What's new arround internet
Last one

Src Date (GMT) Titre Description Tags Stories Notes
ProofPoint.webp 2025-04-17 10:31:17 Autour du monde en 90 jours: les acteurs parrainés par l'État essaient Clickfix
Around the World in 90 Days: State-Sponsored Actors Try ClickFix (lien direct)		 Conclusions clés Alors que principalement une technique affiliée à des acteurs cybercrimins, les chercheurs de ProofPoint ont découvert des acteurs parrainés par l'État dans plusieurs campagnes en utilisant la technique d'ingénierie sociale ClickFix pour la première fois. Sur seulement une période de trois mois de la fin de 2024 au début de 2025, des groupes de Corée du Nord, d'Iran et de Russie ont tous été vus en utilisant la technique Clickfix dans leur activité de routine. L'incorporation de ClickFix ne révolutionne pas les campagnes réalisées par TA427, TA450, UNK_Remooterogue et TA422 mais remplace plutôt les étapes d'installation et d'exécution dans les chaînes d'infection existantes. Bien que actuellement limité à quelques groupes parrainés par l'État, la popularité croissante du fixe de clics dans la cybercriminalité au cours de la dernière année ainsi que dans les campagnes d'espionnage au cours des derniers mois suggère que la technique sera probablement plus testée ou adoptée par des acteurs parrainés par l'État. Aperçu Une tendance majeure dans le paysage des menaces est la fluidité des tactiques, des techniques et des procédures (TTPS). Les acteurs de menace partagent, copiernt, voler, adopter et tester les TTP de la métier exposée publiquement ou l'interaction avec d'autres groupes de menaces. Plus précisément, les acteurs parrainés par l'État ont souvent mis à profit les techniques développées et déployées pour la première fois par des acteurs cybercriminaux. Par exemple, les acteurs de la menace nord-coréenne copiant les techniques de la cybercriminalité pour voler la crypto-monnaie au nom du gouvernement, ou des groupes chinois imitant les chaînes d'infection de cybercriminalité pour livrer des logiciels malveillants dans les opérations d'espionnage. L'exemple le plus récent de cette tendance est Clickfix. ClickFix est une technique d'ingénierie sociale qui utilise des boîtes de dialogue avec des instructions pour copier, coller et exécuter des commandes malveillantes sur la machine Target \\. Cette technique créative utilise non seulement de faux messages d'erreur comme problème, mais aussi une alerte faisant autorité et des instructions provenant du système d'exploitation en tant que solution. Principalement observé dans l'activité de la cybercriminalité, la technique Clickfix a été vue pour la première fois début mars 2024 déployé par le courtier d'accès initial TA571 et le cluster Clearfake, après quoi il a inondé le paysage des menaces. Un an plus tard, au moins quatre acteurs de menaces parrainés par l'État ont depuis expérimenté des variations de cette technique dans le cadre de leurs campagnes d'espionnage habituées. Sur environ trois mois d'octobre 2024 à janvier 2025, les acteurs de la menace provenant de trois pays distincts (Corée du Nord, Iran et Russie) ont incorporé Clickfix comme étape de leurs chaînes d'infection. Corée du Nord: TA427 En janvier et février 2025, ProofPoint a d'abord observé les opérateurs TA427 ciblant les individus dans moins de cinq organisations dans le secteur des ateliers avec une nouvelle chaîne d'infection en utilisant la technique ClickFix. Ta427 chevauche avec des tiers de l'activité appelée kimsuky ou grésil émeraude. TA427 a établi un contact initial avec l'objectif grâce à une demande de réunion d'un expéditeur usurpé livré aux cibles traditionnelles TA427 travaillant sur les affaires nord-coréennes. Après une brève conversation pour engager la cible et renforcer la confiance, comme on le voit souvent dans l'activité TA427, les attaquants ont dirigé la cible vers un site contrôlé par l'attaquant où ils ont convaincu la cible d'exécuter une commande PowerShell. Bien qu'une chaîne n'ait pas réussi à récupérer d'autres charges utiles, une autre instance de cette campagne comprenait une chaîne à plusieurs étages qui a exécuté PowerShell, VBS et les scripts par lots, ce qui a finalement conduit à une charge utile finale - Quasarrat Malware Tool Vulnerability Threat Prediction Cloud APT 28 ★★★
RiskIQ.webp 2024-11-04 12:25:16 Faits saillants hebdomadaires d'osint, 4 novembre 2024
Weekly OSINT Highlights, 4 November 2024 (lien direct)		 ## Instantané La semaine dernière, les rapports OSINT de \\ ont mis en évidence l'activité de menace parrainée par l'État et la menace cybercriminale, avec divers vecteurs d'attaque et cibles dans les secteurs.Des acteurs apt en Corée du Nord, en Chine et en Russie ont mené des campagnes ciblées de phishing, de réseau et de campagnes de logiciels malveillants.Les groupes nord-coréens et russes ont favorisé les tactiques de vol d'identification et de ransomwares ciblant les secteurs du gouvernement aux militaires, tandis que les acteurs chinois ont exploité les vulnérabilités de pare-feu pour obtenir un accès à long terme dans les secteurs à enjeux élevés.Pendant ce temps, les cybercriminels ont mis à profit l'ingénierie sociale, le Vishing et l'IoT et les vulnérabilités de plugin pour infiltrer les environnements cloud, les appareils IoT et les systèmes Android.L'accent mis sur l'exploitation des vulnérabilités de logiciels populaires et des plateformes Web souligne l'adaptabilité de ces acteurs de menace à mesure qu'ils étendent leur portée d'attaque, en particulier dans l'utilisation des stratégies de cloud, de virtualisation et de cryptomiminage dans une gamme d'industries. ## Description 1. [Jumpy Poisses Ransomware Collaboration] (https://sip.security.microsoft.com/intel-explorer/articles/393b61a9): l'unité 42 a rapporté la Corée du Nord \'s Jucky Pisse (Onyx Sleet) en partenariat avec Play Ransomware in \'s Jumpy Pisses (ONYX Sleet) en partenariat avec Play Ransomware dans Play Ransomware in Jumpy Pisses (ONYX Sleet)Une attaque à motivation financière ciblant les organisations non spécifiées.L'acteur de menace a utilisé des outils comme Sliver, Dtrack et Psexec pour gagner de la persistance et dégénérerPrivilèges, se terminant par le déploiement des ransomwares de jeu. 1. [Menaces chinoises ciblant les pare-feu] (https://sip.security.microsoft.com/intel-Explorateur / articles / 798C0FDB): Sophos X-OPS a identifié des groupes basés en Chine comme Volt Typhoon, APT31 et APT41 exploitant des pare-feu pour accéderPacifique.Ces groupes utilisent des techniques sophistiquées telles que les rootkits de vie et multiplateforme. 1. [Campagne de phishing sur la plate-forme Naver] (https://sip.security.microsoft.com/intel-explorer/articles/dfee0ab5): les acteurs liés au nord-coréen ont lancé une campagne de phishing ciblant la Corée du Sud \'s Naver, tentantPour voler des informations d'identification de connexion via plusieurs domaines de phishing.L'infrastructure, avec les modifications du certificat SSL et les capacités de suivi, s'aligne sur Kimsuky (Emerald Sleet), connu pour ses tactiques de vol d'identification. 1. [FAKECALL Vishing malware sur Android] (https://sip.security.microsoft.com/intel-explorer/articles/d94c18b0): les chercheurs de Zimperium ont identifié des techniques de vitesses de malware FAKECALT pour voler les utilisateurs de l'Android.Le malware intercepte les appels et imite le numéroteur d'Android \\, permettant aux attaquants de tromper les utilisateurs pour divulguer des informations sensibles. 1. [Facebook Business Phishing Campaign] (https://sip.security.microsoft.com/intel-explorer/articles/82b49ffd): Cisco Talos a détecté une attaque de phishing ciblant les comptes commerciaux Facebook à Taiwan, en utilisant des avis juridiques comme leurre.Lummac2 et les logiciels malveillants de volée des informations de Rhadamanthys ont été intégrés dans des fichiers RAR, collectionner des informations d'identification du système et éluder la détection par l'obscurcissement et l'injection de processus. 1. [Vulnérabilité des caches litres de LiteSpeed] (https://sip.security.microsoft.com/intel-explorer/articles/a85b69db): le défaut du plugin de cache LiteSpeets (CVE-2024-50550) pourrait permettre une escalale de privilège à un niveau de privilège à plus de six millions pour plus de six millionssites.Les vulnérabilités exploitées ont permis aux attaquants de télécharger des plugins ma Ransomware Malware Tool Vulnerability Threat Mobile Prediction Medical Cloud Technical APT 41 APT 28 APT 31 Guam ★★★
AlienVault.webp 2024-11-01 19:39:00 Ngioweb reste actif 7 ans plus tard
Ngioweb Remains Active 7 Years Later (lien direct)		 Executive Summary Seven years after its first appearance, the proxy server botnet Ngioweb continues its impactful presence on the internet with barely any relevant changes in its original code. Threat actors have continued to actively use Nbioweb extensively to scan for vulnerable devices (including a new arsenal of exploits) which can be turned into new proxies. All infected systems are then sold in the black market for pennies as residential proxies via Nsocks. Key Takeaways: Nsocks offers 30,000 IPs globally and sells them for prices under $1.50 for 24hours of access. The main targets are residential ISP users, representing more than 75% of the infected users. The threat actors behind Ngioweb are using dedicated scanners per vulnerability/device to avoid exposing their whole arsenal. Linear eMerge, Zyxel routers, and Neato vacuums are some of the most targeted devices, but there are many other routers, cameras, and access control systems being targeted. Ngioweb Background In August 2018, Check Point published a report and deep analysis on a new multifunctional proxy server botnet named Ngioweb. The proxy service was being loaded by the banking malware family Ramnit. In their report, Check Point reported that the first sample was observed in the second half of 2017. After the publication of that initial report, additional articles were released.  Netlab wrote two blogs that took a deep-dive into the available Ngioweb samples, describing the domain generating algorithm (DGA), communication protocols, command and control (C&C) infrastructure, exploited CVEs for D-Link and Netgear devices, its updated features, and more. For details on the nature of Ngioweb, read Netlab’s blog which includes coverage that remains valid today.[t1] [PA2]  Most recently, in 2024 TrendMicro reported how cybercriminals and nation states are leveraging residential proxy providers to perform malicious actions. For example, one of these nation-state actors, Pawn Storm, had been using a network of hundreds of small office and home office (SOHO) routers through January 2024, when the FBI neutralized part of the botnet. During TrendMicro’s investigation of several EdgeOS infected systems, they identified that in addition to Pawn Storm, the Canadian Pharmacy gang and a threat actor using Ngioweb malware were also abusing the infected device. Malware Analysis This last spring 2024, LevelBlue Labs identified scanning activity on vulnerable devices and those devices were carrying Ngioweb as the delivered payload. Depending on the targeted system, the exploit used a downloader for several CPU architectures or directly contained the specific payload for the targeted system. One of the samples obtained during 2024 (be285b77211d1a33b7ae1665623a9526f58219e20a685b6548bc2d8e857b6b44) allowed LevelBlue Labs to determine that the Ngioweb trojan our researchers identified works very similarly to how Ngioweb worked in 2019, with only a few, slight modifications to Ngioweb’s original code added to elude detections or nosy security researchers. DGA domains Domain generation algorithms (DGA) aren’t new to Ngioweb (they have been identified as present in previous reports, specifically when Netlab sinkholed several domains). The Ngioweb sample LevelBlue Labs analyzed uses a very similar algorithm to those that have been identified in the past. The DGA selects domains from a pool of thousands, depending on the malware configurations, and it will then start trying to connect to all of them until it finds a resolving domain. However, in an attempt to avoid the first stage C&C being sinkholed by researchers, the threat actors using the sample LevelBlue Labs analyzed have included a sanity check. All active C&C communications carry a unique and encrypted TXT response that acts as a signature of its authenticity. This response carries Malware Vulnerability Threat Mobile Technical APT 28 ★★★
RiskIQ.webp 2024-10-28 12:22:25 Cyberattack UAC-0001 (APT28): Commande PowerShell dans le presse-papiers comme "point d'entrée"
Cyberattack UAC-0001 (APT28): PowerShell command in the clipboard as an "entry point" (lien direct)		 #### Géolocations ciblées - Ukraine #### Industries ciblées - agences et services gouvernementaux ## Instantané L'équipe gouvernementale d'intervention d'urgence informatique d'Ukraine (CER-UA) enquête sur les e-mails de phishing ciblant les gouvernements locaux ukrainiens, déguisé par le "remplacement de la table" du sujet et contenant un lien malveillant imitant les feuilles de Google.Cette activité, qui tire parti de l'ingénierie sociale et du PowerShell pour voler des informations d'identification et déployer Metasploit, est probablement liée à l'acteur de menace russe APT28, suivi par Microsoft comme [Forest Blizzard] (https://sip.security.microsoft.com/intel-profiles/ DD75F93B2A771C9510DCEEC817B9D34D868C2D1353D08C8C1647DE067270FDF8). ## Description En cliquant sur le lien dans l'e-mail, les utilisateurs sont présentés avec une fausse invite Recaptcha.Suivant les instructions de l'invite \\ lance une commande PowerShell qui télécharge et exécute des fichiers permettant un tunneling SSH, un vol d'identification du navigateur (de Chrome, Edge, Opera, Firefox) et le déploiement Metasploit sur la machine compromise. CERT-UA note un incident connexe en septembre 2024, où [les attaquants ont exploité une vulnérabilité du cube rond] (https://sip.security.microsoft.com/intel-explorer/articles/7c0b1160) ([CVE-2023-43770] (https: //sip.security.microsoft.com/intel-explorer/cves/cve-2023-43770/)) pour intercepter les données de messagerie et rediriger les boîtes aux lettres vers l'adresse de l'attaquant \\.Les deux attaques ont utilisé un serveur compromis, "Mail.zhblz \ [. \] Com", et plus de 10 comptes de messagerie gouvernementaux ont été compromis et surveillés par les attaquants pour répandre les exploits, atteignant même les services de défense à l'étranger. ## Analyse Microsoft et contexte OSINT supplémentaire Le groupe Microsoft suit en tant que Forest Blizzard (Strontium) est un acteur de menace parrainé par l'État russe qui cible principalement le gouvernement, l'énergie, les transports et les organisations non gouvernementales aux États-Unis, en Europe et au Moyen-Orient.Microsoft a également observé Forest Blizzard (Strontium) ciblant les médias, les technologies de l'information, les organisations sportives et les établissements d'enseignement du monde entier.Les «gouvernements des États-Unis et du Royaume-Uni] (https://media.defense.gov/2021/jul/01/2002753896/-1/-1/1/csa_gru_global_brute_force_campaign_uoo158036-21.pdf) ont lié Blizzard forestier (Strontium) to to to to to to to-to to to-to to to-toUnité 26165 de l'Agence de renseignement militaire de la Fédération de Russie: Direction principale du renseignement de l'état-major général des forces armées de la Fédération de Russie (GRU).   D'autres chercheurs en sécurité ont également rendu compte des attaquants exploitant une vulnérabilité du cube rond à cibler les gouvernements d'Europe centrale.En octobre, [des chercheurs de Positive Technologies identifiés] (https: //sip.security.microsoft.com/intel-explorer/articles/7c0b1160) Une campagne exploitant une vulnérabilité de script de sites croisées stockée (XSS) dans le CLI de la femme Web RoundcubeENT, ciblant les organisations gouvernementales dans la région de la CIS.La vulnérabilité, [CVE-2024-37383] (https://sip.security.microsoft.com/intel-explorer/cves/cve-2024-37383/?tid=72F988BF-86F1-41AF-91AB-2D7CD011DB47), AuthorL'exécution du code JavaScript malveillant sur la page RoundCube lorsqu'un e-mail spécialement conçu est ouvert.Positive Technologies n'a pas attribué publiquement l'attaque. ## Recommandations Microsoft recommande les atténuations suivantes pour réduire l'impact de cette menace. - Allumez [Protection en livraison du cloud] (https://learn.microsoft.com/en-us/defender-endpoint/linux-preférences) dans Microsoft Defender Antivirus ou l'équivalent de votre produit antivirus pour couvrir rapidement les outils d'attaquant en évolutio Ransomware Tool Vulnerability Threat APT 28 ★★★★
RiskIQ.webp 2024-10-23 16:34:48 Faux attachement.Roundcube Mail Server Attacks Exploit CVE-2024-37383 Vulnérabilité.
