What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-04-12 21:41:00 | Lazarus Group \\ 'S \\' Deathnote \\ 'Cluster Pivots to Defense secteur Lazarus Group\\'s \\'DeathNote\\' Cluster Pivots to Defense Sector (lien direct) |
Habituellement axé sur les organisations de crypto-monnaie, l'acteur de menace a commencé à cibler les entreprises de défense dans le monde.
Usually focused on going after cryptocurrency organizations, the threat actor has begun targeting defense companies around the world. |
Threat | APT 38 | ★★ |
 |
2023-04-12 16:00:00 | La campagne Deathnote de Lazarus Group \\ révèle un changement dans les cibles Lazarus Group\\'s DeathNote Campaign Reveals Shift in Targets (lien direct) |
Kaspersky a découvert un changement dans les cibles de l'attaque et les vecteurs d'infection mis à jour en 2020
Kaspersky uncovered a shift in the attack\'s targets and updated infection vectors in 2020 |
APT 38 | ★★ | |
 |
2023-04-12 09:36:00 | Le labyrinthe sous-groupe de Lazarus Chollima découvert comme cerveau dans l'attaque de la chaîne d'approvisionnement 3CX Lazarus Sub-Group Labyrinth Chollima Uncovered as Mastermind in 3CX Supply Chain Attack (lien direct) |
Le fournisseur de services de communication d'entreprise 3CX a confirmé que l'attaque de la chaîne d'approvisionnement ciblant son application de bureau pour Windows et MacOS était le travail d'un acteur de menace au nord-coréen Nexus.
Les résultats sont le résultat d'une évaluation provisoire réalisée par Mandiant appartenant à Google, dont les services ont été enrôlés après que l'intrusion a été lancée à la fin du mois dernier.L'intelligence de la menace
Enterprise communications service provider 3CX confirmed that the supply chain attack targeting its desktop application for Windows and macOS was the handiwork of a threat actor with North Korean nexus. The findings are the result of an interim assessment conducted by Google-owned Mandiant, whose services were enlisted after the intrusion came to light late last month. The threat intelligence |
Threat | APT 38 | ★★ |
 |
2023-04-12 08:00:00 | Suivant le groupe Lazare en suivant la campagne DeathNote Following the Lazarus group by tracking DeathNote campaign (lien direct) |
Le groupe Lazare est un acteur de menace coréen de haut niveau avec plusieurs sous-campagnols.Dans ce blog, nous nous concentrons sur un cluster actif que nous avons surnommé DeathNote.
The Lazarus group is a high-profile Korean-speaking threat actor with multiple sub-campaigns. In this blog, we\'ll focus on an active cluster that we dubbed DeathNote. |
Threat | APT 38 | ★★★ |
 |
2023-04-06 14:15:07 | CVE-2023-23891 (lien direct) | Auth.(Contributeur +) Vulnérabilité des scripts croisés (XSS) dans le plugin supplémentaire OceanWP Ocean | Vulnerability | APT 32 | |
 |
2023-04-06 13:59:23 | Assistance technique Pivots de DigitalOcean à StackPath CDN Tech Support Scam Pivots from DigitalOcean to StackPath CDN (lien direct) |
> Les attaquants récapitulatifs qui abusaient auparavant DigitalOcean pour héberger une arnaque de support technologique ont élargi l'opération, abusant désormais de StackPath CDN pour distribuer l'arnaque, et sont susceptibles de commencer à abuser des services cloud supplémentaires pour fournir l'arnaque dans un avenir proche.Du 1er février au 16 mars, NetSkope Threat Labs a vu une augmentation de 10x [& # 8230;]
>Summary Attackers who were previously abusing DigitalOcean to host a tech support scam have expanded the operation, now abusing StackPath CDN to distribute the scam, and are likely to start abusing additional cloud services to deliver the scam in the near future. From February 1 to March 16, Netskope Threat Labs has seen a 10x increase […] |
Threat Cloud | APT 32 | ★★★ |
 |
2023-04-05 10:49:00 | 2022 Gagnant des prix du partenaire de l'année Fortinet 2022 Fortinet Partner of the Year Award Winners (lien direct) |
Chaque année, nous honorons nos partenaires les plus dévoués qui ont démontré un fort engagement envers la sécurité mondiale.Consultez la liste des gagnants des prix Fortinet Partner of the Year 2022.
Every year, we honor our most dedicated partners who have demonstrated a strong commitment to global security. Check out the list of winners from the 2022 Fortinet Partner of the Year Awards. |
APT 3 | ★★★ | |
|
2023-04-03 21:12:07 | La violation de 3CX s'élargit à mesure que les cyberattaquiers baissent la porte dérobée de deuxième étape 3CX Breach Widens as Cyberattackers Drop Second-Stage Backdoor (lien direct) |
"Gopuram" est une porte dérobée que le groupe de Lazarus de la Corée du Nord a utilisée dans certaines campagnes datant de 2020, selon certains chercheurs.
