATO attackers with new tactics, techniques and procedures. So far, it has affected dozens of businesses and users. In this campaign, attackers use hijacked user accounts to create malicious internal apps. In tandem, they also conduct reconnaissance, exfiltrate data and launch additional attacks. Attackers use a unique anomalous URL for the malicious OAuth apps\' reply URL-a local loopback with port 7823. This port is used for TCP traffic. It is also associated with a known Windows Remote Access Trojan (RAT). Recently, Proofpoint researchers found four accounts at a large company in the hospitality industry compromised by attackers. In a matter of days, attackers used these accounts to create four distinct malicious OAuth apps. The threat: How did the attack happen? Here is a closer look at how the attack unfolded. Initial access vectors. Attackers used a reverse proxy toolkit to target cloud user accounts. They sent individualized phishing lures to these users, which enabled them to steal their credentials as well as multifactor authentication (MFA) tokens. A shared PDF file with an embedded phishing URL that attackers used to steal users\' credentials. Unauthorized access (cloud account takeover). Once attackers had stolen users\' credentials, they established unauthorized access to the four targeted accounts. They logged in to several native Microsoft 365 sign-in apps, including “Azure Portal” and “Office Home.” Cloud malware (post-access OAuth app creat | Spam Malware Tool Threat Cloud | APT 29 | ★★★ |
|
2024-04-11 13:47:19 | CISA Orde les agences affectées par Microsoft Hack pour atténuer les risques CISA orders agencies impacted by Microsoft hack to mitigate risks (lien direct) |
CISA a publié une nouvelle directive d'urgence ordonnant aux agences fédérales américaines de répondre aux risques résultant de la violation de plusieurs comptes de messagerie Microsoft d'entreprise par le groupe de piratage russe APT29.[...]
CISA has issued a new emergency directive ordering U.S. federal agencies to address risks resulting from the breach of multiple Microsoft corporate email accounts by the Russian APT29 hacking group. [...] |
Hack | APT 29 | ★★★ |
|
2024-04-11 13:27:54 | Revisiter MACT: Applications malveillantes dans des locataires cloud crédibles Revisiting MACT: Malicious Applications in Credible Cloud Tenants (lien direct) |
For years, the Proofpoint Cloud Research team has been particularly focused on the constantly changing landscape of cloud malware threats. While precise future predictions remain elusive, a retrospective examination of 2023 enabled us to discern significant shifts and trends in threat actors\' behaviors, thereby informing our projections for the developments expected in 2024. There is no doubt that one of the major, and most concerning, trends observed in 2023 was the increased adoption of malicious and abused OAuth applications by cybercriminals and state-sponsored actors. In January, Microsoft announced they, among other organizations, were targeted by a sophisticated nation-state attack. It seems that the significant impact of this attack, which was attributed to TA421 (AKA Midnight Blizzard and APT29), largely stemmed from the strategic exploitation of pre-existing OAuth applications, coupled with the creation of new malicious applications within compromised environments. Adding to a long list of data breaches, this incident emphasizes the inherent potential risk that users and organizations face when using inadequately protected cloud environments. Expanding on early insights shared in our 2021 blog, where we first explored the emerging phenomenon of application creation attacks and armed with extensive recent discoveries, we delve into the latest developments concerning this threat in our 2024 update. In this blog, we will: Define key fundamental terms pertinent to the realm of cloud malware and OAuth threats. Examine some of the current tactics, techniques, and procedures (TTPs) employed by threat actors as part of their account-takeover (ATO) kill chain. Provide specific IOCs related to recently detected threats and campaigns. Highlight effective strategies and solutions to help protect organizations and users against cloud malware threats. Basic terminology OAuth (Open Authorization) 2.0. OAuth is an open standard protocol that enables third-party applications to access a user\'s data without exposing credentials. It is widely used to facilitate secure authentication and authorization processes. Line-of-business (LOB) applications. LOB apps (also known as second-party apps) typically refer to applications created by a user within their cloud environment in order to support a specific purpose for the organization. Cloud malware. A term usually referring to malicious applications created, utilized and proliferated by threat actors. Malicious apps can be leveraged for various purposes, such as: mailbox access, file access, data exfiltration, internal reconnaissance, and