Fake attachment. Roundcube mail server attacks exploit CVE-2024-37383 vulnerability. (lien direct)		 ## Instantané Les chercheurs de Positive Technologies ont identifié une campagne exploitant une vulnérabilité de script de script inter-sites stockée (XSS) dans le cube rondeClient du webmail, ciblant les organisations gouvernementales dans la région CIS. ## Description La vulnérabilité, [CVE-2024-37383] (https://sip.security.microsoft.com/intel-explorer/cves/cve-2024-37383/?tid=72F988BF-86F1-41AF-91AB-2D7CD011DB47), AuthorL'exécution du code JavaScript malveillant sur la page RoundCube lorsqu'un e-mail spécialement conçu est ouvert.L'attaque, qui a commencé en juin, implique des e-mails avec une pièce jointe .doc mais pas de contenu visible, contenant une charge utile cachée que le client traite.Ce code JavaScript en charge utile, cocoé par base64 déguisé en valeur "HREF", télécharge un document de leurre tout en injectant simultanément un formulaire de connexion non autorisé dans la page HTML pour demander les informations d'identification Roundcube de l'utilisateur \\.Si l'utilisateur remplit la connexion et le mot de passe, les données sont envoyées à un serveur distant sur "libcdn \ [. \] Org".Les attaquants utilisent également le plugin ManageSieve pour exfiltrer les messages du serveur de messagerie.La vulnérabilité affecte les versions Roundcube plus tôt que 1.5.6 et les versions 1.6 à 1.6.6, avec des correctifs publiés dans les versions 1.5.7 et 1.6.7. ## Analyse Microsoft et contexte OSINT supplémentaire Cet incident suit un modèle de pirates exploitant des défauts XSS en Roundcube pour violer les organisations.Autrement dit, cette exploitation la plus récente n'a pas été attribuée à un acteur de menace spécifique, Roundcube est généralement exploité par les acteurs de l'État-nation en raison de son utilisation élevée au sein des agences gouvernementales.En octobre 2023, CISA a ajouté [CVE-2023-5631] (https://security.microsoft.com/intel-explorer/cves/cve-2023-5631/) à la catalogue Vulnérabilités exploitée connue] (https: //www.cisa.gov/ connu-exploited-fulnerabilities-catalog) après que la vulnérabilité a été identifiée et exploitée par des acteurs de menace, notamment Winter Vivern et APT28 (suivi par Microsoft.com/intel Bzzard] (https://security.microsoft.com/intelfard] (https://security.microsoft.com/intel-Profiles / dd75f93b2a771c9510dceec817b9d34d868c2d1353d08c8c1647de067270fdf8)).Cette vulnérabilité permet à un attaquant distant d'envoyer un e-mail HTML qui contient un document Graphics Vector Graphics (SVG) évolutif, qui exécute ensuite JavaScript arbitraire dans les versions Roundcube avant 1.4.15, 1.5.x avant 1.5.5 et 1.6.x avant 1.6.4De façon similaire, en février 2024, CISA a noté [CVE-2023-43770] (https://security.microsoft.com/intel-explorer/cves/cve-2023-43770/) en tant que vulnérabilité exploitée connue qui a permis à XSS par le texte / Texte /Messages électroniques simples dans les versions Roundcube avant 1.4.14, 1.5.x avant 1.5.4 et 1.6.x avant 1.6.3. ## Recommandations Roundcube recommande aux utilisateurs de mettre à jour leur logiciel pour atténuer l'impact.Plus d'informations sur la mise à jour pour chaque vulnérabilité peuvent être trouvées ci-dessous: - [CVE-2024-37383] (https://www.cve.org/cverecord?id=CVE-2024-37383) - [CVE-2023-43770] (https://www.cve.org/cverecord?id=CVE-2023-43770) - [CVE-2023-5631] (https://www.cve.org/cverecord?id=CVE-2023-5631) ## références [Faux attachement.Les attaques du serveur de courrier rondes exploitent CVE-2024-37383 Vulnérabilité] (https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/fake-attachment-boundcube-mail-server-attadiques-Expoit-Cve-2024-37383-Vulnérabilité).Technologies positives (consultées en 2023-10-23). [CVE-2023-5631] (https://www.cve.org/cverecord?id=CVE-2023-5631).Mitre (consulté en 2023-10-23). [CVE-2023-43770] (https://www.cve.org/cverecord?id=CVE-2023-43770).Mitre (consulté en 2023-10-23). ## Copyright **&copie;Microsoft 2024 **.Tous droits réservés.La Vulnerability Threat APT 28 ★★★
Mandiant.webp 2024-09-10 14:00:00 Perspectives sur les cyber-menaces ciblant les utilisateurs et les entreprises au Mexique
Insights on Cyber Threats Targeting Users and Enterprises in Mexico (lien direct)		 Written by: Aurora Blum, Kelli Vanderlee
Like many countries across the globe, Mexico faces a cyber threat landscape made up of a complex interplay of global and local threats, with threat actors carrying out attempted intrusions into critical sectors of Mexican society. Mexico also faces threats posed by the worldwide increase in multifaceted extortion, as ransomware and data theft continue to rise. Threat actors with an array of motivations continue to seek opportunities to exploit the digital infrastructure that Mexicans rely on across all aspects of society. This joint blog brings together our collective understanding of the cyber threat landscape impacting Mexico, combining insights from Google\'s Threat Analysis Group (TAG) and Mandiant\'s frontline intelligence. By sharing our global perspective, especially during today\'s Google for Mexico event, we hope to enable greater resiliency in mitigating these threats. Cyber Espionage Operations Targeting Mexico As the 12th largest economy in the world, Mexico draws attention from cyber espionage actors from multiple nations, with targeting patterns mirroring broader priorities and focus areas that we see elsewhere. Since 2020, cyber espionage groups from more than 10 countries have targeted users in Mexico; however, more than 77% of government-backed phishing activity is concentrated among groups from the People\'s Republic of China (PRC), North Korea, and Russia. Government-backed phishing activity targeting Mexico Figure 1: Government-backed phishing activity targeting Mexico, January 2020 – August 2024 The examples here highlight recent and historical examples where cyber espionage actors have targeted users and organizations in Mexico. It should be noted that these campaigns describe targeting and do not indicate successful compromise or exploitation. PRC Cyber Espionage Activity Targeting Mexico Since 2020, we have observed activity from seven cyber espionage groups with links to the PRC targeting users in Mexico, accounting for a third of government-backed phishing activity in the country. This volume of PRC cyber espionage is similar to activity in other regions where Chinese government investment has been focused, such as countries within China\'s Belt and Road Initiative. In addition to activity targeting Gmail users, PRC-backed groups have targeted Mexican government agencies, higher 		Ransomware Malware Tool Vulnerability Threat Mobile Cloud Commercial APT 28 ★★
RiskIQ.webp 2024-08-12 10:35:06 Faits saillants hebdomadaires, 12 août 2024
Weekly OSINT Highlights, 12 August 2024 (lien direct)		 ## Instantané La semaine dernière, les rapports de \\ ont mis en évidence plusieurs tendances clés des menaces de cybersécurité.Les attaques de phishing continuent d'être répandues, observées dans plusieurs campagnes utilisant des e-mails trompeurs et de faux sites Web pour voler des informations d'identification et livrer des logiciels malveillants tels que le trojan bancaire Mispadu.Les logiciels malveillants de volée de l'information restent une menace importante, ciblant des données allant des informations d'identification de la plate-forme Google Cloud aux données utilisateur mobiles à l'aide de logiciels spymétriques Android Lianspy.Des incidents de ransomware tels que DeathGrip et Mallox ont également persisté, reflétant les défis continus dans la défense contre la cybercriminalité axée sur l'extorsion.   Plusieurs articles comprenaient un lien russe, allant de la blizzard forestier de la Russie, conduisant l'espionnage contre les agences gouvernementales à une campagne impliquant des logiciels malveillants de Strrat, attribués à l'acteur de menace russe Bloody Wolf.Les groupes parrainés par l'État nord-coréen étaient également actifs, en se concentrant sur l'espionnage et en volant la propriété intellectuelle grâce à des attaques ciblées en chaîne d'approvisionnement et à des mises à jour logicielles trojanisées.L'abus de services légitimes à des fins malveillantes et le développement de logiciels malveillants avancés et polymorphes ont souligné l'évolution de la complexité et de la persistance des cyber-menaces. ## Description 1. [Les pirates d'État nord-coréens ciblent les secrets industriels sud-coréens] (https://sip.security.microsoft.com/intel-explorer/articles/9625c1a0): les groupes de Kimsuky et Andariel de la Corée du Nord ont exploité une vulnérabilité du logiciel VPN VPN \\et a lancé des installateurs trojanisés pour enfreindre les réseaux industriels sud-coréens.Leur objectif était de voler des secrets commerciaux dans les secteurs de la construction et des industriels dans le cadre d'un effort soutenu par l'État pour moderniser les industries nord-coréennes. 2. [URSA / Mispadu Banking Trojan cible des utilisateurs d'espagnol et portugais] (https://sip.security.microsoft.com/intel-explorer/articles/c3a30f3b): une campagne de spam est distribué le Trojan URSA / Mispadu pour voler des informations d'identification.des utilisateurs d'Espagne, du Portugal et du Mexique.La campagne utilise des e-mails urgents sur le thème des factures pour inciter les destinataires à télécharger des logiciels malveillants, entraînant des pertes financières importantes. 3. [La campagne polymorphe des logiciels malveillants cible les utilisateurs de Chrome et Edge] (https://sip.security.microsoft.com/intel-explorer/articles/c437b517): RaisonLabs a identifié une campagne répandue avec force d'installation avec force des extensions de navigation qui volent les données et les mises à jour.La campagne cible les utilisateurs de Chrome et Edge, avec plus de 300 000 infections depuis 2021, exploitant des sites Web de téléchargement pour diffuser les logiciels malveillants. 4. [APT group Actor240524 targeting Azerbaijani and Israeli diplomats:](https://sip.security.microsoft.com/intel-explorer/articles/240524) Researchers at NSFOCUS Security Labs uncovered a sophisticated spear-phishing campaign by the newly identifiedAPT Group Actor240524, en utilisant un programme de Troie nommé Abcloader pour cibler les diplomates azerbaïdjanais et israéliens.La campagne impliquait des techniques avancées comme le chiffrement de l'API et le détournement des composants com, visant à voler SEInformations diplomatiques nsitiques. 5. [DeathGrip Ransomware-As-A-Service étend Cybercrime Reach] (https://sip.security.microsoft.com/intel-exPLORER / Articles / 09d168fd): DeathGrip, une opération Ransomware-as-a-Service, permet aux acteurs de menace moins qualifiés de déployer des ransomwares avancés comme Lockbit 3.0.Le service alimente une a Ransomware Spam Malware Tool Vulnerability Threat Mobile Industrial Cloud APT 28 ★★
RiskIQ.webp 2024-08-05 21:26:54 Russian APT Fighting Ursa cible les diplomates avec des logiciels malveillants de tête à l'aide de fausses annonces de vente de voitures
Russian APT Fighting Ursa Targets Diplomats with HeadLace Malware Using Fake Car Sale Ads (lien direct)		 #### Industries ciblées - agences et services gouvernementaux - Diplomatie / relations internationales ## Instantané Les chercheurs de l'unité 42 ont identifié une campagne probablement attribuée à l'acteur de menace russe combattant Ursa (aka [Forest Blizzard] (https://sip.security.microsoft.com/intel-profiles/dd75f93b2a71c9510dceec817b9d34d868c2d1353d08c8c1647d868c2d1353d08c8c1647d868c2d1353d08c8c847De067270f. , Apt28, ours fantaisie) qui a utilisé unAPUTER LA VOLAGE DE VENTE comme un leurre pour distribuer les logiciels malveillants de la porte de la tête.La campagne a ciblé les diplomates et a commencé en mars 2024. ## Description Le leurre initial a été hébergé par le service légitime webhook.site et a conduit à la distribution de la page HTML malveillante.Le logiciel malveillant téléchargé, déguisé en publicité automobile, contenait la porte dérobée de la tête, qui a exécuté par étapes pour échapper à la détection.L'attaque s'appuyait fortement sur les services publics et gratuits pour héberger des leurres et diverses étapes de l'attaque.Le code HTML vérifie les ordinateurs Windows et redirige les visiteurs non-Windows vers une image de leurre sur IMGBB.Le code crée ensuite une archive zip à partir du texte Base64, l'offrant pour le téléchargement et la tentative de l'ouvrir avec la fonction javascript click ().L'archive zip téléchargée contient un fichier avec une double extension de .jpg.exe, qui est une copie du fichier de calculatrice de Windows légitime que Calc.exe a utilisé pour mettre à côté le fichier DLL inclus WindowsCodecs.dll, un composant de la porte arrière de la tête.  La lutte contre l'Ursa est connue pour exploiter continuellement des vulnérabilités connues même après que leur couverture a été soufflée.L'infrastructure du groupe \\ évolue constamment, et il devrait continuer à utiliser des services Web légitimes dans son infrastructure d'attaque. ## Analyse Microsoft Cette tactique de l'utilisation de leurres de phishing diplomatique de voitures diplomatiques a été précédemment observée avec d'autres groupes de menaces russes.En septembre 2023, Microsoft Threat Intelligence a observé probablement [Midnight Blizzard]. 831] (https://sip.security.Microsoft.com/intel-explorer/cves/cve-2023-38831/description) Vulnérabilité dans Rarlabs Winrar pour cibler les réseaux de plus de 40 organisations diplomatiques et intergouvernementales (IGO).Les acteurs de la menace ont envoyé des courriels de phishing de lance avec des archives zippées malveillantes, demandant aux destinataires d'ouvrir la pièce jointe pour voir les détails d'une voiture diplomatique à vendre.Lire la suite [ici] (https://sip.security.microsoft.com/intel-explorer/articles/af5bdd1c). ## Détections / requêtes de chasse ** Microsoft Defender Antivirus ** Microsoft Defender Antivirus détecte les composants de menace suivants comme malWare: - [Trojan: script / obfuse] (https://www.microsoft.com/en-us/wdsi/thereats/malware-encycopedia-dercription?name=trojan:js/obfuse) - [Trojan: html / phish] (https://www.microsoft.com/en-us/wdsi/therets/malware-encyclopedia-description?name=trojan:html/phish) ## Recommandations Investissez dans des solutions avancées et anti-phishing qui surveillent les e-mails entrants et les sites Web visités.[Microsoft Defender pour OFFFICE 365] (https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-security-center-mdo?ocid=Magicti_Ta_learnDoc) rassemble une gestion des incidents et des alertes à travers les e-mails, les dispositifset identités, centraliser les enquêtes pour les menaces par courrier électronique.Les organisations peuvent également tirer parti des navigateurs Web qui [Indentify and Block] (https://learn.microsoft.com/deployedge/microsoft-edge-security-smartscreen?ocid=Magicti_TA_LearnDoc) sont des sites Web malveillants, y compris ceux utilisés dans cette campagne de phishing. • Exécutez la détection et la Malware Tool Vulnerability Threat APT 28 ★★★★