"Gopuram" is a backdoor that North Korea\'s Lazarus Group has used in some campaigns dating back to 2020, some researchers say. |
General Information | APT 38 | ★★ |
 |
2023-03-31 15:44:16 | Utilisation de Thor Lite pour rechercher des indicateurs de l'activité de Lazarus liés au compromis 3CX [Using THOR Lite to scan for indicators of Lazarus activity related to the 3CX compromise] (lien direct) | "Gopuram" est une porte dérobée que le groupe de Lazarus de la Corée du Nord a utilisée dans certaines campagnes datant de 2020, selon certains chercheurs.
"Gopuram" is a backdoor that North Korea\'s Lazarus Group has used in some campaigns dating back to 2020, some researchers say. |
APT 38 | ★★★ | |
 |
2023-03-31 12:16:00 | Plus de preuves relie l'attaque de la chaîne d'approvisionnement 3CX au groupe de piratage nord-coréen [More evidence links 3CX supply-chain attack to North Korean hacking group] (lien direct) |
L'attaque de la chaîne d'approvisionnement contre la société de téléphone d'entreprise 3CX a utilisé le code de piratage qui «correspond exactement» au malware maltraité précédemment dans les attaques par un groupe nord-coréen notoire, selon une nouvelle analyse.L'établissement de l'étendue des dommages causés par le pirat
The supply-chain attack on the enterprise phone company 3CX used hacking code that “exactly matches” malware previously seen in attacks by a notorious North Korean group, according to new analysis. Establishing the extent of the damage caused by the hack has been a priority for researchers after a number of cybersecurity businesses went public with |
Malware Hack | APT 38 | ★★ |
 |
2023-03-30 15:37:54 | Le compromis de la chaîne d'approvisionnement 3CX mène à des incidents emblématiques 3CX Supply Chain Compromise Leads to ICONIC Incident (lien direct) |
> [MISE À JOUR: Après une analyse supplémentaire de Shellcode utilisée dans l'emblématique, en conjonction avec d'autres observations de la communauté de sécurité plus large, la volexité attribue désormais l'activité décrite dans ce post à l'acteur de la menace de Lazarus.Plus précisément, en plus d'autres revendications de similitude, la séquence ShellCode {E8 00 00 00 00 59 49 89 C8 48 81 C1 58 06 00 00} semble avoir été utilisée uniqueêtre lié à Lazarus.Le poste d'origine a été laissé comme écrit.] Le mercredi 29 mars 2023, la volexité a pris conscience d'un compromis de la chaîne d'approvisionnement par un acteur de menace nord-coréen présumé, qui suit la volexité comme UTA0040 *.Les points de terminaison avec l'application de bureau 3CX installée ont reçu une mise à jour malveillante de ce logiciel signé par 3CX et téléchargé à partir de leurs serveurs.Cela faisait partie du processus de mise à jour automatique par défaut et [& # 8230;]
>[Update: Following additional analysis of shellcode used in ICONIC, in conjunction with other observations from the wider security community, Volexity now attributes the activity described in this post to the Lazarus threat actor. Specifically, in addition to other claims of similarity, the shellcode sequence {E8 00 00 00 00 59 49 89 C8 48 81 C1 58 06 00 00} appears to have been only used in the ICONIC loader and the APPLEJEUS malware, which is known to be linked to Lazarus. The original post has been left as written.] On Wednesday, March 29, 2023, Volexity became aware of a supply chain compromise by a suspected North Korean threat actor, which Volexity tracks as UTA0040*. Endpoints with the 3CX Desktop application installed received a malicious update of this software that was signed by 3CX and downloaded from their servers. This was part of the default automatic update process and would […] |
Threat | APT 38 | ★★★ |
|
2023-03-30 12:15:07 | CVE-2023-24399 (lien direct) | Auth.(Contributeur +) Vulnérabilité des scripts croisés (XSS) dans le plugin supplémentaire OceanWP Ocean | Vulnerability | APT 32 | |
 |
2023-03-29 23:42:34 | La cyberattaque de la chaîne d'approvisionnement avec des liens possibles avec la Corée du Nord pourrait avoir des milliers de victimes à l'échelle mondiale [Supply chain cyberattack with possible links to North Korea could have thousands of victims globally] (lien direct) | > Une attaque qui pourrait être le travail du célèbre groupe de Lazare a tenté d'installer des logiciels malveillants infoséaler à l'intérieur des réseaux d'entreprise.
