What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2021-06-10 11:18:22 | \'Fancy Lazarus\' Criminal Group Launches DDoS Extortion Campaign (lien direct) | APT 38 | |||
 |
2021-06-02 15:00:00 | Anomali Cyber Watch: Attacks Against Israeli Targets, MacOS Zero-Days, Conti Ransomware Targeting US Healthcare and More (lien direct) | The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: Agrius, Conti, North Korea, JSWorm, Nobelium, Phishing, Strrat and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.
Trending Cyber News and Threat Intelligence
New Sophisticated Email-based Attack From NOBELIUM
(published: May 28, 2021)
NOBELIUM, the threat actor behind SolarWinds attacks, has been conducting a widespread email campaign against more than 150 organizations. Using attached HTML files containing JavaScript, the email will write an ISO file to disk; this contains a Cobalt Strike beacon that will activate on completion. Once detonated, the attackers have persistent access to a victims’ system for additional objectives such as data harvesting/exfiltration, monitoring, and lateral movement.
Analyst Comment: Be sure to update and monitor email filter rules constantly. As noted in the report, many organizations managed to block these malicious emails; however, some payloads successfully bypassed cloud security due to incorrect/poorly implemented filter rules.
MITRE ATT&CK: [MITRE ATT&CK] Spearphishing Link - T1192 | [MITRE ATT&CK] Spearphishing Attachment - T1193
Tags: Nobelium, SolarWinds, TearDrop, CVE-2021-1879, Government, Military
Evolution of JSWorm Ransomware
(published: May 25, 2021)
JSWorm ransomware was discovered in 2019, and since then different variants have gained notoriety under different names such as Nemty, Nefilim, and Offwhite, among others. It has been used to target multiple industries with the largest concentration in engineering, and others including finance, healthcare, and energy. While the underlying code has been rewritten from C++ to Golang (and back again), along with revolving distribution methods, JSWorm remains a consistent threat.
Analyst Comment: Ransomware threats often affect organisations in two ways. First encrypting operational critical documents and data. In these cases EDR solutions will help to block potential Ransomwares and data backup solutions will help for restoring files in case an attack is successful. Secondly, sensitive customer and business files are exfiltrated and leaked online by ransomware gangs. DLP solutions will help to identify and block potential data exfiltration attempts. Whereas network segregation and encryption of critical data will play an important role in reducing the risk.
MITRE ATT&CK: [MITRE ATT&CK] Obfuscated Files or Information - T1027 | [MITRE ATT&CK] Private Keys - T1145 | [MITRE ATT&CK] Remote File Copy - T1105 | [MITRE ATT&CK] System Owner/User Discovery - T1033 | [MITRE ATT&CK] Code Signing - T1116 | [MITRE ATT&CK] BITS Jobs - T1197 |
Ransomware Malware Threat Medical | Solardwinds APT 38 APT 28 | |
 |
2021-05-24 10:23:01 | Researchers Link CryptoCore Attacks On Cryptocurrency Exchanges to North Korea (lien direct) | State-sponsored hackers affiliated with North Korea have been behind a slew of attacks on cryptocurrency exchanges over the past three years, new evidence has revealed.
Attributing the attack with "medium-high" likelihood to the Lazarus Group (aka APT38 or Hidden Cobra), researchers from Israeli cybersecurity firm ClearSky said the campaign, dubbed "CryptoCore," targeted crypto exchanges in |
Medical | APT 38 APT 28 | |
 |
2021-05-24 10:02:03 | North Korean hackers behind CryptoCore multi-million dollar heists (lien direct) | Security researchers piecing together evidence from multiple attacks on cryptocurrency exchanges, attributed to a threat actor they named CryptoCore have established a strong connection to the North Korean state-sponsored group Lazarus. [...] | Threat | APT 38 | |
|
2021-04-27 17:24:00 | Anomali Cyber Watch: HabitsRAT Targeting Linux and Windows Servers, Lazarus Group Targetting South Korean Orgs, Multiple Zero-Days and More (lien direct) | The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Android Malware, RATs, Phishing, QLocker Ransomware and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.
Trending Cyber News and Threat Intelligence
Zero-day Vulnerabilities in SonicWall Email Security Actively Exploited
(published: April 21, 2021)
US cybersecurity company SonicWall said fixes have been published to resolve three critical issues in its email security solution that are being actively exploited in the wild. The vulnerabilities are tracked as CVE-2021-20021, CVE-2021-20022, and CVE-2021-20023, impacting SonicWall ES/Hosted Email Security (HES) versions 10.0.1 and above.