maintaining persistent access to specific resources. MACT (Malicious Applications Created in Compromised Credible Tenants). A common technique wherein threat actors create new applications within hijacked environments, exploiting unauthorized access to compromised accounts to initiate additional attacks and establish a persistent foothold within impacted cloud tenants. Apphish. A term denoting the fusion of cloud apps-based malware with phishing tactics, mainly by utilizing OAuth 2.0 infrastructure to implement open redirection attacks. Targeted users could be taken to a designated phishing webpage upon clicking an app\'s consent link. Alternatively, redirection to a malicious webpage could follow authorizing or declining an application\'s consent request. Abused OAuth applications. Benign apps that are authorized or used by attackers, usually following a successful account takeover, to perform illegitimate activities. What we are seeing Already in 2020, we witnessed a rise in malicious OAuth applications targeting cloud users, with bad actors utilizing increasingly sophisticated methods such as application impersonation and diverse lures. In October 2022, Proofpoint researchers demonstrated how different threat actors capitalized on the global relevance of the COVID-19 pandemic to spread malware and phishing threats. Proofpoint has also seen this trend include the propagation of malicious OAuth applications seamlessly integ | Malware Threat Prediction Cloud | APT 29 | ★★★ |
|
2024-03-25 09:30:00 | Le groupe russe confortable ours cible les politiciens allemands Russian Cozy Bear Group Targets German Politicians (lien direct) |
Mandiant observe ce qu'il prétend être la toute première campagne APT29 destinée aux partis politiques
Mandiant observes what it claims is the first ever APT29 campaign aimed at political parties |
APT 29 | ★★★ | |
|
2024-03-23 11:33:00 | Les pirates russes utilisent \\ 'wineloader \\' malware pour cibler les partis politiques allemands Russian Hackers Use \\'WINELOADER\\' Malware to Target German Political Parties (lien direct) |
La porte dérobée de Wineloader utilisée dans les cyberattaques récentes ciblant les entités diplomatiques avec des leurres de phishing dégustation de vin a été attribué comme le travail d'un groupe de piratage avec des liens vers le service de renseignement étranger de la Russie (SVR), qui était responsable de & nbsp; violation de Solarwinds et de Solarwinds et de NBSP;Microsoft.
Les résultats proviennent de Mandiant, qui a dit & nbsp; Midnight Blizzard & nbsp; (aka apt29, bluebravo, ou
The WINELOADER backdoor used in recent cyber attacks targeting diplomatic entities with wine-tasting phishing lures has been attributed as the handiwork of a hacking group with links to Russia\'s Foreign Intelligence Service (SVR), which was responsible for breaching SolarWinds and Microsoft. The findings come from Mandiant, which said Midnight Blizzard (aka APT29, BlueBravo, or |
Malware | APT 29 | ★★ |
|
2024-03-22 11:00:00 | APT29 utilise Wineloader pour cibler les partis politiques allemands APT29 Uses WINELOADER to Target German Political Parties (lien direct) |
Résumé exécutif fin février, l'APT29 a utilisé une nouvelle variante de porte dérobée suivie publiquement comme wineloader pour cibler les fêtes politiques allemandes avecun leurre sur le thème de la CDU. & nbsp; & nbsp; C'est la première fois que nous voyons ce cluster APT29 cible des partis politiques, indiquant une zone émergente émergenteFocus opérationnel au-delà du ciblage typique des missions diplomatiques. basée sur la responsabilité du SVR \\ de collecter l'intelligence politique et cette cluster APT29 \\ 'sModèles de ciblage historiques, nous jugeons cette activité pour présenter une large menace pour les partis politiques européens et autres occidentaux de tous les politiques
Executive SummaryIn late February, APT29 used a new backdoor variant publicly tracked as WINELOADER to target German political parties with a CDU-themed lure. This is the first time we have seen this APT29 cluster target political parties, indicating a possible area of emerging operational focus beyond the typical targeting of diplomatic missions.Based on the SVR\'s responsibility to collect political intelligence and this APT29 cluster\'s historical targeting patterns, we judge this activity to present a broad threat to European and other Western political parties from across the political |
Threat | APT 29 | ★★ |
|
2024-03-22 00:00:00 | APT29 Uses WINELOADER to Target German Political Parties (lien direct) | Written by: Luke Jenkins, Dan Black