>An attack that could be the work of the notorious Lazarus Group attempted to install infostealer malware inside corporate networks. |
Malware | APT 38 | ★★ |
 |
2023-03-28 21:28:00 | Anomali Cyber Watch: Takeover comptable, APT, Banking Trojans, Chine, Cyberespionage, Inde, Malspam, Corée du Nord, Phishing, Skimmers, Ukraine et Vulnérabilités [Anomali Cyber Watch: Account takeover, APT, Banking trojans, China, Cyberespionage, India, Malspam, North Korea, Phishing, Skimmers, Ukraine, and Vulnerabilities] (lien direct) | Aucun Sélectionné Sauter vers le contenu à l'aide d'Anomali Inc Mail avec les lecteurs d'écran Yury 1 sur 52 ACW CONSEIL POLOZOV ACCORDS MAR 27 MAR, 2023, 10: 11 & # 8239; AM (1 jour) pour moi, marketing, recherche Cher Jarom etMarketing, ACW est prêt https://ui.thereatstream.com/tip/6397663 - Yury Polozov |Analyste de renseignement sur la menace de Sr. |ATR |www.anomali.com Téléphone: + 1-347-276-5554 3 pièces jointes et taureau;Scanné par gmail
& nbsp;
Anomali Cyber Watch: Spies amer sur l'énergie nucléaire chinoise, Kimsuky prend le contrôle de Google pour infecter les appareils Android connectés, les mauvaises cibles magiques occupées des parties de l'Ukraine, et plus encore.
Les diverses histoires de l'intelligence des menaces dans cette itération de l'anomali cyber watch discutent des sujets suivants: Takeover, APT, Banking Trojans, China, Cyberspionage, Inde, Malspam, North Corée, Phishing, Skimmers, Ukraine, et vulnérabilités .Les CIO liés à ces histoires sont attachés à Anomali Cyber Watch et peuvent être utilisés pour vérifier vos journaux pour une activité malveillante potentielle.
Figure 1 - Diagrammes de résumé du CIO.Ces graphiques résument les CIO attachés à ce magazine et donnent un aperçu des menaces discutées.
Cyber News et Intelligence des menaces
campagne de phishingCible l'industrie chinoise de l'énergie nucléaire
(Publié: 24 mars 2023)
Actif Depuis 2013, le groupe amer (T-APT-17) est soupçonné d'être parrainé par le gouvernement indien.Des chercheurs Intezer ont découvert une nouvelle campagne amère ciblant les universitaires, le gouvernement et d'autres organisations de l'industrie de l'énergie nucléaire en Chine.Les techniques sont cohérentes avec les campagnes amères observées précédemment.L'intrusion commence par un e-mail de phishing censé provenir d'un véritable employé de l'ambassade du Kirghizistan.Les pièces jointes malveillantes observées étaient soit des fichiers HTML (CHM) compilés à Microsoft, soit des fichiers Microsoft Excel avec des exploits d'éditeur d'équation.L'objectif des charges utiles est de créer de la persistance via des tâches planifiées et de télécharger d'autres charges utiles de logiciels malveillants (les campagnes amères précédentes ont utilisé le voleur d'identification du navigateur, le voleur de fichiers, le keylogger et les plugins d'outils d'accès à distance).Les attaquants se sont appuyés sur la compression LZX et la concaténation des cordes pour l'évasion de détection.
Commentaire de l'analyste: De nombreuses attaques avancées commencent par des techniques de base telles que des e-mails injustifiés avec une pièce jointe qui oblige l'utilisateur à l'ouvrir.Il est important d'enseigner l'hygiène de base en ligne à vos utilisateurs et la sensibilisation au phishing.Il est sûr de recommander de ne jamais ouvrir de fichiers CHM joints et de garder votre bureau MS Office entièrement mis à jour.Tous les indicateurs connus associés à cette campagne amère sont disponibles dans la plate-forme Anomali et il est conseillé aux clients de les bloquer sur leur infrastructure.
mitre att & amp; ck: [mitre att & amp; ck] t1589.002 - rassembler l'identité des victimesInformations: Adresses e-mail | [mitre att & amp; ck] t1566.001 -Phishing: attachement de espionnage | [mitre at |
Malware Tool Threat Cloud | APT 37 APT 43 | ★★ |
|
2023-03-28 17:05:00 | Kimsuky de la Corée du Nord évolue en APT à part entière et prolifique [North Korea\\'s Kimsuky Evolves into Full-Fledged, Prolific APT] (lien direct) | Dans les cyberattaques contre les États-Unis, la Corée du Sud et le Japon, le groupe (alias APT43 ou Thallium) utilise des tactiques avancées d'ingénierie sociale et de cryptomiminage qui le distinguent des autres acteurs de la menace.