Analyst Comment: The patches for these vulnerabilities have been issued and should be applied as soon as possible to avoid potential malicious behaviour. SonicWall’s security notice can be found here https://www.sonicwall.com/support/product-notification/security-notice-sonicwall-email-security-zero-day-vulnerabilities/210416112932360/. It is important that your company has patch-maintenance policies in place. Once a vulnerability has been publicly reported,, threat actors will likely attempt to incorporate the exploitation of the vulnerability into their malicious operations. Patches should be reviewed and applied as soon as possible to prevent potential malicious activity.
MITRE ATT&CK: [MITRE ATT&CK] Remote File Copy - T1105 | [MITRE ATT&CK] File and Directory Discovery - T1083
Tags: CVE-2021-20021, CVE-2021-20023, CVE-2021-20022
Massive Qlocker Ransomware Attack Uses 7zip to Encrypt QNAP Devices
(published: April 21, 2021)
The ransomware is called Qlocker and began targeting QNAP devices on April 19th, 2021. All victims are told to pay 0.01 Bitcoins, which is approximately $557.74, to get a password for their archived files. While the files are being locked, the Resource Monitor will display numerous '7z' processes which are the 7zip command-line executable.
Analyst Comment: Attackers are using legitimate tools like 7zip to evade detections by traditional antiviruses. EDR solutions can help tracking suspicious command line arguments and process creations to potentially detect such attacks. Customers should use backup solutions to be able recover encrypted files.
MITRE ATT&CK: [MITRE ATT&CK] Credentials in Files - T1081
Tags: Tor, Qlocker, CVE-2020-2509, CVE-2020-36195
Novel Email-Based Campaign Targets Bloomberg Clients with RATs
(published: April 21, 2021)
A new e-mail-based campaign by an emerging threat actor aims to spread various remote access trojans (RATs) to a very specific group of targets who use Bloomberg's industry-based services. Attacks start in the form of targeted emails to c |
Ransomware Malware Tool Vulnerability Threat Medical | Wannacry Wannacry APT 38 APT 28 | |
 |
2021-04-22 08:30:22 | Smashing Security podcast #224: The Lazarus Heist, Facebook faux pas, and no-cost security (lien direct) | Facebook has managed to do the seemingly impossible - and had a data breach about its handling of a data breach. Meanwhile, we chat to the host of the brand new podcast about North Korea's hackers targeting the rest of the world, and discuss if an intern can be trusted to monitor your security. All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Geoff White and featuring an interview with Duo's Helen Patton. | Data Breach | APT 38 APT 28 | |
 |
2021-04-20 16:06:24 | North Korea-linked Lazarus APT hides malicious code within BMP image to avoid detection (lien direct) | North Korea-linked Lazarus APT group is abusing bitmap (.BMP) image files in a recent spear-phishing campaign targeting entities in South Korea. Experts from Malwarebytes have uncovered a spear-phishing attack conducted by a North Korea-linked Lazarus APT group that obfuscated a malicious code within a bitmap (.BMP) image file. The malicious code within the bitmap image […] | APT 38 APT 28 | ||
 |
2021-04-20 10:35:48 | Lazarus hacking group now hides payloads in BMP image files (lien direct) | South Korea continues to be a favored target. | APT 38 | ||
|
2021-04-19 22:33:45 | Lazarus APT Hackers are now using BMP images to hide RAT malware (lien direct) | A spear-phishing attack operated by a North Korean threat actor targeting its southern counterpart has been found to conceal its malicious code within a bitmap (.BMP) image file to drop a remote access trojan (RAT) capable of stealing sensitive information.