RiskIQ.webp 2024-07-29 10:58:35 Weekly OSINT Highlights, 29 July 2024 (lien direct) ## Snapshot Key trends from last week\'s OSINT reporting include novel malware, such as Flame Stealer and FrostyGoop, the compromise of legitimate platforms like Discord and GitHub, and state-sponsored threat actors conducting espionage and destructive attacks. Notable threat actors, including Russian groups, Transparent Tribe, FIN7, and DPRK\'s Andariel, are targeting a wide range of sectors from defense and industrial control systems to financial institutions and research entities. These attacks exploit various vulnerabilities and employ advanced evasion techniques, leveraging both traditional methods and emerging technologies like AI-generated scripts and RDGAs, underscoring the evolving and persistent nature of the cyber threat landscape. ## Description 1. [Widespread Adoption of Flame Stealer](https://sip.security.microsoft.com/intel-explorer/articles/f610f18e): Cyfirma reports Flame Stealer\'s use in stealing Discord tokens and browser credentials. Distributed via Discord and Telegram, this malware targets various platforms, utilizing evasion techniques like DLL side-loading and data exfiltration through Discord webhooks. 2. [ExelaStealer Delivered via PowerShell](https://sip.security.microsoft.com/intel-explorer/articles/5b4a34b0): The SANS Technology Institute Internet Storm Center reported a threat involving ExelaStealer, downloaded from a Russian IP address using a PowerShell script. The script downloads two PE files: a self-extracting RAR archive communicating with "solararbx\[.\]online" and "service.exe," the ExelaStealer malware. The ExelaStealer, developed in Python, uses Discord for C2, conducting reconnaissance activities and gathering system and user details. Comments in Russian in the script and the origin of the IP address suggest a Russian origin. 3. [FrostyGoop Disrupts Heating in Ukraine](https://sip.security.microsoft.com/intel-explorer/articles/cf8f8199): Dragos identified FrostyGoop malware in a cyberattack disrupting heating in Lviv, Ukraine. Linked to Russian groups, the ICS-specific malware exploits vulnerabilities in industrial control systems and communicates using the Modbus TCP protocol. 4. [Rhysida Ransomware Attack on Private School](https://sip.security.microsoft.com/intel-explorer/articles/4cf89ad3): ThreatDown by Malwarebytes identified a Rhysida ransomware attack using a new variant of the Oyster backdoor. The attackers used SEO-poisoned search results to distribute malicious installers masquerading as legitimate software, deploying the Oyster backdoor. 5. [LLMs Used to Generate Malicious Code](https://sip.security.microsoft.com/intel-explorer/articles/96b66de0): Symantec highlights cyberattacks using Large Language Models (LLMs) to generate malware code. Phishing campaigns utilize LLM-generated PowerShell scripts to download payloads like Rhadamanthys and LokiBot, stressing the need for advanced detection against AI-facilitated attacks. 6. [Stargazers Ghost Network Distributes Malware](https://sip.security.microsoft.com/intel-explorer/articles/62a3aa28): Check Point Research uncovers a network of GitHub accounts distributing malware via phishing repositories. The Stargazer Goblin group\'s DaaS operation leverages over 3,000 accounts to spread malware such as Atlantida Stealer and RedLine, targeting both general users and other threat actors. 7. [Crimson RAT Targets Indian Election Results](https://sip.security.microsoft.com/intel-explorer/articles/dfae4887): K7 Labs identified Crimson RAT malware delivered through documents disguised as "Indian Election Results." Transparent Tribe APT, believed to be from Pakistan, targets Indian diplomatic and defense entities using macro-embedded documents to steal credentials. 8. [AsyncRAT Distributed via Weaponized eBooks](https://sip.security.microsoft.com/intel-explorer/articles/e84ee11d): ASEC discovered AsyncRAT malware distributed through weaponized eBooks. Hidden PowerShell scripts within these eBooks trigger the AsyncRAT payload, which uses obfuscation and anti-detection techniques to exfiltrate data. Ransomware Data Breach Spam Malware Tool Vulnerability Threat Legislation Mobile Industrial Medical APT 28 APT 36 ★★
RiskIQ.webp 2024-07-23 20:53:33 (Déjà vu) UAC-0063 Attaque des institutions de recherche en Ukraine: Hatvibe + Cherryspy + CVE-2024-23692
UAC-0063 attacks research institutions in Ukraine: HATVIBE + CHERRYSPY + CVE-2024-23692 (lien direct)		 #### Targeted Geolocations - Ukraine ## Snapshot The Computer Emergency Response Team of Ukraine (CERT-UA) released reporting on an attack by UAC-0063 against a research institution in Ukraine perpetrated in July 2024. ## Description The attackers accessed an employee\'s email account and sent a compromised email with a macro-embedded document to multiple recipients. When opened, this document created and executed another document and scheduled a task to run the HATVIBE malware. The attackers then used remote control to download a Python interpreter and the CHERRYSPY malware to the victim\'s computer. UAC-0063, linked to the Russian APT28 group, was also detected using a similar attack vector in Armenia. In June 2024, the group exploited a vulnerability in the HFS HTTP File Server ([CVE-2024-23692](https://security.microsoft.com/intel-explorer/cves/CVE-2024-23692/)) to install the HATVIBE backdoor, demonstrating their use of varied initial compromise methods. The attack succeeded due to the institution\'s lack of two-factor authentication, admin privileges for user accounts, and insufficient security policies to block macros and specific executables.  ## Additional Analysis Both CHERRYSPY and HATVIBE have previously been used by UAC-0063 to target Ukranian organizations. [In April 2023](https://cert.gov.ua/article/4697016?fbclid=IwAR1B5gj0v-Ve9Q5299ydM5lrInLuKVmvPRosQkUucq6YzcjuTgVnM_x3LjQ), the threat group sent spear-phishing emails to government organizations in Ukraine, likely from the previously compromised email of the Embassy of Tajikistan. ## Recommendations Microsoft recommends the implementation multifactor authentication (MFA) to reduce the impact of this threat and mitigate credential theft from phishing attacks. MFA can be complemented with the following solutions and best practices to protect organizations:  - Activate [conditional access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview?ocid=magicti_ta_learndoc) policies. Conditional access policies are evaluated and enforced every time an attacker attempts to use a stolen session cookie. Organizations can protect themselves from attacks that leverage stolen credentials by activating policies regarding compliant devices or trusted IP address requirements. - Configure [continuous access evaluation](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation?ocid=magicti_ta_learndoc) in your tenant. - Invest in advanced anti-phishing solutions that monitor incoming emails and visited websites. [Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-security-center-mdo?ocid=magicti_ta_learndoc) brings together incident and alert management across email, devices, and identities, centralizing investigations for threats in email. Organizations can also leverage web browsers that automatically identify and block malicious websites, including those used in this phishing campaign. To build resilience against phishing attacks in general, organizations can use [anti-phishing policies](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about?view=o365-worldwide) to enable mailbox intelligence settings, as well as configure impersonation protection settings for specific messages and sender domains. Enabling [SafeLinks](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about?view=o365-worldwide) ensures real-time protection by scanning at time of delivery and at time of click. - Monitor for suspicious or anomalous activities, and search for sign-in attempts with suspicious characteristics (for example location, internet service provider \[ISP\], user agent, and use of anonymizer services). Activity can be identified and investigated with [Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-security-center-mdi?ocid=magicti_ta_learndoc), which contributes identity-focus Malware Vulnerability Threat APT 28 ★★★
Mandiant.webp 2024-07-08 14:00:00 Enhardi et évolutif: un instantané des cyber-menaces auxquelles l'OTAN est confrontée à l'OTAN
Emboldened and Evolving: A Snapshot of Cyber Threats Facing NATO (lien direct)		 Written by: John Hultquist
  As North Atlantic Treaty Organization (NATO) members and partners gather for a historic summit, it is important to take stock of one of its most pressing challenges-the cyber threat. The Alliance faces a barrage of malicious cyber activity from all over the globe, carried out by emboldened state-sponsored actors, hacktivists, and criminals who are willing to cross lines and carry out activity that was previously considered unlikely or inconceivable. In addition to military targets, NATO must consider the risks that hybrid threats like malicious cyber activity pose to hospitals, civil society, and other targets, which could impact resilience in a contingency. The war in Ukraine is undoubtedly linked to escalating cyber threat activity, but many of these threats will continue to grow separately and in parallel.  NATO must contend with covert, aggressive malicious cyber actors that are seeking to gather intelligence, preparing to or currently attacking critical infrastructure, and working to undermine the Alliance with elaborate disinformation schemes. In order to protect its customers and clients, Google is closely tracking cyber threats, including those highlighted in this report; however, this is just a glimpse at a much larger and evolving landscape. Cyber Espionage NATO\'s adversaries have long sought to leverage cyber espionage to develop insight into the political, diplomatic, and military disposition of the Alliance and to steal its defense technologies and economic secrets. However, intelligence on the Alliance in the coming months will be of heightened importance. This year\'s summit is a transition period, with the appointment of Mark Rutte as the new Secretary General and a number of adaptations expected to be rolled out to shore up the Alliance\'s defense posture and its long-term support for Ukraine. Successful cyber espionage from threat actors could potentially undermine the Alliance\'s strategic advantage and inform adversary leadership on how to anticipate and counteract NATO\'s initiatives and investments. NATO is targeted by cyber espionage activity from actors around the world with varying capabilities. Many still rely on technically simple but operationally effective methods, like social engineering. Others have evolved and elevated their tradecraft to levels that distinguish themselves as formidable adversaries for even the most experienced defenders. APT29 (ICECAP) Publicly attributed to the Russian Foreign Intelligence Services (SVR) by several governments, APT29 is heavily focused on diplomatic and political intelligence collection, principally targeting Europe and NATO member states. APT29 has been involved in multiple high-profile breaches of technology firms that were designed to provide access to the public sector. In the past year, Mandiant has observed APT29 targeting technology companies and IT service providers in NATO member countries to facilitate third-party and software supply chain compromises of government and poli		 Ransomware Malware Tool Vulnerability Threat Legislation Medical Cloud Technical APT 29 APT 28 ★★★
Mandiant.webp 2024-06-12 14:00:00 Aperçu sur les cyber-menaces ciblant les utilisateurs et les entreprises au Brésil
Insights on Cyber Threats Targeting Users and Enterprises in Brazil (lien direct)		 Written by: Kristen Dennesen, Luke McNamara, Dmitrij Lenz, Adam Weidemann, Aline Bueno