In cyberattacks against the US, South Korea, and Japan, the group (aka APT43 or Thallium) is using advanced social engineering and cryptomining tactics that set it apart from other threat actors. |
Threat Cloud | APT 37 APT 43 | ★★★★ |
|
2023-03-22 17:54:00 | Arsenal évolutif de Scarcruft \\: les chercheurs révèlent de nouvelles techniques de distribution de logiciels malveillants [ScarCruft\\'s Evolving Arsenal: Researchers Reveal New Malware Distribution Techniques] (lien direct) | L'acteur de menace persistante avancée nord-coréenne (APT) surnommé Scarcruft utilise des fichiers HTML (CHM) compilés compilés par Microsoft armé pour télécharger des logiciels malveillants supplémentaires.
Selon plusieurs rapports d'Ahnlab Security Emergency Response Center (ASEC), de Sekoia.io et de Zscaler, les résultats illustrent les efforts continus du groupe pour affiner et réorganiser ses tactiques pour contourner la détection.
"
The North Korean advanced persistent threat (APT) actor dubbed ScarCruft is using weaponized Microsoft Compiled HTML Help (CHM) files to download additional malware. According to multiple reports from AhnLab Security Emergency response Center (ASEC), SEKOIA.IO, and Zscaler, the findings are illustrative of the group\'s continuous efforts to refine and retool its tactics to sidestep detection. " |
Malware Threat General Information Cloud | APT 37 | ★★ |
|
2023-03-22 12:30:00 | Le Royaume-Uni émet une stratégie pour protéger les services de santé nationaux contre les cyberattaques [UK issues strategy to protect National Health Service from cyberattacks] (lien direct) |
Le gouvernement britannique a publié mercredi sa nouvelle stratégie de cybersécurité pour le National Health Service, visant à rendre le secteur de la santé du pays \\ «durcie considérablement à la cyberattaque, au plus tard en 2030».La stratégie vient dans le sillage de la [Wannacry] (https://www.theguardian.com/technology/2017/jun/16/wannacry-ransomware-attack-linked-north-korea-lazarus-group) Ransomware Attack en 2017, parallèlement à une attaque criminelle contre le fournisseur de logiciels [Advanced] (https://www.bbc.co.uk/news/technology-62725363) l'année dernière,
The British government published on Wednesday its new cybersecurity strategy for the National Health Service, aiming to make the country\'s healthcare sector “significantly hardened to cyber attack, no later than 2030.” The strategy comes in the wake of the [WannaCry](https://www.theguardian.com/technology/2017/jun/16/wannacry-ransomware-attack-linked-north-korea-lazarus-group) ransomware attack in 2017, alongside a criminal attack on the software supplier [Advanced](https://www.bbc.co.uk/news/technology-62725363) last year, |
Ransomware General Information | Wannacry APT 38 | ★★ |
 |
2023-03-20 18:30:00 | When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule (lien direct) | > En février 2023, X-Force a publié un blog intitulé & # 8220; Direct Kernel Object Manipulation (DKOM) Attacks contre les fournisseurs ETW & # 8221;Cela détaille les capacités d'un échantillon attribué au groupe Lazare se sont exploités pour altérer la visibilité des opérations de logiciels malveillants.Ce blog ne remaniera pas l'analyse de l'échantillon de logiciel malveillant Lazarus ou du traçage d'événements pour Windows (ETW) comme [& # 8230;]
>In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will not rehash analysis of the Lazarus malware sample or Event Tracing for Windows (ETW) as […] |
Malware Medical | APT 38 | ★★★ |
|
2023-03-14 17:32:00 | Anomali Cyber Watch: Xenomorph Automates The Whole Fraud Chain on Android, IceFire Ransomware Started Targeting Linux, Mythic Leopard Delivers Spyware Using Romance Scam (lien direct) |
Anomali Cyber Watch: Xenomorph Automates The Whole Fraud Chain on Android, IceFire Ransomware Started Targeting Linux, Mythic Leopard Delivers Spyware Using Romance Scam, and More.
The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: Android, APT, DLL side-loading, Iran, Linux, Malvertising, Mobile, Pakistan, Ransomware, and Windows. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.
Trending Cyber News and Threat Intelligence
Xenomorph V3: a New Variant with ATS Targeting More Than 400 Institutions
(published: March 10, 2023)
Newer versions of the Xenomorph Android banking trojan are able to target 400 applications: cryptocurrency wallets and mobile banking from around the World with the top targeted countries being Spain, Turkey, Poland, USA, and Australia (in that order). Since February 2022, several small, testing Xenomorph campaigns have been detected. Its current version Xenomorph v3 (Xenomorph.C) is available on the Malware-as-a-Service model. This trojan version was delivered using the Zombinder binding service to bind it to a legitimate currency converter. Xenomorph v3 automatically collects and exfiltrates credentials using the ATS (Automated Transfer Systems) framework. The command-and-control traffic is blended in by abusing Discord Content Delivery Network.