Attributing the attack to the Lazarus Group based on similarities to prior tactics adopted by the adversary, researchers from Malwarebytes |
Malware Threat Medical | APT 38 | |
|
2021-04-16 06:22:51 | Lazarus BTC Changer. Back in action with JS sniffers redesigned to steal crypto (lien direct) | Group-IB observed the North Korea-linked Lazarus APT group stealing cryptocurrency using a never-before-seen tool. In the last five years, JavaScript sniffers have grown into one of the most dangerous threats for e-commerce businesses. The simple nature of such attacks combined with the use of malicious JavaScript code for intercepting payment data attract more and more […] | APT 38 APT 28 | ||
|
2021-04-08 09:36:31 | Vyveva: Lazarus hacking group\'s latest weapon strikes South African freight (lien direct) | The backdoor is being used to spy on the activities of freight companies. | APT 38 APT 28 | ||
 |
2021-04-08 09:30:57 | (Are you) afreight of the dark? Watch out for Vyveva, new Lazarus backdoor (lien direct) | ESET researchers discover a new Lazarus backdoor deployed against a freight logistics firm in South Africa | APT 38 APT 28 | ||
|
2021-04-08 09:01:17 | North Korean hackers use new Vyveva malware to attack freighters (lien direct) | The North Korean-backed Lazarus hacking group used new malware with backdoor capabilities dubbed Vyveva by ESET researchers in targeted attacks against a South African freight logistics company. [...] | Malware | APT 38 APT 28 | |
|
2021-03-23 14:00:00 | Anomali Cyber Watch: APT, Malware, Vulnerabilities and More. (lien direct) | The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: BlackRock, CopperStealer, Go, Lazarus, Mirai, Mustang Panda, Rust, Tax Season, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.
Trending Cyber News and Threat Intelligence
Bogus Android Clubhouse App Drops Credential-Swiping Malware
(published: March 19, 2021)
Researchers are warning of a fake version of the popular audio chat app Clubhouse, which delivers malware that steals login credentials for more than 450 apps. Clubhouse has burst on the social media scene over the past few months, gaining hype through its audio-chat rooms where participants can discuss anything from politics to relationships. Despite being invite-only, and only being around for a year, the app is closing in on 13 million downloads. The app is only available on Apple's App Store mobile application marketplace - though plans are in the works to develop one.
Analyst Comment: Use only the official stores to download apps to your devices. Be wary of what kinds of permissions you grant to applications. Before downloading an app, do some research.
MITRE ATT&CK: [MITRE ATT&CK] Remote File Copy - T1105
Tags: LokiBot, BlackRock, Banking, Android, Clubhouse
Trojanized Xcode Project Slips XcodeSpy Malware to Apple Developers
(published: March 18, 2021)
Researchers from cybersecurity firm SentinelOne have discovered a malicious version of the legitimate iOS TabBarInteraction Xcode project being distributed in a supply-chain attack. The malware, dubbed XcodeSpy, targets Xcode, an integrated development environment (IDE) used in macOS for developing Apple software and applications. The malicious project is a ripped version of TabBarInteraction, a legitimate project that has not been compromised. Malicious Xcode projects are being used to hijack developer systems and spread custom EggShell backdoors.
Analyst Comment: Researchers attribute this new targeting of Apple developers to North Korea and Lazarus group: similar TTPs of compromising developer supply chain were discovered in January 2021 when North Korean APT was using a malicious Visual Studio project. Moreover, one of the victims of XcodeSpy is a Japanese organization regularly targeted by North Korea. A behavioral detection solution is required to fully detect the presence of XcodeSpy payloads.
MITRE ATT&CK: [MITRE ATT&CK] Remote File Copy - T1105 | [MITRE ATT&CK] Security Software Discovery - T1063 | [MITRE ATT&CK] Obfuscated Files or Information - T1027
Tags: Lazarus, XcodeSpy, North Korea, EggShell, Xcode, Apple
Cybereason Exposes Campaign Targeting US Taxpayers with NetWire and Remcos Malware
(published: March 18, 2021)
Cybereason detected a new campaig |
Ransomware Malware Tool Threat Patching Medical | APT 38 APT 28 | |
 |
2021-03-04 13:01:47 | Le groupe APT Lazarus se tourne à présent vers l\'industrie de la défense (lien direct) | Les chercheurs de Kaspersky ont identifié une nouvelle campagne, jusqu'alors inconnue, menée par Lazarus, un acteur APT très prolifique. Actif depuis au moins 2009, Lazarus est lié à un certain nombre de campagnes, notamment à l'encontre du marché des crypto-monnaies. The post Le groupe APT Lazarus se tourne à présent vers l'industrie de la défense first appeared on UnderNews. | APT 38 APT 28 | ||
 |
2021-02-26 19:56:39 | Lazarus Targets Defense Companies with ThreatNeedle Malware (lien direct) | A spear-phishing campaigned linked to a North Korean APT uses “NukeSped” malware in cyberespionage attacks against defense companies. | Malware | APT 38 | |
 |
2021-02-26 04:48:42 | Here\'s How North Korean Hackers Stole Data From Isolated Network Segment (lien direct) | During an attack on the defense industry, the North Korea-linked threat group known as Lazarus was able to exfiltrate data from a restricted network segment by taking control of a router and setting it up as a proxy server. | Threat | APT 38 APT 28 | |
|
2021-02-26 03:02:08 | North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware (lien direct) | A prolific North Korean state-sponsored hacking group has been tied to a new ongoing espionage campaign aimed at exfiltrating sensitive information from organizations in the defense industry.