  Individuals and organizations in Brazil face a unique cyber threat landscape because it is a complex interplay of global and local threats, posing significant risks to individuals, organizations, and critical sectors of Brazilian society. Many of the cyber espionage threat actors that are prolific in campaigns across the globe are also active in carrying out attempted intrusions into critical sectors of Brazilian society. Brazil also faces threats posed by the worldwide increase in multifaceted extortion, as ransomware and data theft continue to rise. At the same time, the threat landscape in Brazil is shaped by a domestic cybercriminal market, where threat actors coordinate to carry out account takeovers, conduct carding and fraud, deploy banking malware and facilitate other cyber threats targeting Brazilians. The rise of the Global South, with Brazil at the forefront, marks a significant shift in the geopolitical landscape; one that extends into the cyber realm. As Brazil\'s influence grows, so does its digital footprint, making it an increasingly attractive target for cyber threats originating from both global and domestic actors. This blog post brings together Google\'s collective understanding of the Brazilian threat landscape, combining insights from Google\'s Threat Analysis Group (TAG) and Mandiant\'s frontline intelligence. As Brazil\'s economic and geopolitical role in global affairs continues to rise, threat actors from an array of motivations will further seek opportunities to exploit the digital infrastructure that Brazilians rely upon across all aspects of society. By sharing our global perspective, we hope to enable greater resiliency in mitigating these threats. Google uses the results of our research to improve the safety and security of our products, making them secure by default. Chrome OS has built-in and proactive security to protect from ransomware, and there have been no reported ransomware attacks ever on any business, education, or consumer Chrome OS device. Google security teams continuously monitor for new threat activity, and all identified websites and domains are added to Safe Browsing to protect users from further exploitation. We deploy and constantly update Android detections to protect users\' devices and prevent malicious actors from publishing malware to the Google Play Store. We send targeted Gmail and Workspace users government-backed attacker alerts, notifying them of the activity and encouraging potential targets to enable Enhanced Safe Browsing for Chrome and ensure that all devices are updated.   Cyber Espionage Operations Targeting Brazil Brazil\'s status as a globally influential power and the largest economy in South America have drawn attention from c		 Ransomware Spam Malware Tool Vulnerability Threat Mobile Medical Cloud Technical APT 28 ★★
Checkpoint.webp 2024-05-06 11:21:36 6 mai & # 8211;Rapport de renseignement sur les menaces
6th May – Threat Intelligence Report (lien direct)		 > Pour les dernières découvertes en cyberLes meilleures attaques et violations dans une déclaration conjointe avec l'Allemagne et l'OTAN, la République tchèque a découvert une campagne de cyber-espionnage par l'acteur affilié à l'État russe APT28.Ces cyberattaques ont ciblé les institutions tchèques utilisant une nouvelle vulnérabilité dans Microsoft [& # 8230;]
>For the latest discoveries in cyber research for the week of 29th April, please download our Threat_Intelligence Bulletin. TOP ATTACKS AND BREACHES In a joint statement with Germany and NATO, the Czech Republic uncovered a cyber espionage campaign by Russian state affiliated actor APT28. These cyber-attacks targeted Czech institutions using a new vulnerability in Microsoft […] 		Vulnerability Threat APT 28 ★★★
TechWorm.webp 2024-05-04 21:52:07 Les cyberattaques de la Russie contre l'Allemagne condamnées par l'UE et l'OTAN
Russia’s cyberattacks against Germany condemned by EU and NATO (lien direct)		 hackers russes ne ralentissent pas dans les cyberattaques. L'attaque présumée s'est produite contre le Parti social-démocrate (SPD).Leurs comptes de messagerie ont été compromis dans l'attaque. Cette saga de piratage a commencé il y a plus de deux ans pendant la guerre russe-Ukraine et elle a progressivement augmenté au cours du temps. comment il a commencé Un groupe appelé APT28, également connu sous le nom de Fancy Bear, qui aurait des liens avec le gouvernement russe, a été accusé d'avoir fait de nombreuses cyberattaques partout dans le monde, y compris en Allemagne et quelques entités tchèques. Russian Cyberattack sur l'Allemagne Ils ont trouvé un Vulnérabilité Dans Microsoft Outlook et l'utiliser pour entrer dans les e-mails SPD. La vulnérabilité, un CVE-2023-23397 zéro-jour, est un bogue d'escalade de privilège essentiel dans Outlook qui pourrait permettre aux attaquants d'accéder aux hachages net-ntlmv2, puis de les utiliser pour s'authentifier à l'aide d'une attaque de relais. Le gouvernement allemand dit que non seulement le SPD mais aussi les entreprises allemandes en défense et en aérospatiale. Il comprenait également des objectifs de technologie de l'information, ainsi que des choses liées à la guerre en Ukraine. Ces cyberattaques ont commencé vers mars 2022, après que la Russie ait envahi l'Ukraine. Le gouvernement allemand a allégué que le service de renseignement militaire de la Russie, Gru, était derrière ces attaques. Ils ont même convoqué un diplomate russe en réponse à ces accusations. La Russie a nié les allégations La Russie a nié les allégations et appelé les accusations comme & # 8220; non fondée et sans fondement & # 8221;. Le gouvernement dirigé par Poutine a nié des cyber-incidences similaires aux actes parrainés par l'État dans le passé. L'Occident a été rigide dans son récit de l'implication de la Russie dans les cyberattaques depuis des décennies maintenant. pas le premier rodéo Récemment, le ministre australien des Affaires étrangères a rejoint d'autres pays en disant que l'APT28, qui serait lié à la Russie, était derrière certaines cyberattaques. Ce n'est pas la première fois que les pirates russes sont accusés d'espionnage de l'Allemagne. En 2020, Angela Merkel, qui était la chancelière de l'Allemagne à l'époque, a accusé la Russie de l'espionner. Un incident majeur imputé aux pirates russes a été en 2015 lorsqu'ils ont attaqué le Parlement de l'Allemagne, ce qui l'a fait fermer pendant des jours. Hack Vulnerability Threat APT 28 ★★★
Mandiant.webp 2024-04-25 10:00:00 Pole Voûte: cyber-menaces aux élections mondiales
Poll Vaulting: Cyber Threats to Global Elections (lien direct)		 Written by: Kelli Vanderlee, Jamie Collier
  Executive Summary The election cybersecurity landscape globally is characterized by a diversity of targets, tactics, and threats. Elections attract threat activity from a variety of threat actors including: state-sponsored actors, cyber criminals, hacktivists, insiders, and information operations as-a-service entities. Mandiant assesses with high confidence that state-sponsored actors pose the most serious cybersecurity risk to elections. Operations targeting election-related infrastructure can combine cyber intrusion activity, disruptive and destructive capabilities, and information operations, which include elements of public-facing advertisement and amplification of threat activity claims. Successful targeting does not automatically translate to high impact. Many threat actors have struggled to influence or achieve significant effects, despite their best efforts.  When we look across the globe we find that the attack surface of an election involves a wide variety of entities beyond voting machines and voter registries. In fact, our observations of past cycles indicate that cyber operations target the major players involved in campaigning, political parties, news and social media more frequently than actual election infrastructure.   Securing elections requires a comprehensive understanding of many types of threats and tactics, from distributed denial of service (DDoS) to data theft to deepfakes, that are likely to impact elections in 2024. It is vital to understand the variety of relevant threat vectors and how they relate, and to ensure mitigation strategies are in place to address the full scope of potential activity.  Election organizations should consider steps to harden infrastructure against common attacks, and utilize account security tools such as Google\'s Advanced Protection Program to protect high-risk accounts. Introduction  The 2024 global election cybersecurity landscape is characterized by a diversity of targets, tactics, and threats. An expansive ecosystem of systems, administrators, campaign infrastructure, and public communications venues must be secured against a diverse array of operators and methods. Any election cybersecurity strategy should begin with a survey of the threat landscape to build a more proactive and tailored security posture.  The cybersecurity community must keep pace as more than two billion voters are expected to head to the polls in 2024. With elections in more than an estimated 50 countries, there is an opportunity to dynamically track how threats to democracy evolve. Understanding how threats are targeting one country will enable us to better anticipate and prepare for upcoming elections globally. At the same time, we must also appreciate the unique context of different countries. Election threats to South Africa, India, and the United States will inevitably differ in some regard. In either case, there is an opportunity for us to prepare with the advantage of intelligence.  		Ransomware Malware Hack Tool Vulnerability Threat Legislation Cloud Technical APT 40 APT 29 APT 28 APT 43 APT 31 APT 42 ★★★
Blog.webp 2024-04-24 11:54:21 Russian APT28 Exploitation de Windows Vulnérabilité avec outil d'Oeeegg
Russian APT28 Exploiting Windows Vulnerability with GooseEgg Tool (lien direct)		 > Par waqas Mettez à jour les fenêtres maintenant ou soyez piraté: Microsoft met en garde contre la vulnérabilité activement exploitée! Ceci est un article de HackRead.com Lire le post original: Russian APT28 Exploitation de Windows Vulnérabilité avec l'outil Gooseegg
>By Waqas Update Windows Now or Get Hacked: Microsoft Warns of Actively Exploited Vulnerability! This is a post from HackRead.com Read the original post: Russian APT28 Exploiting Windows Vulnerability with GooseEgg Tool		 Tool Vulnerability APT 28 ★★★
TechWorm.webp 2024-04-23 22:47:49 Les pirates de la Russie ont exploité Windows Flaw pour déployer & # 8216; GooseEgg & # 8217;Malware
Russia’s APT28 Hackers Exploited Windows Flaw To Deploy ‘GooseEgg’ Malware (lien direct)		 Microsoft a récemment révélé que le groupe de menaces russes & # 8220; APT28 & # 8243;utilisé un outil de piratage précédemment inconnu, «GooseEgg & # 8221;Pour exploiter la vulnérabilité Windows Print Spooler pour obtenir un accès élevé aux systèmes cibles et voler des informations d'identification et des informations. Selon l'équipe de renseignement des menaces de Redmond, APT28, également appelée Fancy Bear and Forest Blizzard (anciennement Strontium), utilise l'outil post-compromis depuis au moins juin 2020 et peut-être dès avril 2019Pour exploiter le CVE-2022-38028 (score CVSS: 7.8) Vulnérabilité dans Windows Print Spooler Service. Cet outil modifie un fichier de contraintes JavaScript et l'exécute avec des autorisations au niveau du système. Bien que la société ait abordé la vulnérabilité, CVE-2022-38028, rapportée par la U.S.Mate Security Agency (NSA) dans le cadre de Microsoft & # 8217; s octobre 2022 Patch Mardi Security Mises à jour, elle n'a fait aucune mention du défaut dans son avis . Microsoft a observé APT28 en utilisant GooseEgg dans le cadre des activités post-compromis contre diverses cibles, y compris les organisations gouvernementales, non gouvernementales, de l'éducation et des transports en Ukraine, en Europe occidentale et en Amérique du Nord. Bien que Gooseegg soit une application de lanceur simple, il peut engendrer d'autres applications sur la ligne de commande avec des autorisations élevées. Cela permet aux acteurs de menace de prendre en charge les activités malveillantes telles que l'exécution du code distant, l'installation d'une porte dérobée et le déplacement latéralement à travers des réseaux compromis. Les gouvernements américains et britanniques ont lié Forest Blizzard à l'unité 26165 de la Fédération de Russie \'s Military Intelligence Agency, la principale Direction du renseignement de l'état-major général des Forces armées de la Fédération de Russie (GRU). «Microsoft a observé qu'après avoir obtenu l'accès à un appareil cible, Forest Blizzard utilise GooseEgg pour élever les privilèges dans l'environnement.GooseEgg est généralement déployé avec un script de lot, que nous avons observé en utilisant le nom execute.bat et doit.bat .Ce script de lot écrit le fichier servtask.bat, qui contient des commandes pour enregistrer / compresser les ruches de registre.Le script de lot invoque l'exécutable de GooseEgg apparié et configure la persistance en tant que tâche planifiée conçue pour exécuter servtask.bat », lit le Advisory publié par Microsoft lundi. Les chercheurs de Microsoft ont noté qu'un fichier DLL malveillant intégré généralement, qui comprend l'expression « wayzgoose»; par exemple, wayzgoose23.dll , est une application de lanceur utilisée par la menaceLes acteurs doivent lancer d'autres charges utiles avec des autorisations au niveau du système et installer une porte dérobée, se déplacer latéralement dans le réseau de la victime et exécuter à distance le code sur les systèmes violés. Comme mentionné précédemment, la société a corrigé le défaut de sécurité des spouleurs imprimés en 2022. Il a également corrigé les vulnérabilités imprimées précédemment exploitées en 2021. «Les clients qui n'ont pas encore mis en œuvre ces correctifs sont invités à le faire dès que possible pour la sécurité de leur organisation», a déclaré Microsoft dans son avis. De plus, la société recommande également de dé Malware Tool Vulnerability Threat APT 28 ★★★
News.webp 2024-04-23 01:15:11 Old Windows Print Spooler Bug est la dernière cible du gang d'ours sophistiqué de la Russie