Executive Summary In late February, APT29 used a new backdoor variant publicly tracked as WINELOADER to target German political parties with a CDU-themed lure. This is the first time we have seen this APT29 cluster target political parties, indicating a possible area of emerging operational focus beyond the typical targeting of diplomatic missions. Based on the SVR\'s responsibility to collect political intelligence and this APT29 cluster\'s historical targeting patterns, we judge this activity to present a broad threat to European and other Western political parties from across the political spectrum. Please see the Technical Annex for technical details and MITRE ATT&CK techniques, (T1543.003, T1012, T1082, T1134, T1057, T1007, T1027, T1070.004, T1055.003 and T1083) Threat Detail In late February 2024, Mandiant identified APT29 - a Russian Federation backed threat group linked by multiple governments to Russia\'s Foreign Intelligence Service (SVR) - conducting a phishing campaign targeting German political parties. Consistent with APT29 operations extending back to 2021, this operation leveraged APT29\'s mainstay first-stage payload ROOTSAW (aka EnvyScout) to deliver a new backdoor variant publicly tracked as WINELOADER. Notably, this activity represents a departure from this APT29 initial access cluster\'s typical remit of targeting governments, foreign embassies, and other diplomatic missions, and is the first time Mandiant has seen an operational interest in political parties from this APT29 subcluster. Additionally, while APT29 has previously used lure documents bearing the logo of German government organizations, this is the first instance where we have seen the group use German-language lure content - a possible artifact of the targeting differences (i.e. domestic vs. foreign) between the two operations. Phishing emails were sent to victims purporting to be an invite to a dinner reception on 01 March bearing a logo from the Christian Democratic Union (CDU), a major political party in Germany (see Figure 1). The German-language lure document contains a phishing link directing victims to a malicious ZIP file containing a ROOTSAW dropper hosted on an actor-controlled compromised website “https://waterforvoiceless[.]org/invite.php”. ROOTSAW delivered a second-stage CDU-themed lure document and a next stage WINELOADER payload retrieved from “waterforvoiceless[.]org/util.php”. WINELOADER was first observed in operational use in late January 2024 in an operation targeting likely diplomatic entities in Czechia, Germany, India, Italy, Latvia, and Peru. The backdoor contains several features and functions that overlap with several known APT29 malware families including BURNTBATTER, MUSKYBEAT and BEATDROP, indicating they are likely created by a common developer (see Technical Annex for additional details). |
Malware Threat Cloud Technical | APT 29 | ★★★ |
|
2024-03-11 12:19:02 | Les pirates russes de Blizzard Midnight Blizzard ont violé le code source Microsoft Russian Midnight Blizzard Hackers Breached Microsoft Source Code (lien direct) |
> Par deeba ahmed
Midnight Blizzard (alias Cozy Bear et APT29) a initialement violé Microsoft le 12 janvier 2024.
Ceci est un article de HackRead.com Lire le post original: Les pirates russes de Blizzard Midnight ont violé le code source Microsoft
>By Deeba Ahmed Midnight Blizzard (aka Cozy Bear and APT29) originally breached Microsoft on January 12, 2024. This is a post from HackRead.com Read the original post: Russian Midnight Blizzard Hackers Breached Microsoft Source Code |
APT 29 | ★★ | |
|
2024-03-11 09:30:00 | La blizzard minuit de la Russie accède au code source Microsoft Russia\\'s Midnight Blizzard Accesses Microsoft Source Code (lien direct) |
Le groupe de menace APT29 utilise des secrets volés dans une attaque antérieure pour compromettre les systèmes internes de Microsoft \\
Threat group APT29 is using secrets stolen in an earlier attack to compromise Microsoft\'s internal systems |
Threat | APT 29 | ★★★ |
|
2024-03-09 09:31:00 | Microsoft confirme que les pirates russes ont volé le code source, certains secrets des clients Microsoft Confirms Russian Hackers Stole Source Code, Some Customer Secrets (lien direct) |
Vendredi, Microsoft a révélé que l'acteur de menace soutenu par le Kremlin connu sous le nom de & nbsp; Midnight Blizzard & nbsp; (aka apt29 ou confort) a réussi à accéder à certains de ses référentiels de code source et systèmes internes après A & NBSP; hack qui est venu à la lumière & NBSP; en janvier 2024.
"Ces dernières semaines, nous avons vu des preuves que Midnight Blizzard utilise des informations initialement exfiltrées de notre
Microsoft on Friday revealed that the Kremlin-backed threat actor known as Midnight Blizzard (aka APT29 or Cozy Bear) managed to gain access to some of its source code repositories and internal systems following a hack that came to light in January 2024. "In recent weeks, we have seen evidence that Midnight Blizzard is using information initially exfiltrated from our |
Hack Threat | APT 29 | ★★★ |
 |
2024-03-08 20:41:15 | Les pirates russes ont accédé au code source Microsoft Russian hackers accessed Microsoft source code (lien direct) |
> Un incident attribué à l'équipage de piratage russe confortable ours qui a été divulgué pour la première fois en janvier continue d'affecter Microsoft Systems.