Attributing the attacks with high confidence to the Lazarus Group, the new findings from Kaspersky signal an expansion of the APT actor's tactics by going beyond the usual gamut of financially-motivated |
Malware Medical | APT 38 | ★★ |
|
2021-02-25 17:50:39 | North Korea-linked Lazarus APT targets defense industry with ThreatNeedle backdoor (lien direct) | North Korea-linked Lazarus APT group has targeted the defense industry with the custom-backdoor dubbed ThreatNeedle since 2020. North Korea-linked Lazarus APT group has targeted the defense industry with the backdoor dubbed ThreatNeedle since early 2020. The state-sponsored hackers targeted organizations from more than a dozen countries. The experts discovered the custom backdoor while investigating an […] | APT 38 APT 28 | ||
 |
2021-02-25 16:49:06 | North Korean hackers find another new target: The defense industry (lien direct) | The Lazarus group had a busy 2020, and 2021 is shaping up to be another devastatingly productive year for one of the most dangerous hacking groups on the planet. | Medical | APT 38 APT 28 | |
 |
2021-02-25 10:00:53 | Lazarus targets defense industry with ThreatNeedle (lien direct) | In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group's other campaigns. | Malware | APT 38 APT 28 | |
 |
2021-02-18 11:10:00 | (Déjà vu) Two More Lazarus Group Members Indicted for North Korean Attacks (lien direct) | Sony Pictures, WannaCry and string of heists blamed on agents | Wannacry Wannacry APT 38 APT 28 | ★★★ | |
|
2021-02-17 22:25:42 | US DoJ charges three members of the North Korea-linked Lazarus APT group (lien direct) | The US DOJ charged three members of the North Korea-linked Lazarus Advanced Persistent Threat (APT) group. The U.S. Justice Department indicted three North Korean military intelligence officials, members of the Lazarus APT group, for their involvement in cyber-attacks, including the theft of $1.3 billion in money and crypto-currency from organizations around the globe. The indictment […] | Threat | APT 38 APT 28 | |
|
2021-02-17 18:20:28 | (Déjà vu) U.S. Accuses North Korean Hackers of Stealing Millions (lien direct) | The feds have expanded the list of financial and political hacking crimes they allege are linked to Lazarus Group and North Korea. | Medical | APT 38 APT 28 | |
|
2021-02-17 17:33:00 | (Déjà vu) US charges two more members of the \'Lazarus\' North Korean hacking group (lien direct) | The US DOJ described the North Korean hackers as "the world's leading bank robbers" and "a criminal syndicate with a flag." | Guideline | APT 38 | |
 |
2021-02-17 12:25:00 | (Déjà vu) North Korean Lazarus Group hackers indicted in US (lien direct) | The US DOJ described the North Korean hackers as "the world's leading bank robbers" and "a criminal syndicate with a flag." | APT 38 APT 28 | ||
|
2021-01-29 14:49:07 | Microsoft: North Korea-linked Zinc APT targets security experts (lien direct) | Microsoft, like Google TAG, observed a cyber espionage campaign aimed at vulnerability researchers that attributed to North Korea-linked Zinc APT group. Researchers from Microsoft monitored a cyber espionage campaign aimed at vulnerability researchers and attributed the attacks to North Korea-linked Zinc APT group. “In recent months, Microsoft has detected cyberattacks targeting security researchers by an […] | Vulnerability Medical | APT 38 | |
|
2021-01-29 13:29:10 | Lazarus Affiliate \'ZINC\' Blamed for Campaign Against Security Researcher (lien direct) | New details emerge of how North Korean-linked APT won trust of experts and exploited Visual Studio to infect systems with 'Comebacker' malware. | APT 38 | ||
|
2021-01-28 14:47:45 | Microsoft: DPRK hackers \'likely\' hit researchers with Chrome exploit (lien direct) | Today, Microsoft disclosed that they have also been monitoring the targeted attacks against vulnerability researchers for months and have attributed the attacks to a DPRK group named 'Zinc.' [...] | Vulnerability Medical | APT 38 | |
|
2021-01-03 09:21:19 | (Déjà vu) COVID-19 themed attacks December 19, 2020– January 02, 2021 (lien direct) | This post includes the details of the COVID-19 themed attacks launched from December 19, 2020– January 02, 2021. 25 December, 2020 – North Korea-linked Lazarus APT targets the COVID-19 research The North Korea-linked Lazarus APT group has recently launched cyberattacks against at least two organizations involved in COVID19 research. 30 December, 2020 – US Treasury […] | APT 38 APT 28 | ||