Old Windows print spooler bug is latest target of Russia\\'s Fancy Bear gang (lien direct)		 Les copains de Poutine \\ utilisent \\ 'gooseegg \' malware pour lancer des attaques que vous pouvez vaincre avec des correctifs ou une suppression Les espions russes exploitent une vulnérabilité de spooler d'impression Windows vieille et utilisent unUn outil personnalisé appelé GooseEgg pour élever les privilèges et voler des informations d'identification sur des réseaux compromis, selon Microsoft Threat Intelligence.…
Putin\'s pals use \'GooseEgg\' malware to launch attacks you can defeat with patches or deletion Russian spies are exploiting a years-old Windows print spooler vulnerability and using a custom tool called GooseEgg to elevate privileges and steal credentials across compromised networks, according to Microsoft Threat Intelligence.…		 Malware Tool Vulnerability Threat APT 28 ★★★
RiskIQ.webp 2024-03-05 19:03:47 Rester en avance sur les acteurs de la menace à l'ère de l'IA
Staying ahead of threat actors in the age of AI (lien direct)		 ## Snapshot Over the last year, the speed, scale, and sophistication of attacks has increased alongside the rapid development and adoption of AI. Defenders are only beginning to recognize and apply the power of generative AI to shift the cybersecurity balance in their favor and keep ahead of adversaries. At the same time, it is also important for us to understand how AI can be potentially misused in the hands of threat actors. In collaboration with OpenAI, today we are publishing research on emerging threats in the age of AI, focusing on identified activity associated with known threat actors, including prompt-injections, attempted misuse of large language models (LLM), and fraud. Our analysis of the current use of LLM technology by threat actors revealed behaviors consistent with attackers using AI as another productivity tool on the offensive landscape. You can read OpenAI\'s blog on the research [here](https://openai.com/blog/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors). Microsoft and OpenAI have not yet observed particularly novel or unique AI-enabled attack or abuse techniques resulting from threat actors\' usage of AI. However, Microsoft and our partners continue to study this landscape closely. The objective of Microsoft\'s partnership with OpenAI, including the release of this research, is to ensure the safe and responsible use of AI technologies like ChatGPT, upholding the highest standards of ethical application to protect the community from potential misuse. As part of this commitment, we have taken measures to disrupt assets and accounts associated with threat actors, improve the protection of OpenAI LLM technology and users from attack or abuse, and shape the guardrails and safety mechanisms around our models. In addition, we are also deeply committed to using generative AI to disrupt threat actors and leverage the power of new tools, including [Microsoft Copilot for Security](https://www.microsoft.com/security/business/ai-machine-learning/microsoft-security-copilot), to elevate defenders everywhere. ## Activity Overview ### **A principled approach to detecting and blocking threat actors** The progress of technology creates a demand for strong cybersecurity and safety measures. For example, the White House\'s Executive Order on AI requires rigorous safety testing and government supervision for AI systems that have major impacts on national and economic security or public health and safety. Our actions enhancing the safeguards of our AI models and partnering with our ecosystem on the safe creation, implementation, and use of these models align with the Executive Order\'s request for comprehensive AI safety and security standards. In line with Microsoft\'s leadership across AI and cybersecurity, today we are announcing principles shaping Microsoft\'s policy and actions mitigating the risks associated with the use of our AI tools and APIs by nation-state advanced persistent threats (APTs), advanced persistent manipulators (APMs), and cybercriminal syndicates we track. These principles include: - **Identification and action against malicious threat actors\' use:** Upon detection of the use of any Microsoft AI application programming interfaces (APIs), services, or systems by an identified malicious threat actor, including nation-state APT or APM, or the cybercrime syndicates we track, Microsoft will take appropriate action to disrupt their activities, such as disabling the accounts used, terminating services, or limiting access to resources. - **Notification to other AI service providers:** When we detect a threat actor\'s use of another service provider\'s AI, AI APIs, services, and/or systems, Microsoft will promptly notify the service provider and share relevant data. This enables the service provider to independently verify our findings and take action in accordance with their own policies. - **Collaboration with other stakeholders:** Microsoft will collaborate with other stakeholders to regularly exchange information a Ransomware Malware Tool Vulnerability Threat Studies Medical Technical APT 28 ChatGPT APT 4 ★★
RecordedFuture.webp 2023-12-08 15:16:00 Plus de preuves du renseignement russe exploitant de vieilles perspectives de faille
More evidence of Russian intelligence exploiting old Outlook flaw (lien direct)		 Les chercheurs en cybersécurité ont découvert une autre campagne dans laquelle les pirates associés aux renseignements militaires de la Russie exploitent une vulnérabilité dans les logiciels Microsoft pour cibler des entités critiques, y compris celles des pays membres de l'OTAN.Selon un Rapport par Palo Alto Networks \\ 'Unit 42, l'acteur de menace russe connue sous le nom de Fancy Bear ou APT28 a violé Microsoft Outlook sur
Cybersecurity researchers have discovered another campaign in which hackers associated with Russia\'s military intelligence are exploiting a vulnerability in Microsoft software to target critical entities, including those in NATO member countries. According to a report by Palo Alto Networks\' Unit 42, the Russian threat actor known as Fancy Bear or APT28 breached Microsoft Outlook over		 Vulnerability Threat APT 28 ★★
The_Hackers_News.webp 2023-12-05 12:29:00 Microsoft met en garde contre APT28 soutenu par le Kremlin exploitabilité de la vulnérabilité des perspectives critiques
Microsoft Warns of Kremlin-Backed APT28 Exploiting Critical Outlook Vulnerability (lien direct)		 Microsoft a déclaré lundi avoir détecté des activités d'État-nation soutenues par Kremlin exploitant un défaut de sécurité critique dans son service de messagerie Outlook pour obtenir un accès non autorisé aux comptes des victimes dans les serveurs d'échange. Le géant de la technologie & nbsp; attribué & nbsp; les intrusions à un acteur de menace qu'il a appelé & nbsp; Forest Blizzard & nbsp; (anciennement Strontium), qui est également largement suivi sous les surnoms APT28,
Microsoft on Monday said it detected Kremlin-backed nation-state activity exploiting a critical security flaw in its Outlook email service to gain unauthorized access to victims\' accounts within Exchange servers. The tech giant attributed the intrusions to a threat actor it called Forest Blizzard (formerly Strontium), which is also widely tracked under the monikers APT28,		 Vulnerability Threat APT 28 ★★★★
ProofPoint.webp 2023-12-05 05:00:40 TA422 \\ Soule d'exploitation dédiée - la même semaine après semaine
TA422\\'s Dedicated Exploitation Loop-the Same Week After Week (lien direct)		 Key takeaways  Since March 2023, Proofpoint researchers have observed regular TA422 (APT28) phishing activity, in which the threat actor leveraged patched vulnerabilities to send, at times, high-volume campaigns to targets in Europe and North America.  TA422 used the vulnerabilities as initial access against government, aerospace, education, finance, manufacturing, and technology sector targets likely to either disclose user credentials or initiate follow-on activity.  The vulnerabilities included CVE-2023-23397-a Microsoft Outlook elevation of privilege flaw that allows a threat actor to exploit TNEF files and initiate NTLM negotiation, obtaining a hash of a target\'s NTLM password-and CVE-2023-38831-a WinRAR remote code execution flaw that allows execution of “arbitrary code when a user attempts to view a benign file within a ZIP archive,” according to the NIST disclosure.  Overview  Starting in March 2023, Proofpoint researchers have observed the Russian advanced persistent threat (APT) TA422 readily use patched vulnerabilities to target a variety of organizations in Europe and North America. TA422 overlaps with the aliases APT28, Forest Blizzard, Pawn Storm, Fancy Bear, and BlueDelta, and is attributed by the United States Intelligence Community to the Russian General Staff Main Intelligence Directorate (GRU). While TA422 conducted traditional targeted activity during this period, leveraging Mockbin and InfinityFree for URL redirection, Proofpoint observed a significant deviation from expected volumes of emails sent in campaigns exploiting CVE-2023-23397-a Microsoft Outlook elevation of privilege vulnerability. This included over 10,000 emails sent from the adversary, from a single email provider, to defense, aerospace, technology, government, and manufacturing entities, and, occasionally, included smaller volumes at higher education, construction, and consulting entities. Proofpoint researchers also identified TA422 campaigns leveraging a WinRAR remote execution vulnerability, CVE-2023-38831.  Bar chart showing the breakdown of TA422 phishing activity from March 2023 to November 2023.  Please attend: CVE-2023-23397-test meeting In late March 2023, TA422 started to launch high volume campaigns exploiting CVE-2023-23397 targeting higher education, government, manufacturing, and aerospace technology entities in Europe and North America. TA422 previously used an exploit for CVE-2023-23397 to target Ukrainian entities as early as April 2022, according to open-source reporting by CERT-EU.  In the Proofpoint-identified campaigns, our researchers initially observed small numbers of emails attempting to exploit this vulnerability. The first surge in activity caught our attention partly due to all the emails pointing to the same listener server, but mostly due to the volume. This campaign was very large compared to typical state-aligned espionage campaign activity Proofpoint tracks. Proofpoint observed over 10,000 repeated attempts to exploit the Microsoft Outlook vulnerability, targeting the same accounts daily during the late summer of 2023. It is unclear if this was operator error or an informed effort to collect target credentials. TA422 re-targeted many of the higher education and manufacturing users previously targeted in March 2023. It is unclear why TA422 re-targeted these entities with the same exploit. Based upon the available campaign data, Proofpoint suspects that these entities are priority targets and as a result, the threat actor attempted broad, lower effort campaigns regularly to try and gain access.    Like the high-volume TA422 campaign Proofpoint researchers identified in March 2023, the late summer 2023 messages contained an appointment attachment, using the Transport Neutral Encapsulation Format (TNEF) file. The TNEF file used a fake file extension to masquerade as a CSV, Excel file, or Word document, and contained an UNC path directing traffic to an SMB listener being hosted on a likely compromised Ubiquiti router. TA422 has previously used compromised routers to host the gr Malware Vulnerability Threat APT 28 ★★★
Blog.webp 2023-12-04 18:58:53 Vulnérabilité Microsoft Outlook exploitée par le groupe de blizzard de forêt russe
Microsoft Outlook Vulnerability Exploited by Russian Forest Blizzard Group (lien direct)		 > Par waqas Forest Blizzard (AKA Strontium, APT28 et Fancy Bear) aurait des affiliations avec ou le soutien de la Russian Military Intelligence Agency. Ceci est un article de HackRead.com Lire le post original: Vulnérabilité des perspectives de Microsoft exploitées par le groupe de blizzard de forêt russe
>By Waqas Forest Blizzard (aka STRONTIUM, APT28, and Fancy Bear) is thought to have affiliations with or support from the Russian military intelligence agency. This is a post from HackRead.com Read the original post: Microsoft Outlook Vulnerability Exploited by Russian Forest Blizzard Group		 Vulnerability APT 28 ★★★
RecordedFuture.webp 2023-12-04 15:16:00 Des pirates soutenus au Kremlin attaquant les systèmes d'Outlook non corrigées, dit Microsoft
Kremlin-backed hackers attacking unpatched Outlook systems, Microsoft says (lien direct)		 Les pirates associés aux renseignements militaires de la Russie exploitent toujours activement une vulnérabilité dans les logiciels Microsoft pour accéder aux e-mails des victimes, a annoncé lundi la société.L'acteur de menace, suivi par Microsoft sous le nom de Forest Blizzard mais également connu sous le nom de Fancy Bear ou APT28, a tenté d'utiliser le bogue pour obtenir un accès non autorisé à l'e-mail
Hackers associated with Russia\'s military intelligence are still actively exploiting a vulnerability in Microsoft software to gain access to victims\' emails, the company said Monday. The threat actor, tracked by Microsoft as Forest Blizzard but also known as Fancy Bear or APT28, has been attempting to use the bug to gain unauthorized access to email		 Vulnerability Threat APT 28 ★★
bleepingcomputer.webp 2023-11-19 11:14:25 Les pirates russes utilisent la fonctionnalité Ngrok et l'exploit Winrar pour attaquer les ambassades
Russian hackers use Ngrok feature and WinRAR exploit to attack embassies (lien direct)		 Après Sandworm et APT28 (connu sous le nom de Fancy Bear), un autre groupe de pirates russes parrainé par l'État, APT29, tire parti de la vulnérabilité CVE-2023-38831 dans Winrar pour les cyberattaques.[...]