Analyst Comment: Fraud chain automation makes Xenomorph v3 a dangerous malware that might significantly increase its prevalence on the threat landscape. Users should keep their mobile devices updated and avail of mobile antivirus and VPN protection services. Install only applications that you actually need, use the official store and check the app description and reviews. Organizations that publish applications for their customers are invited to use Anomali's Premium Digital Risk Protection service to discover rogue, malicious apps impersonating your brand that security teams typically do not search or monitor.
MITRE ATT&CK: [MITRE ATT&CK] T1417.001 - Input Capture: Keylogging | [MITRE ATT&CK] T1417.002 - Input Capture: Gui Input Capture
Tags: malware:Xenomorph, Mobile, actor:Hadoken Security Group, actor:HadokenSecurity, malware-type:Banking trojan, detection:Xenomorph.C, Malware-as-a-Service, Accessibility services, Overlay attack, Discord CDN, Cryptocurrency wallet, target-industry:Cryptocurrency, target-industry:Banking, target-country:Spain, target-country:ES, target-country:Turkey, target-country:TR, target-country:Poland, target-country:PL, target-country:USA, target-country:US, target-country:Australia, target-country:AU, malware:Zombinder, detection:Zombinder.A, Android
Cobalt Illusion Masquerades as Atlantic Council Employee
(published: March 9, 2023)
A new campaign by Iran-sponsored Charming Kitten (APT42, Cobalt Illusion, Magic Hound, Phosphorous) was detected targeting Mahsa Amini protests and researchers who document the suppression of women and minority groups i |
Ransomware Malware Tool Vulnerability Threat Guideline Conference | APT 35 ChatGPT ChatGPT APT 36 APT 42 | ★★ |
|
2023-03-14 14:15:13 | CVE-2023-24180 (lien direct) | Libelfin v0.3 was discovered to contain an integer overflow in the load function at elf/mmap_loader.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted elf file. | Vulnerability | APT 33 | |
|
2023-03-13 17:15:12 | CVE-2023-0749 (lien direct) | The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones. | APT 32 | ||
|
2023-03-09 21:46:24 | Attackers Increasingly Abusing DigitalOcean to Host Scams and Phishing (lien direct) | >Summary Netskope Threat Labs is tracking a 17x increase in traffic to malicious web pages hosted on DigitalOcean in the last six months. This increase is attributed to new campaigns of a known tech support scam that mimics Windows Defender and tries to deceive users into believing that their computer is infected. The end goal […] | Threat | APT 32 | ★★ |
 |
2023-03-08 23:30:00 | CHM Malware Disguised as Security Email from a Korean Financial Company: Redeyes (Scarcruft) (lien direct) | The ASEC (AhnLab Security Emergency response Center) analysis team has discovered that the CHM malware, which is assumed to have been created by the RedEyes threat group (also known as APT37, ScarCruft), is being distributed to Korean users. The team has confirmed that the command used in the “2.3. Persistence” stage of the RedEyes group’s M2RAT malware attack, which was reported back in February, has the same format as the command used in this attack. This information, as well as... | Malware Threat Cloud | APT 37 | ★★ |
|
2023-03-08 17:00:00 | Lazarus Group Targets South Korean Finance Firm Via Zero-Day Flaw (lien direct) | Asec recorded attacks in May and October 2022 | APT 38 | ★★ | |
|
2023-03-08 16:04:00 | Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity (lien direct) | The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year. While the first attack in May 2022 entailed the use of a vulnerable version of a certificate software that's widely used by public institutions and universities, the re-infiltration in October 2022 involved the | Hack Vulnerability Medical | APT 38 | ★★★ |
|
2023-03-08 10:30:00 | Officials Targeted with Romance Scams and Android Trojans (lien direct) | Activity linked to Pakistani state group APT36 | General Information | APT 36 | ★★★ |
|
2023-03-07 17:09:00 | Transparent Tribe Hackers Distribute CapraRAT via Trojanized Messaging Apps (lien direct) | A suspected Pakistan-aligned advanced persistent threat (APT) group known as Transparent Tribe has been linked to an ongoing cyber espionage campaign targeting Indian and Pakistani Android users with a backdoor called CapraRAT. "Transparent Tribe distributed the Android CapraRAT backdoor via trojanized secure messaging and calling apps branded as MeetsApp and MeetUp," ESET said in a report | Threat | APT 36 | ★★ |
 |