|
2020-12-25 18:45:15 | (Déjà vu) North Korea-linked Lazarus APT targets the COVID-19 research (lien direct) | The North Korea-linked Lazarus APT group has recently launched cyberattacks against at least two organizations involved in COVID-19 research. The North Korea-linked APT group Lazarus has recently launched cyberattacks against two entities involved in COVID-19 research. The activity of the Lazarus APT group surged in 2014 and 2015, its members used mostly custom-tailored malware in their attacks. […] | Malware | APT 38 APT 28 | |
|
2020-12-24 12:00:11 | North Korean state hackers breach COVID-19 research entities (lien direct) | North Korean nation-state hackers tracked as the Lazarus Group have recently compromised organizations involved in COVID-19 research and vaccine development. [...] | Medical | APT 38 APT 28 | |
|
2020-12-23 23:24:40 | North Korean Hackers Trying to Steal COVID-19 Vaccine Research (lien direct) | Threat actors such as the notorious Lazarus group are continuing to tap into the ongoing COVID-19 vaccine research to steal sensitive information to speed up their countries' vaccine-development efforts.
Cybersecurity firm Kaspersky detailed two incidents at a pharmaceutical company and a government ministry in September and October leveraging different tools and techniques but exhibiting |
Threat Medical | APT 38 APT 28 | |
|
2020-12-23 19:02:30 | Lazarus Group Hits COVID-19 Vaccine-Maker in Espionage Attack (lien direct) | The nation-state actor is looking to speed up vaccine development efforts in North Korea. | APT 38 | ||
|
2020-12-23 18:14:00 | Lazarus Attacks Vaccine Research (lien direct) | APT group Lazarus attacks two targets related to COVID-19 vaccine research | APT 38 APT 28 | ||
 |
2020-12-23 11:33:10 | Les recherches du vaccin contre la Covid-19 suscitent toujours autant d\'intérêt Kaspersky identifie deux nouveaux APT ciblant des établissements de recherche et institutions de régulation sanitaire (lien direct) | Au cours de l'automne 2020, les chercheurs de Kaspersky ont identifié deux nouveaux incidents APT visant des établissements de recherche du vaccin contre la Covid-19 - un organisme d'un Ministère de la Santé et une entreprise pharmaceutique. Les experts de Kaspersky ont évalué avec une grande confiance que ces activités peuvent être attribuées au tristement célèbre groupe Lazarus. Alors que la pandémie et les mesures pour ralentir la diffusion du virus se poursuivent dans le monde entier, de nombreux (...) - Malwares | APT 38 | ||
|
2020-12-23 10:00:08 | Lazarus covets COVID-19-related intelligence (lien direct) | As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that actors, such as the Lazarus group, are going after intelligence that could help these efforts by attacking entities related to COVID-19 research. | Threat Medical | APT 38 APT 28 | |
 |
2020-12-03 04:01:42 | How to Protect Your Business From Multi-Platform Malware Systems (lien direct) | The Lazarus Group (also known as Guardians of Peace or Whois) is a notorious cybercrime gang made up of unknown individuals. According to the United States Federal Bureau of Investigations, the group is a North Korean “state-sponsored hacking organization.” However, some believe that their connections to North Korea might be a false flag intending to […]… Read More | Malware Medical | APT 38 | |
|
2020-11-18 09:09:22 | ESET Research décode les procédés du groupe Lazarus (lien direct) | Les chercheurs d'ESET ont récemment découvert des tentatives de déploiement du malware Lazarus via un la technique dite d'attaque de la chaîne d'approvisionnement (Supply chain attack) en Corée du Sud. Afin d'installer leur malware, les attaquants ont utilisé un mécanisme inhabituel, détournant un logiciel de sécurité sud-coréen légitime et des certificats volés à deux sociétés différentes. Dans ce contexte, l'attaque a été facilitée car les internautes sud-coréens sont souvent invités à installer des logiciels (...) - Malwares | Malware | APT 38 | |
 |
2020-11-17 14:14:34 | (Déjà vu) Experts Reacted On Lazarus Malware Strikes South Korean Supply Chains (lien direct) | It has been reported that Lazarus malware has been tracked in new campaigns against South Korean supply chains, made possible through stolen security certificates. Today, cybersecurity researchers from ESET revealed the abuse of the… The ISBuzz Post: This Post Experts Reacted On Lazarus Malware Strikes South Korean Supply Chains | Malware | APT 38 | |