After Sandworm and APT28 (known as Fancy Bear), another state-sponsored Russian hacker group, APT29, is leveraging the CVE-2023-38831 vulnerability in WinRAR for cyberattacks. [...]		 Vulnerability Threat APT 29 APT 28 ★★★
TechRepublic.webp 2023-04-28 16:36:57 L'acteur de menace APT28 cible les routeurs Cisco avec une vieille vulnérabilité
Threat actor APT28 targets Cisco routers with an old vulnerability (lien direct)		 > Les États-Unis, l'Europe et l'Ukraine seraient des cibles dans cette menace malveillante.Apprenez à protéger les routeurs Cisco affectés.
>The U.S., Europe and Ukraine are reportedly targets in this malware threat. Learn how to protect affected Cisco routers. 		Malware Vulnerability Threat APT 28 APT 28 ★★
SocRadar.webp 2023-04-20 11:23:59 APT28 exploite la vulnérabilité Cisco au déploiement de logiciels malveillants dans la campagne d'espionnage
APT28 Exploits Cisco Vulnerability to Deploy Malware in Espionage Campaign (lien direct)		 > Les acteurs de l'État-nation russe utilisent une vulnérabilité de code à distance correcée dans les appareils de réseau Cisco pour mener ...
>Russian nation-state actors are using a patched remote code execution vulnerability in Cisco network appliances to conduct... 		Malware Vulnerability APT 28 ★★
SecurityWeek.webp 2023-04-19 09:03:31 États-Unis, Royaume-Uni: la Russie exploitant la vieille vulnérabilité pour pirater les routeurs Cisco
US, UK: Russia Exploiting Old Vulnerability to Hack Cisco Routers (lien direct)		 > Les agences gouvernementales américaines et britanniques ont émis un avertissement conjoint pour le groupe russe APT28 ciblant les routeurs Cisco en exploitant une ancienne vulnérabilité.
>US and UK government agencies have issued a joint warning for Russian group APT28 targeting Cisco routers by exploiting an old vulnerability. 		Hack Vulnerability APT 28 ★★
NetworkWorld.webp 2023-04-18 16:26:00 Cisco met en garde contre les attaques contre les routeurs de réseau, les pare-feu
Cisco warns of attacks on network routers, firewalls (lien direct)		 Le groupe de renseignement de la sécurité de Cisco \\ de Cisco \\ a publié aujourd'hui un avertissement d'une augmentation des attaques très sophistiquées contre les infrastructures de réseau, y compris des routeurs et des pare-feu. Le Cisco Avertissement Piggybacks Un avertissement conjoint similaire émis aujourd'hui à partir de Le National Cyber Security Center du Royaume-Uni (NCSC), l'Agence américaine de sécurité nationale (NSA), l'Agence américaine de sécurité de la cybersécurité et de l'infrastructure (CISA) et le Federal Bureau of Investigation (FBI) qui a noté une augmentation des menaces dansen partie utilisant un exploit qui a été révélé pour la première fois en 2017. Cet exploit a ciblé une vulnérabilité SNMP dans les routeurs Cisco qui Le fournisseur patché en 2017 . Pour lire cet article en entier, veuillez cliquer ici
Cisco\'s Talos security intelligence group issued a warning today about an uptick in highly sophisticated attacks on network infrastructure including routers and firewalls.The Cisco warning piggybacks a similar joint warning issued today from The UK National Cyber Security Centre (NCSC), the US National Security Agency (NSA), US Cybersecurity and Infrastructure Security Agency (CISA) and US Federal Bureau of Investigation (FBI) that noted an uptick in threats in part utilizing an exploit that first came to light in 2017.  That exploit targeted an SNMP vulnerability in Cisco routers that the vendor patched in 2017. To read this article in full, please click here		 Vulnerability APT 28 ★★
Netskope.webp 2023-03-21 19:00:00 CVE-2023-23397: Microsoft Outlook Zero-Day exploité par APT28 [CVE-2023-23397: Microsoft Outlook Zero-Day Exploited by APT28] (lien direct) > Résumé Une vulnérabilité de privilège (EOP) désormais fixe (EOP) dans Microsoft Outlook (CVE-2023-23397) permet aux attaquants d'envoyer des e-mails artisanaux pour exploiter Outlook.La vulnérabilité ne nécessite pas que l'interaction utilisateur soit exploitée et s'exécute avant même que l'e-mail ne soit visualisé dans le volet d'aperçu d'Outlook, ce qui rend cette vulnérabilité encore plus dangereuse.CVE-2023-2339 [& # 8230;]
>Summary A now fixed zero-day elevation of privilege (EoP) vulnerability in Microsoft Outlook (CVE-2023-23397) allows attackers to send craft emails to exploit Outlook. The vulnerability does not require user interaction to be exploited and runs even before the email is visualized in the preview pane of Outlook, which makes this vulnerability even more dangerous. CVE-2023-2339 […] 		Vulnerability APT 28 ★★★
NoticeBored.webp 2022-08-06 10:46:21 CISO workshop slides (lien direct) A glossy, nicely-constructed and detailed PowerPoint slide deck by Microsoft Security caught my beady this morning. The title 'CISO Workshop: Security Program and Strategy' with 'Your Name Here' suggests it might be a template for use in a workshop/course bringing CISOs up to speed on the governance, strategic and architectural aspects of information security, but in fact given the amount of technical detail, it appears to be aimed at informing IT/technology managers about IT or cybersecurity, specifically. Maybe it is intended for newly-appointed CISOs or more junior managers who aspire to be CISOs, helping them clamber up the pyramid (slide 87 of 142): Malware Vulnerability Threat Patching Guideline Medical Cloud Uber APT 38 APT 37 APT 28 APT 19 APT 15 APT 10 APT 34 Guam
Anomali.webp 2022-08-02 15:17:00 Anomali Cyber Watch: Velvet Chollima Steals Emails from Browsers, Austrian Mercenary Leverages Zero-Days, China-Sponsored Group Uses CosmicStrand UEFI Firmware Rootkit, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Cyber mercenaries, Phishing, Rootkits, Spyware, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence SharpTongue Deploys Clever Mail-Stealing Browser Extension “SHARPEXT” (published: July 28, 2022) Volexity researchers discovered SharpExt, a new malicious browser app used by the North-Korea sponsored Velvet Chollima (Kimsuky, SharpTongue, Thallium) group. SharpExt inspects and exfiltrates data from a victim's webmail (AOL or Gmail) account as they browse it. Velvet Chollima continues to add new features to the app, the latest known version (3.0) supports three browsers: Microsoft Edge, Google Chrome, and Whale, the latter almost exclusively used in South Korea. Following the initial compromise, Velvet Chollima deploy SharpExt and to avoid warning the victim they manually exfiltrate settings files to change the settings and generate a valid "super_mac" security check value. They also hide the newly opened DevTools window and any other warning windows such as a warning regarding extensions running in developer mode. Analyst Comment: Velvet Chollima is known for its tactic of deploying malicious browser extensions, but in the past it was concentrating on stealing credentials instead of emails. The group continues aggressive cyberespionage campaigns exfiltrating military and industrial technologies from Europe, South Korea, and the US. Network defenders should monitor for suspicious instances of PowerShell execution, as well as for traffic to and from known Velvet Chollima infrastructure (available in Anomali Match). MITRE ATT&CK: [MITRE ATT&CK] Browser Extensions - T1176 | [MITRE ATT&CK] Email Collection - T1114 | [MITRE ATT&CK] Command and Scripting Interpreter - T1059 | [MITRE ATT&CK] Hide Artifacts - T1564 Tags: SharpExt, Velvet Chollima, Kimsuky, SharpTongue, Thallium, APT, North Korea, source-country:KP, South Korea, target-country:KR, USA, target-country:US, target-region:Europe, AOL, Gmail, Edge, Chrome, Whale, PowerShell, VBS, Browser extension Untangling KNOTWEED: European Private-Sector Offensive Actor Using 0-Day Exploits (published: July 27, 2022) Microsoft researchers detail activity of DSIRF, Austrian private-sector offensive actor (PSOA). In 2021, this actor, tracked as Knotweed, used four Windows and Adobe 0-day exploits. In 2022, DSIRF was exploiting another Adobe Reader vulnerability, CVE-2022-22047, which was patched in July 2022. DSIRF attacks rely on their malware toolset called Subzero. The initial downloader shellcode is executed from either the exploit chains or malicious Excel documents. It downloads a JPG image file with extra encrypted data, extracts, decrypts and loads to the memory the Corelump memory-only infostealer. For persistence, Corelump creates trojanized copies of legitimate Windows DLLs that se Malware Tool Vulnerability Threat Patching Guideline Cloud APT 37 APT 28
Anomali.webp 2022-06-28 19:11:00 Anomali Cyber Watch: API Hammering Confuses Sandboxes, Pirate Panda Wrote in Nim, Magecart Obfuscates Variable Names, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: API hammering, APT, China, Phishing, Ransomware, Russia, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Lockbit Ransomware Disguised as Copyright Claim E-mail Being Distributed (published: June 24, 2022) ASEC researchers have released their analysis of a recent phishing campaign, active since February 2022. The campaign aims to infect users with Lockbit ransomware, using the pretense of a copyright claim as the phishing lure. The phishing email directs the recipient to open the attached zip file which contains a pdf of the infringed material. In reality, the pdf is a disguised NSIS executable which downloads and installs Lockbit. The ransomware is installed onto the desktop for persistence through desktop change or reboot. Prior to data encryption, Lockbit will delete the volume shadow copy to prevent data recovery, in addition to terminating a variety of services and processes to avoid detection. Analyst Comment: Never click on suspicious attachments or run any executables from suspicious emails. Copyright infringement emails are a common phishing lure. Such emails will be straight forward to rectify if legitimate. If a copyright email is attempting to coerce you into opening attachments, such emails should be treated with extreme caution. MITRE ATT&CK: [MITRE ATT&CK] Phishing - T1566 | [MITRE ATT&CK] Data Encrypted for Impact - T1486 | [MITRE ATT&CK] Impair Defenses - T1562 Tags: malware:Phishing, malware:Lockbit, Lockbit, Copyright, Ransomware There is More Than One Way To Sleep: Deep Dive into the Implementations of API Hammering by Various Malware Families (published: June 24, 2022) Researchers at Palo Alto Networks have released their analysis of new BazarLoader and Zloader samples that utilize API Hammering as a technique to evade sandbox detection. API Hammering makes use of a large volume of Windows API calls to delay the execution of malicious activity to trick sandboxes into thinking the malware is benign. Whilst BazarLoader has utilized the technique in the past, this new variant creates large loops of benign API using a new process. Encoded registry keys within the malware are used for the calls and the large loop count is created from the offset of the first null byte of the first file in System32 directory. Zloader uses a different form of API Hammering to evade sandbox detection. Hardcoded within Zloader are four large functions with many smaller functions within. Each function makes an input/output (I/O) call to mimic the behavior of many legitimate processes. Analyst Comment: Defense in depth is the best defense against sophisticated malware. The Anomali Platform can assist in detection of malware and Match anomalous activity from all telemetry sources to provide the complete picture of adversary activity within your network. MITRE ATT&CK: [MITRE ATT&CK] Virtualization/Sandbox Evasion - T1497 Tags: malware:BazarLoad Ransomware Spam Malware Tool Vulnerability Threat APT 28 APT 23
The_Hackers_News.webp 2022-06-22 04:51:03 Russian Hackers Exploiting Microsoft Follina Vulnerability Against Ukraine (lien direct) The Computer Emergency Response Team of Ukraine (CERT-UA) has cautioned of a new set of spear-phishing attacks exploiting the "Follina" flaw in the Windows operating system to deploy password-stealing malware. Attributing the intrusions to a Russian nation-state group tracked as APT28 (aka Fancy Bear or Sofacy), the agency said the attacks commence with a lure document titled "Nuclear Terrorism Vulnerability APT 28