2023-03-07 13:55:18 | ESET Research découvre une campagne d\'espionnage ciblant des fonctionnaires en Inde et au Pakistan (lien direct) | ● ESET Research a découvert une campagne du groupe de pirates Transparent Tribe qui cible principalement des citoyens indiens et pakistanais ayant probablement un passé militaire ou politique. ● Transparent Tribe a diffusé la porte dérobée Android CapraRAT via des applications de messagerie et d'appel sécurisées sous le nom de MeetsApp et MeetUp. Elle est capable d'exfiltrer toute information sensible des appareils des victimes. ● Ces applications pouvaient être téléchargées à partir de sites web se faisant passer pour des sites de téléchargement officiels. Nous pensons qu'une arnaque à la romance a été utilisée pour attirer les cibles sur ces sites. ● Ces applications mal sécurisées ont exposé des informations personnellement identifiables, ce qui nous a permis de géolocaliser 150 victimes. - Malwares | APT 36 | ★★ | |
 |
2023-03-07 13:50:26 | (Déjà vu) Transparent Tribe APT weaponising Android messaging apps to target officials in India and Pakistan with romance scams (lien direct) | ESET researchers have analysed a cyberespionage campaign run by the Transparent Tribe APT group distributing CapraRAT backdoors through trojanised and supposedly “secure” Android messaging apps that exfiltrate sensitive information of mostly Indian and Pakistani Android users - presumably with a military or political orientation. The victims were probably targeted through a honey-trap romance scam, in […] | APT 36 | ★ | |
 |
2023-03-07 10:30:37 | Love scam or espionage? Transparent Tribe lures Indian and Pakistani officials (lien direct) | >ESET researchers analyze a cyberespionage campaign that distributes CapraRAT backdoors through trojanized and supposedly secure Android messaging apps – but also exfiltrates sensitive information | APT 36 | ★★ | |
|
2023-03-06 23:30:00 | Lazarus Group Attack Case Using Vulnerability of Certificate Software Commonly Used by Public Institutions and Universities (lien direct) | Since two years ago (March 2021), the Lazarus group’s malware strains have been found in various Korean companies related to national defense, satellites, software, media press, etc. As such, ASEC (AhnLab Security Emergency Response Center) has been pursuing and analyzing the Lazarus threat group’s activities and related malware. The affected company in this case had been infiltrated by the Lazarus group in May 2022 and was re-infiltrated recently through the same software’s 0-Day vulnerability. During the infiltration in May 2022,... | Malware Vulnerability Threat Medical | APT 38 | ★★★ |
|
2023-02-28 16:15:00 | Anomali Cyber Watch: Newly-Discovered WinorDLL64 Backdoor Has Code Similarities with Lazarus GhostSecret, Atharvan Backdoor Can Be Restricted to Communicate on Certain Days (lien direct) | The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Backdoors, DLL sideloading, Infostealers, Phishing, Social engineering, and Tunneling. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.
Trending Cyber News and Threat Intelligence
WinorDLL64: A Backdoor From The Vast Lazarus Arsenal?
(published: February 23, 2023)
When the Wslink downloader (WinorLoaderDLL64.dll) was first discovered in 2021, it had no known payload and no known attribution. Now ESET researchers have discovered a Wslink payload dubbed WinorDLL64. This backdoor uses some of Wslink functions and the Wslink-established TCP connection encrypted with 256-bit AES-CBC cipher. WinorDLL64 has some code similarities with the GhostSecret malware used by North Korea-sponsored Lazarus Group.
Analyst Comment: Wslink and WinorDLL64 use a well-developed cryptographic protocol to protect the exchanged data. Innovating advanced persistent groups like Lazarus often come out with new versions of their custom malware. It makes it important for network defenders to leverage the knowledge of a wider security community by adding relevant premium feeds and leveraging the controls automation via Anomali Platform integrations.
MITRE ATT&CK: [MITRE ATT&CK] T1587.001 - Develop Capabilities: Malware | [MITRE ATT&CK] T1059.001: PowerShell | [MITRE ATT&CK] T1106: Native API | [MITRE ATT&CK] T1134.002 - Access Token Manipulation: Create Process With Token | [MITRE ATT&CK] T1070.004 - Indicator Removal on Host: File Deletion | [MITRE ATT&CK] T1087.001 - Account Discovery: Local Account | [MITRE ATT&CK] T1087.002 - Account Discovery: Domain Account | [MITRE ATT&CK] T1083 - File And Directory Discovery | [MITRE ATT&CK] T1135 - Network Share Discovery | [MITRE ATT&CK] T1057 - Process Discovery | [MITRE ATT&CK] T1012: Query Registry | [MITRE ATT&CK] Picus: The System Information Discovery Technique Explained - MITRE ATT&CK T1082 | [MITRE ATT&CK] T1614 - System Location Discovery | [MITRE ATT&CK] T1614.001 - System Location Discovery: System Language Discovery | [MITRE ATT&CK] T1016 - System Network Configuration Discovery | [MITRE ATT&CK] T1049 - System Network Connections Discovery | |
Ransomware Malware Tool Threat Medical Medical Cloud | APT 38 | ★ |
 |
2023-02-28 14:00:00 | CyberheistNews Vol 13 #09 [Eye Opener] Should You Click on Unsubscribe? (lien direct) |
CyberheistNews Vol 13 #09 | February 28th, 2023
[Eye Opener] Should You Click on Unsubscribe?