|
2020-11-17 14:10:55 | Hackers Pose As WHO Officials To Attack COVID-19 Vaccines (lien direct) | Pharmaceutical companies researching treatments and vaccines for COVID-19 are being actively targeted by prominent nation state-backed hackers from Russia and North Korea, according to IT Pro. Groups including Strontium, Zinc… The ISBuzz Post: This Post Hackers Pose As WHO Officials To Attack COVID-19 Vaccines | Medical | APT 38 APT 28 | |
 |
2020-11-17 11:19:05 | COVID-19 vaccine research firms targeted by Russian and North Korean hackers (lien direct) | Microsoft has recently alerted governments across the globe that the North Korean hacker groups Cerium and Zinc, as well as the Russian hacker group Strontium, have been targeting organisations involved in COVID-19 vaccine research using brute-force, credential stuffing and spear-phishing attacks. Tom Burt, Microsoft’s Corporate Vice President for Customer Security & Trust, said in a […] | Medical | APT 38 APT 28 APT 43 | |
|
2020-11-16 18:23:36 | Hacked Security Software Used in Novel South Korean Supply-Chain Attack (lien direct) | Lazarus Group is believed to be behind a spate of attacks that leverage stolen digital certificates tied to browser software that secures communication with government and financial websites in South Korea. | Medical | APT 38 | |
|
2020-11-16 15:18:44 | Lazarus malware delivered to South Korean users via supply chain attacks (lien direct) | North Korea-linked Lazarus APT group is behind new campaigns against South Korean supply chains that leverage stolen security certificates. Security experts from ESET reported that North-Korea-linked Lazarus APT (aka HIDDEN COBRA) is behind cyber campaigns targeting South Korean supply chains. According to the experts the nation-state actors leverage stolen security certificates from two separate, legitimate South […] | Malware Medical | APT 38 | |
|
2020-11-16 12:34:50 | Lazarus Group Used Supply Chain Attack to Target South Korean Users with Malware (lien direct) | The Lazarus group leveraged a supply chain attack to target users located in South Korea with custom malware. On November 16, ESET disclosed that the Lazarus group conducted its supply chain attack by abusing WIZVERA VeraPort. This application helps users in South Korea manage the installation of additional computer security software when they visit a […]… Read More | Malware Medical | APT 38 | |
|
2020-11-16 10:30:03 | Lazarus supply‑chain attack in South Korea (lien direct) | ESET researchers uncover a novel Lazarus supply-chain attack leveraging WIZVERA VeraPort software | APT 38 | ||
|
2020-11-16 10:30:03 | Lazarus malware strikes South Korean supply chains (lien direct) | The malware is passing security checks through the abuse of stolen software certificates. | Malware | APT 38 | |
|
2020-11-16 02:29:40 | Trojanized Security Software Hits South Korea Users in Supply-Chain Attack (lien direct) | Cybersecurity researchers took the wraps off a novel supply chain attack in South Korea that abuses legitimate security software and stolen digital certificates to distribute remote administration tools (RATs) on target systems.
Attributing the operation to the Lazarus Group, also known as Hidden Cobra, Slovak internet security company ESET said the state-sponsored threat actor leveraged the |
Threat Medical | APT 38 | |
|
2020-11-13 17:18:12 | Three APT groups have targeted at least seven COVID-19 vaccine makers (lien direct) | At least the three nation-state actors have targeted seven COVID-19 vaccine makers, they are Strontium, Lazarus Group, and Cerium, Microsoft warns. Microsoft revealed that at least three APT groups have targeted seven companies involved in COVID-19 vaccines research and treatments. “In recent months, we've detected cyberattacks from three nation-state actors targeting seven prominent companies directly […] | Medical | APT 38 APT 28 APT 43 | |
|
2020-11-13 14:00:00 | Microsoft says three APTs have targeted seven COVID-19 vaccine makers (lien direct) | The three state-sponsored hacker groups (APTs) are Russia's Strontium (Fancy Bear) and North Korea's Zinc (Lazarus Group) and Cerium. | Medical | APT 38 APT 28 APT 43 |
To see everything:
Our RSS (filtrered)