Anomali.webp 2022-05-10 17:08:00 Anomali Cyber Watch: Moshen Dragon Abused Anti-Virus Software, Raspberry Robin Worm Jumps from USB, UNC3524 Uses Internet-of-Things to Steal Emails, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Cyberespionage, Phishing, Ransomware, Sideloading, and Ukraine. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Attackers Are Attempting to Exploit Critical F5 BIG-IP RCE (published: May 9, 2022) CVE-2022-1388, a critical remote code execution vulnerability affecting F5 BIG-IP multi-purpose networking devices/modules, was made public on May 4, 2022. It is of high severity (CVSSv3 score is 9.8). By May 6, 2022, multiple researchers have developed proof-of concept (PoC) exploits for CVE-2022-1388. The first in-the-wild exploitation attempts were reported on May 8, 2022. Analyst Comment: Update your vulnerable F5 BIG-IP versions 13.x and higher. BIG-IP 11.x and 12.x will not be fixed, but temporary mitigations available: block iControl REST access through the self IP address and through the management interface, modify the BIG-IP httpd configuration. MITRE ATT&CK: [MITRE ATT&CK] Exploit Public-Facing Application - T1190 Tags: CVE-2022-1388, F5, Vulnerability, Remote code execution, Missing authentication Mobile Subscription Trojans and Their Little Tricks (published: May 6, 2022) Kaspersky researchers analyzed five Android trojans that are secretly subscribing users to paid services. Jocker trojan operators add malicious code to legitimate apps and re-upload them to Google Store under different names. To avoid detection, malicious functionality won’t start until the trojan checks that it is available in the store. The malicious payload is split in up to four files. It can block or substitute anti-fraud scripts, and modify X-Requested-With header in an HTTP request. Another Android malware involved in subscription fraud, MobOk trojan, has additional functionality to bypass captcha. MobOk was seen in a malicious app in Google Store, but the most common infection vector is being spread by other Trojans such as Triada. Analyst Comment: Limit your apps to downloads from the official stores (Google Store for Android), avoid new apps with low number of downloads and bad reviews. Pay attention to the terms of use and payment. Avoid granting it too many permissions if those are not crucial to the app alleged function. Monitor your balance and subscription list. MITRE ATT&CK: [MITRE ATT&CK] Ingress Tool Transfer - T1105 | [MITRE ATT&CK] User Execution - T1204 | [MITRE ATT&CK] Data Manipulation - T1565 Tags: Android, Jocker, MobOk, Triada, Vesub, GriftHorse, Trojan, Subscription fraud, Subscription Trojan, Russia, target-country:RU, Middle East, Saudi Arabia, target-country:SA, Egypt, target-country:EG, Thailand, target-country:TH Raspberry Robin Gets the Worm Early (published: May 5, 2022) Since September 2021, Red Canary researchers monitor Raspberry Robin, a new worm Ransomware Malware Tool Vulnerability Threat APT 29 APT 28 ★★★
Anomali.webp 2022-04-26 16:24:00 Anomali Cyber Watch: Gamaredon Delivers Four Pterodos At Once, Known-Plaintext Attack on Yanlouwang Encryption, North-Korea Targets Blockchain Industry, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, CatalanGate, Cloud, Cryptocurrency, Information stealers, Ransomware, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence SocGholish and Zloader – From Fake Updates and Installers to Owning Your Systems (published: April 25, 2022) Cybereason researchers have compared trending attacks involving SocGholish and Zloader malware. Both infection chains begin with social engineering and malicious downloads masquerading as legitimate software, and both lead to data theft and possible ransomware installation. SocGholish attacks rely on drive-by downloads followed by user execution of purported browser installer or browser update. The SocGholish JavaScript payload is obfuscated using random variable names and string manipulation. The attacker domain names are written in reverse order with the individual string characters being put at the odd index positions. Zloader infection starts by masquerading as a popular application such as TeamViewer. Zloader acts as information stealer, backdoor, and downloader. Active since 2016, Zloader actively evolves and has acquired detection evasion capabilities, such as excluding its processes from Windows Defender and using living-off-the-land (LotL) executables. Analyst Comment: All applications should be carefully researched prior to installing on a personal or work machine. Applications that request additional permissions upon installation should be carefully vetted prior to allowing permissions. Additionally, all applications, especially free versions, should only be downloaded from trusted vendors. MITRE ATT&CK: [MITRE ATT&CK] Drive-by Compromise - T1189 | [MITRE ATT&CK] Phishing - T1566 | [MITRE ATT&CK] User Execution - T1204 | [MITRE ATT&CK] Command and Scripting Interpreter - T1059 | [MITRE ATT&CK] Windows Management Instrumentation - T1047 | [MITRE ATT&CK] Masquerading - T1036 | [MITRE ATT&CK] Process Injection - T1055 | [MITRE ATT&CK] Signed Binary Proxy Execution - T1218 | [MITRE ATT&CK] Credentials from Password Stores - T1555 | [MITRE ATT&CK] Steal or Forge Kerberos Tickets - T1558 | [MITRE ATT&CK] Steal Web Session Cookie - T1539 | [MITRE ATT&CK] Unsecured Credentials - T1552 | [MITRE ATT&CK] Remote System Discovery - T1018 | [MITRE ATT&CK] System Owner/User Discovery - T1033 | Ransomware Malware Tool Vulnerability Threat Guideline Medical Uber APT 38 APT 28
Anomali.webp 2022-04-19 15:00:00 Anomali Cyber Watch: RaidForums Seized, Sandworm Attacks Ukrainian Power Stations, North Korea Steals Chemical Secrets, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, China, Cyberespionage, North Korea, Spearphishing, Russia, Ukraine, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Lazarus Targets Chemical Sector (published: April 14, 2022) In January 2022, Symantec researchers discovered a new wave of Operation Dream Job. This operation, attributed to the North Korea-sponsored group Lazarus, utilizes fake job offers via professional social media and email communications. With the new wave of attacks, Operation Dream Job switched from targeting the defense, government, and engineering sectors to targeting South Korean organizations operating within the chemical sector. A targeted user executes an HTM file sent via a link. The HTM file is copied to a DLL file to be injected into the legitimate system management software. It downloads and executes the final backdoor: a trojanized version of the Tukaani project LZMA Utils library (XZ Utils) with a malicious export added (AppMgmt). After the initial access, the attackers gain persistence via scheduled tasks, move laterally, and collect credentials and sensitive information. Analyst Comment: Organizations should train their users to recognize social engineering attacks including those posing as “dream job” proposals. Organizations facing cyberespionage threats should implement a defense-in-depth approach: layering of security mechanisms, redundancy, fail-safe defense processes. MITRE ATT&CK: [MITRE ATT&CK] Scheduled Task - T1053 | [MITRE ATT&CK] User Execution - T1204 | [MITRE ATT&CK] Windows Management Instrumentation - T1047 | [MITRE ATT&CK] Process Injection - T1055 | [MITRE ATT&CK] Valid Accounts - T1078 | [MITRE ATT&CK] Signed Binary Proxy Execution - T1218 | [MITRE ATT&CK] Credentials from Password Stores - T1555 Tags: Lazarus, Operation Dream Job, North Korea, source-country:KP, South Korea, target-country:KR, APT, HTM, CPL, Chemical sector, Espionage, Supply chain, IT sector Old Gremlins, New Methods (published: April 14, 2022) Group-IB researchers have released their analysis of threat actor OldGremlin’s new March 2022 campaign. OldGremlin favored phishing as an initial infection vector, crafting intricate phishing emails that target Russian industries. The threat actors utilized the current war between Russia and Ukraine to add a sense of legitimacy to their emails, with claims that users needed to click a link to register for a new credit card, as current ones would be rendered useless by incoming sanctions. The link leads users to a malicious Microsoft Office document stored within Dropbox. When macros are enabled, the threat actor’s new, custom backdoor, TinyFluff, a new version of their old TinyNode Ransomware Spam Malware Vulnerability Threat Guideline Medical APT 38 APT 28
Anomali.webp 2022-03-15 16:46:00 Anomali Cyber Watch: Government and Financially-Motivated Targeting of Ukraine, Conti Ransomware Active Despite Exposure, Carbanak Abuses XLL Files, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Excel add-ins, Phishing, Russia, Ukraine, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Webinar on Cyberattacks in Ukraine – Summary and Q&A (published: March 14, 2022) As the military conflict in Ukraine continues, the number of cyberattacks in Ukraine is expected to rise in the next six months, according to Kaspersky researchers. Most of the current attacks on Ukraine are of low complexity, but advanced persistent threat (APT) attacks exist too. Gamaredon (Primitive Bear) APT group continues its spearphishing attacks. Sandworm APT targets SOHO network devices with modular Linux malware Cyclops Blink. Other suspected APT campaigns use MicroBackdoor malware or various wipers and fake ransomware (HermeticRansom, HermeticWiper, IsaacWiper, WhisperGate). Honeypot network in Ukraine detected over 20,000 attacking IP addresses, and most of them were seen attacking Ukraine exclusively. Analyst Comment: Harden your infrastructure against DDoS attacks, ransomware and destructive malware, phishing, targeted attacks, supply-chain attacks, and firmware attacks. Install all the latest patches. Install security software. Consider strict application white-listing for all machines. Actively hunt for attackers inside the company’s internal network using the retrospective visibility provided by Anomali XDR. MITRE ATT&CK: [MITRE ATT&CK] Shared Modules - T1129 | [MITRE ATT&CK] Data Encoding - T1132 | [MITRE ATT&CK] Pre-OS Boot - T1542 | [MITRE ATT&CK] Fallback Channels - T1008 | [MITRE ATT&CK] Application Layer Protocol - T1071 | [MITRE ATT&CK] Phishing - T1566 | [MITRE ATT&CK] Disk Content Wipe - T1488 | [MITRE ATT&CK] Inhibit System Recovery - T1490 Tags: Gamaredon, Sandworm, MicroBackdoor, Hades, HermeticWiper, HermeticRansom, IsaacWiper, Pandora, Cyclops Blink, Government, Russia, Ukraine, UNC1151, Ghostwriter, Belarus, Ukraine-Russia Conflict 2022, Operation Bleeding Bear Alert (AA21-265A) Conti Ransomware (Updated) (published: March 9, 2022) The U.S. Cybersecurity and Infrastructure Security Agency (CISA), with assistance from the U.S. Secret Service has updated the alert on Conti ransomware with 98 domain names used in malicious operations. Conti ransomware-as-a-service (RaaS) operation is attributed to the threat group Wizard Spider also known for its Trickbot malware. The group’s internal data and communications were leaked at the end of February 2022 after they announced support for Russia over the conflict in Ukraine. Analyst Comment: Despite the increased attention to Conti ransomware group, it remains extremely active. Ensure t Ransomware Malware Tool Vulnerability Threat APT 28