By Roger A. Grimes.
Some common questions we get are "Should I click on an unwanted email's 'Unsubscribe' link? Will that lead to more or less unwanted email?"
The short answer is that, in general, it is OK to click on a legitimate vendor's unsubscribe link. But if you think the email is sketchy or coming from a source you would not want to validate your email address as valid and active, or are unsure, do not take the chance, skip the unsubscribe action.
In many countries, legitimate vendors are bound by law to offer (free) unsubscribe functionality and abide by a user's preferences. For example, in the U.S., the 2003 CAN-SPAM Act states that businesses must offer clear instructions on how the recipient can remove themselves from the involved mailing list and that request must be honored within 10 days.
Note: Many countries have laws similar to the CAN-SPAM Act, although with privacy protection ranging the privacy spectrum from very little to a lot more protection. The unsubscribe feature does not have to be a URL link, but it does have to be an "internet-based way." The most popular alternative method besides a URL link is an email address to use.
In some cases, there are specific instructions you have to follow, such as put "Unsubscribe" in the subject of the email. Other times you are expected to craft your own message. Luckily, most of the time simply sending any email to the listed unsubscribe email address is enough to remove your email address from the mailing list.
[CONTINUED] at the KnowBe4 blog:https://blog.knowbe4.com/should-you-click-on-unsubscribe
[Live Demo] Ridiculously Easy Security Awareness Training and Phishing
Old-school awareness training does not hack it anymore. Your email filters have an average 7-10% failure rate; you need a strong human firewall as your last line of defense.
Join us TOMORROW, Wednesday, March 1, @ 2:00 PM (ET), for a live demo of how KnowBe4 introduces a new-school approac |
Malware Hack Tool Vulnerability Threat Guideline Prediction | APT 38 ChatGPT | ★★★ |
|
2023-02-23 18:00:00 | WinorDLL64 Backdoor Linked to Lazarus Group (lien direct) | The Wslink loader can reportedly serve other connecting clients and load additional payloads | APT 38 | ★★★ | |
|
2023-02-23 17:17:00 | Lazarus Group Using New WinorDLL64 Backdoor to Exfiltrate Sensitive Data (lien direct) | A new backdoor associated with a malware downloader named Wslink has been discovered, with the tool likely used by the notorious North Korea-aligned Lazarus Group, new findings reveal. The payload, dubbed WinorDLL64 by ESET, is a fully-featured implant that can exfiltrate, overwrite, and delete files; execute PowerShell commands; and obtain comprehensive information about the underlying machine. | Malware Tool Medical | APT 38 | ★ |
|
2023-02-23 10:30:19 | WinorDLL64: A backdoor from the vast Lazarus arsenal? (lien direct) | >The targeted region, and overlap in behavior and code, suggest the tool is used by the infamous North Korea-aligned APT group | Tool | APT 38 | ★★ |
|
2023-02-23 02:00:00 | Anti-Forensic Techniques Used By Lazarus Group (lien direct) | Since approximately a year ago, the Lazarus group’s malware has been discovered in various Korean companies related to national defense, satellites, software, and media press. The AhnLab ASEC analysis team has been continuously tracking the Lazarus threat group’s activities and other related TTPs. Among the recent cases, this post aims to share the anti-forensic traces and details found in the systems that were infiltrated by the Lazarus group. Overview Definition of Anti-Forensics Anti-forensics refers to the tampering of evidence in... | Malware Threat Medical | APT 38 | ★★ |
 |
2023-02-21 15:23:27 | (Déjà vu) Norway Seizes Stolen Crypto Funds Linked to the Lazarus Group (lien direct) | >In March 2022, the Lazarus Group, a North Korea-backed hacking group, stole around $5.84 million worth of cryptocurrency through the Axie Infinity Ronin Bridge hack. However, over ten months later, the Norwegian police agency Økokrim announced they had seized the stolen funds. The crime-fighting unit was able to track the money on the blockchain, even … | Medical | APT 38 | ★★ |
|
2023-02-21 15:23:27 | Norwegian Seize Stolen Crypto Funds Linked to the Lazarus Group (lien direct) | >In March 2022, the Lazarus Group, a North Korea-backed hacking group, stole around $5.84 million worth of cryptocurrency through the Axie Infinity Ronin Bridge hack. However, over ten months later, the Norwegian police agency Økokrim announced they had seized part of the stolen funds. The crime-fighting unit was able to track the money on the … | Medical | APT 38 | ★★ |
|