>An incident attributed to the Russian hacking crew Cozy Bear that was first disclosed in January continues to affect Microsoft systems. |
APT 29 | ★★★ | |
 |
2024-03-01 20:15:10 | Les problèmes NCSC de UK \\ ont avertissement en tant que pirates SVR ciblent les services cloud UK\\'s NCSC Issues Warning as SVR Hackers Target Cloud Services (lien direct) |
Cyber Espionage Group APT29 adapte ses tactiques aux environnements cloud.Voici ce que vous devez savoir.
Cyber espionage group APT29 is adapting its tactics for cloud environments. Here\'s what you should know. |
Cloud | APT 29 | ★★ |
|
2024-02-27 16:04:00 | Cinq agences Eyes exposent des tactiques d'évolution des nuages en évolution de l'APT29 \\ Five Eyes Agencies Expose APT29\\'s Evolving Cloud Attack Tactics (lien direct) |
La cybersécurité et les agences de renseignement des cinq yeux des Nations ont publié un conseil conjoint détaillant les tactiques évolutives de l'acteur de menace parrainé par l'État russe connu sous le nom de & NBSP; APT29.
La tenue de piratage, également connue sous le nom de Bluebravo, Ursa masqué, Cozy Bear, Midnight Blizzard (anciennement Nobelium) et les Dukes, est évaluée pour être affiliée au Foreign Intelligence Service (SVR) de la
Cybersecurity and intelligence agencies from the Five Eyes nations have released a joint advisory detailing the evolving tactics of the Russian state-sponsored threat actor known as APT29. The hacking outfit, also known as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard (formerly Nobelium), and The Dukes, is assessed to be affiliated with the Foreign Intelligence Service (SVR) of the |
Threat Cloud | APT 29 | ★★★ |
|
2024-02-27 01:00:06 | L'ours confortable de la Russie plonge dans des environnements cloud avec un nouveau sac de trucs Russia\\'s Cozy Bear dives into cloud environments with a new bag of tricks (lien direct) |
Les espions du Kremlin \\ ont essayé le TTPS sur Microsoft, et maintenant ils se rendent aux courses Russia \'s Cozy Bear, l'équipage derrière la chaîne d'approvisionnement de SolarwindsAttack, a élargi ses objectifs et a évolué ses techniques pour pénétrer dans les organisations \\ 'Cloud Environments, selon les Five Eyes Governments.…
Kremlin\'s spies tried out the TTPs on Microsoft, and now they\'re off to the races Russia\'s notorious Cozy Bear, the crew behind the SolarWinds supply chain attack, has expanded its targets and evolved its techniques to break into organizations\' cloud environments, according to the Five Eyes governments.… |
Cloud | APT 29 | ★★★ |
|
2024-02-26 17:15:00 | CISA Issues Alert sur les tactiques d'infiltration des nuages d'APT29 \\ CISA Issues Alert on APT29\\'s Cloud Infiltration Tactics (lien direct) |
Connu sous le nom de Midnight Blizzard, les dukes ou l'ours confortable, le groupe a été identifié comme une entité russe opérant probablement sous le SVR
Known as Midnight Blizzard, the Dukes or Cozy Bear, the group has been identified as a Russian entity likely operating under the SVR |
Cloud | APT 29 | ★★ |
 |
2024-02-09 09:20:11 | L\'attaque d\'APT29 contre Microsoft : Suivre les traces de Cozy Bear – analyse de CyberArk (lien direct) | L'attaque d'APT29 contre Microsoft : Suivre les traces de Cozy Bear. Pour Andy Thompson, spécialiste de la sécurité chez CyberArk, un nouveau chapitre inquiétant est en train de s'écrire en ces temps troublés de chaos géopolitique. - Malwares | APT 29 | ★★ | |
 |
2024-02-08 14:51:00 | Attaque d'APT29 \\ sur Microsoft: suivi des empreintes de pas Cozy Bear \\ APT29\\'s Attack on Microsoft: Tracking Cozy Bear\\'s Footprints (lien direct) |
Un chapitre nouveau et préoccupant s'est déroulé en ces temps troublés du chaos géopolitique.L'acteur confortable des menaces d'ours a provoqué des violations importantes ciblant Microsoft et HPE, et d'autres sont susceptibles de venir.Ces récents ...
A new and concerning chapter has unfolded in these troubled times of geopolitical chaos. The Cozy Bear threat actor has caused significant breaches targeting Microsoft and HPE, and more are likely to come. These recent... |
Threat | APT 29 | ★★★ |
To see everything:
Our RSS (filtrered)