2023-02-21 11:25:00 | Researchers Warn of ReverseRAT Backdoor Targeting Indian Government Agencies (lien direct) | A spear-phishing campaign targeting Indian government entities aims to deploy an updated version of a backdoor called ReverseRAT. Cybersecurity firm ThreatMon attributed the activity to a threat actor tracked as SideCopy. SideCopy is a threat group of Pakistani origin that shares overlaps with another actor called Transparent Tribe. It is so named for mimicking the infection chains associated | Threat | APT 36 | ★★★ |
|
2023-02-21 01:00:00 | HWP Malware Using the Steganography Technique: RedEyes (ScarCruft) (lien direct) | In January, the ASEC (AhnLab Security Emergency response Center) analysis team discovered that the RedEyes threat group (also known as APT37, ScarCruft) had been distributing malware by exploiting the HWP EPS (Encapsulated PostScript) vulnerability (CVE-2017-8291). This report will share the RedEyes group’s latest activity in Korea. 1. Overview The RedEyes group is known for targeting specific individuals and not corporations, stealing not only personal PC information but also the mobile phone data of their targets. A distinct characteristic of the... | Malware Vulnerability Threat Cloud | APT 37 | ★★★ |
|
2023-02-20 16:53:00 | Norway Seizes $5.84 Million in Cryptocurrency Stolen by Lazarus Hackers (lien direct) | Norwegian police agency Økokrim has announced the seizure of 60 million NOK (about $5.84 million) worth of cryptocurrency stolen by the Lazarus Group in March 2022 following the Axie Infinity Ronin Bridge hack. "This case shows that we also have a great capacity to follow the money on the blockchain, even if the criminals use advanced methods," the agency said in a statement. The development | Medical | APT 38 | ★★ |
|
2023-02-17 17:00:00 | EU Cybersecurity Agency Warns Against Chinese APTs (lien direct) | The document directly mentions APT27, APT30, APT31, Ke3chang, Gallium and Mustang Panda | APT 30 APT 27 APT 15 APT 25 APT 31 | ★★ | |
 |
2023-02-17 12:19:21 | Norwegian police recover $5.8M crypto from massive Axie Infinity hack (lien direct) | Norwegian police (Økokrim) have seized 60 million kroner ($5,800,000) worth of cryptocurrency stolen by the North Korean Lazarus hacking group last year from Axie Infinity's Ronin Bridge. [...] | Hack | APT 38 | ★★ |
 |
2023-02-17 05:15:06 | Norway finds a way to recover crypto North Korea pinched in Axie heist (lien direct) | Meanwhile South Korea's Do Kwon is sought for fraud by US authorities Norwegian authorities announced on Thursday that they had recovered $5.9 million of cryptocurrency stolen in the Axie Infinity hack – an incident widely held to have been perpetrated by the Lazarus Group, which has links to North Korea.… | Hack Medical | APT 38 | ★★★ |
|
2023-02-15 20:29:00 | North Korea\'s APT37 Targeting Southern Counterpart with New M2RAT Malware (lien direct) | The North Korea-linked threat actor tracked as APT37 has been linked to a piece of new malware dubbed M2RAT in attacks targeting its southern counterpart, suggesting continued evolution of the group's features and tactics. APT37, also tracked under the monikers Reaper, RedEyes, Ricochet Chollima, and ScarCruft, is linked to North Korea's Ministry of State Security (MSS) unlike the Lazarus and | Malware Threat Cloud | APT 38 APT 37 | ★★ |
 |
2023-02-15 10:06:57 | RedEyes Hackers Adopts New Malware, Steals Data From Devices (lien direct) | The APT37 threat group targets people for intelligence gathering using the new elusive “M2RAT” malware and steganography. North Korea’s APT37, sometimes referred to as “RedEyes” or “ScarCruft,” is a hacker collective thought to be funded by the government. The hacker gang was observed in 2022 using Internet Explorer zero-day vulnerabilities to distribute a wide range […] | Malware Threat Cloud | APT 37 | ★★ |
|
2023-02-14 17:37:57 | RedEyes hackers use new malware to steal data from Windows, phones (lien direct) | The APT37 threat group (aka 'RedEyes' or 'ScarCruft') has been spotted using a new evasive malware named 'M2RAT' along with steganography to attack specific individuals for intelligence collection. [...] | Malware Threat Cloud | APT 37 | ★★ |
|
2023-02-13 14:00:00 | Avoid Being a Downstream Victim of Service Provider Attacks (lien direct) | >Attacks on service providers are mounting — and so are downstream victims. Earlier this year, some customers of the cloud service provider DigitalOcean received emails instructing them to reset their passwords. These users hadn’t actually forgotten their passwords — their email addresses had been compromised in a data breach. But the cybersecurity incident didn’t start […] | APT 32 | ★★ | |
|
2023-02-07 21:05:00 | DPRK Using Unpatched Zimbra Devices to Spy on Researchers (lien direct) | Lazarus Group used a known Zimbra bug to steal data from medical and energy researchers. | Medical Medical | APT 38 | ★★★ |
To see everything:
Our RSS (filtrered)