Anomali.webp 2022-01-25 16:00:00 Anomali Cyber Watch: MoonBounce, AccessPress, QR Code Scams and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Linux Malware, Supply-Chain Attacks, Malspam, Phishing, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence FBI Warns Of Malicious QR Codes Used To Steal Your Money (published: January 23, 2022) The Federal Bureau of Investigation (FBI) recently released a notice that malicious QR codes have been found in the wild. These codes, when scanned, will redirect the victim to a site where they are prompted to enter personal and payment details. The site will then harvest these credentials for cybercriminals to commit fraud and empty bank accounts. This threat vector has been seen in Germany as of December 2021. Analyst Comment: Always be sure to check that emails have been sent from a legitimate source, and that any financial details or method of payment is done through the website. While QR codes are useful and being used by businesses more often, it is easy for cybercriminals to perform this kind of scam. If scanning a physical QR code, ensure the code has not been replaced with a sticker placed on top of the original code. Check the final URL to make sure it is the intended site and looks authentic. MITRE ATT&CK: [MITRE ATT&CK] Phishing - T1566 Tags: EU & UK, Banking and Finance MoonBounce: The Dark Side Of UEFI Firmware (published: January 20, 2022) Kaspersky has reported that in September 2021, a bootloader malware infection had been discovered that embeds itself into UEFI firmware. The malware patches existing UEFI drivers and resides in the SPI flash memory located on the motherboard. This means that it will persist even if the hard drive is replaced. Code snippets and IP addresses link the activity to APT41, a group that is operated by a group of Chinese-speaking individuals. MoonBounce is highly sophisticated and very difficult to detect. Analyst Comment: Systems should be configured to take advantage of Trusted Platform Module (TPM) hardware security chips to secure their systems' boot image and firmware, where available. Secure boot is also a viable option to mitigate against attacks that would patch, reconfigure, or flash existing UEFI firmware to implant malicious code. MITRE ATT&CK: [MITRE ATT&CK] Pre-OS Boot - T1542 | [MITRE ATT&CK] Data Obfuscation - T1001 | [MITRE ATT&CK] Data Encoding - T1132 | [MITRE ATT&CK] Exploitation of Remote Services - T1210 | [MITRE ATT&CK] Remote Services - T1021 | [MITRE ATT&CK] Shared Modules - T1129 | [MITRE ATT&CK] Hijack Execution Flow - T1574 | Ransomware Malware Tool Vulnerability Threat Guideline APT 41 APT 28
Anomali.webp 2022-01-19 22:45:00 Anomali Cyber Watch: Russia-Sponsored Cyber Threats, China-Based Earth Lusca Active in Cyberespionage and Cybertheft, BlueNoroff Hunts Cryptocurrency-Related Businesses, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, China, HTTP Stack, Malspam, North Korea, Phishing, Russia and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Earth Lusca Employs Sophisticated Infrastructure, Varied Tools and Techniques (published: January 17, 2022) The Earth Lusca threat group is part of the Winnti cluster. It is one of different Chinese groups that share aspects of their tactics, techniques, and procedures (TTPs) including the use of Winnti malware. Earth Lusca were active throughout 2021 committing both cyberespionage operations against government-connected organizations and financially-motivated intrusions targeting gambling and cryptocurrency-related sectors. For intrusion, the group tries different ways in including: spearphishing, watering hole attacks, and exploiting publicly facing servers. Cobalt Strike is one of the group’s preferred post-exploitation tools. It is followed by the use of the BioPass RAT, the Doraemon backdoor, the FunnySwitch backdoor, ShadowPad, and Winnti. The group employs two separate infrastructure clusters, first one is rented Vultr VPS servers used for command-and-control (C2), second one is compromised web servers used to scan for vulnerabilities, tunnel traffic, and Cobalt Strike C2. Analyst Comment: Earth Lusca often relies on tried-and-true techniques that can be stopped by security best practices, such as avoiding clicking on suspicious email/website links and or reacting on random banners urging to update important public-facing applications. Don’t be tricked to download Adobe Flash update, it was discontinued at the end of December 2020. Administrators should keep their important public-facing applications (such as Microsoft Exchange and Oracle GlassFish Server) updated. MITRE ATT&CK: [MITRE ATT&CK] Drive-by Compromise - T1189 | [MITRE ATT&CK] Exploit Public-Facing Application - T1190 | [MITRE ATT&CK] Phishing - T1566 | [MITRE ATT&CK] Command and Scripting Interpreter - T1059 | [MITRE ATT&CK] Scheduled Task - T1053 | [MITRE ATT&CK] System Services - T1569 | [MITRE ATT&CK] Windows Management Instrumentation - T1047 | [MITRE ATT&CK] Account Manipulation - T1098 | [MITRE ATT&CK] BITS Jobs - T1197 | [MITRE ATT&CK] Create Account - T1136 | [MITRE ATT&CK] Create or Modify System Process - T1543 | [MITRE ATT&CK] External Remote Services - T1133 | [MITRE ATT&CK] Hijack Execution Flow Ransomware Malware Tool Vulnerability Threat Patching Guideline APT 41 APT 38 APT 29 APT 28 APT 28
Anomali.webp 2021-12-21 16:57:00 Anomali Cyber Watch: \'PseudoManuscrypt\' Mass Spyware Campaign Targets 35K Systems, APT31 Intrusion Set Campaign: Description, Countermeasures and Code, State-sponsored hackers abuse Slack API to steal (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT31, Magecart, Hancitor, Pakdoor, Lazarus, and Vulnerabilities CVE-2021-21551.. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence NSW Government Casual Recruiter Suffers Ransomware Hit (published: December 17, 2021) Finite Recruitment suffered a ransomware attack during the month of October 2021, resulting in the exfiltration of some data. Their incident responders (IR) identified the ransomware as Conti, a fast encrypting ransomware commonly attributed to the cybercriminal group Wizard Spider. The exfiltrated data was published on the dark web, however the firm remains fully operational, and affected customers are being informed. Analyst Comment: Always check to see if there is a decryptor available for the ransomware before considering payment. Enforce a strong backup policy to ensure that data is recoverable in the event of encryption or loss. MITRE ATT&CK: [MITRE ATT&CK] Scheduled Transfer - T1029 Tags: Conti, Wizard Spider, Ransomware, Banking and Finance Phorpiex botnet is back with a new Twizt: Hijacking Hundreds of crypto transactions (published: December 16, 2021) Check Point Research has uncovered a new variant of the Phorpiex botnet named Twizt. Historically, Phorpiex utilized sextortion, ransomware delivery, and cryptocurrency clipping. Twizt however, appears to be primarily focused on stealing cryptocurrency and have stolen half a million dollars since November 2020 in the form of Bitcoin, Ether and ERC20 tokens.The botnet features departure from it’s traditional command and control (C2) infrastructure, opting for peer-to-peer (P2P) communications between infected hosts, eliminating the need for C2 communication as each host can fulfill that role. Analyst Comment: Bots within a P2P network need to communicate regularly with other bots to receive and share commands. If the infected bots are on a private network, private IP addresses will be used. Therefore, careful monitoring of network traffic will reveal suspicious activity, and a spike in network resource usage as opposed to the detection of C2 IP addresses. MITRE ATT&CK: [MITRE ATT&CK] Data Encoding - T1132 | [MITRE ATT&CK] File and Directory Discovery - T1083 | [MITRE ATT&CK] Clipboard Data - T1115 Tags: Phorpiex, Twizt, Russia, Banking and Finance, Cryptocurrency, Bitcoin ‘PseudoManuscrypt’ Mass Spyware Campaign Targets 35K Systems (published: December 16, 2021) Kaspersky researchers have documented a spyware that has targeted 195 countries as of December 2021. The spyware, named PseudoManuscrypt, was developed and deployed by Lazarus Group Ransomware Malware Vulnerability Threat Guideline Medical APT 41 APT 38 APT 28 APT 31
Anomali.webp 2021-07-20 15:00:00 Anomali Cyber Watch: China Blamed for Microsoft Exchange Attacks, Israeli Cyber Surveillance Companies Help Oppressive Governments, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: China, APT, Espionage, Ransomware, Targeted Campaigns, DLL Side-Loading, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence UK and Allies Accuse China for a Pervasive Pattern of Hacking, Breaching Microsoft Exchange Servers (published: July 19, 2021) On July 19th, 2021, the US, the UK, and other global allies jointly accused China in a pattern of aggressive malicious cyber activity. First, they confirmed that Chinese state-backed actors (previously identified under the group name Hafnium) were responsible for gaining access to computer networks around the world via Microsoft Exchange servers. The attacks took place in early 2021, affecting over a quarter of a million servers worldwide. Additionally, APT31 (Judgement Panda) and APT40 (Kryptonite Panda) were attributed to Chinese Ministry of State Security (MSS), The US Department of Justice (DoJ) has indicted four APT40 members, and the Cybersecurity and Infrastructure Security Agency (CISA) shared indicators of compromise of the historic APT40 activity. Analyst Comment: Network defense-in-depth and adherence to information security best practices can assist organizations in reducing the risk. Pay special attention to the patch and vulnerability management, protecting credentials, and continuing network hygiene and monitoring. When possible, enforce the principle of least privilege, use segmentation and strict access control measures for critical data. Organisations can use Anomali Match to perform real time forensic analysis for tracking such attacks. MITRE ATT&CK: [MITRE ATT&CK] Drive-by Compromise - T1189 | [MITRE ATT&CK] Exploit Public-Facing Application - T1190 | [MITRE ATT&CK] External Remote Services - T1133 | [MITRE ATT&CK] Server Software Component - T1505 | [MITRE ATT&CK] Exploitation of Remote Services - T1210 Tags: Hafnium, Judgement Panda, APT31, TEMP.Jumper, APT40, Kryptonite Panda, Zirconium, Leviathan, TEMP.Periscope, Microsoft Exchange, CVE-2021-26857, CVE-2021-26855, CVE-2021-27065, CVE-2021-26858, Government, EU, UK, North America, China NSO’s Spyware Sold to Authoritarian Regimes Used to Target Activists, Politicians and Journalists (published: July 18, 2021) Israeli surveillance company NSO Group supposedly sells spyware to vetted governments bodies to fight crime and terrorism. New research discovered NSO’s tools being used against non-criminal actors, pro-democracy activists and journalists investigating corruption, political opponents and government critics, diplomats, etc. In some cases, the timeline of this surveillance coincided with journalists' arrests and even murders. The main penetration tool used by NSO is malware Pegasus that targets both iPho Ransomware Malware Tool Vulnerability Threat Studies Guideline Industrial APT 41 APT 40 APT 28 APT 31
Anomali.webp 2021-06-22 18:18:00 Anomali Cyber Watch:  Klingon RAT Holding on for Dear Life, CVS Medical Records Breach, Black Kingdom Ransomware and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: Black Kingdom, Darkside, Go, Klingon Rat, Microsoft PowerApps, Ransomware and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Andariel Evolves to Target South Korea with Ransomware (published: June 15, 2021) Researchers at securelist identified ransomware attacks from Andariel, a sub-group of Lazarus targeting South Korea. Attack victims included entities from manufacturing, home network service, media and construction sectors. These attacks involved malicious Microsoft Word documents containing a macro and used novel techniques to implant a multi-stage payload. The final payload was a ransomware custom made for this specific attack. Analyst Comment: Users should be wary of documents that request Macros to be enabled. All employees should be educated on the risk of opening attachments from unknown senders. Anti-spam and antivirus protections should be implemented and kept up-to-date with the latest version to better ensure security. MITRE ATT&CK: [MITRE ATT&CK] System Network Connections Discovery - T1049 | [MITRE ATT&CK] Process Discovery - T1057 | [MITRE ATT&CK] Screen Capture - T1113 | [MITRE ATT&CK] Standard Non-Application Layer Protocol - T1095 | [MITRE ATT&CK] Exfiltration Over Command and Control Channel - T1041 | [MITRE ATT&CK] Data Encrypted for Impact - T1486 Tags: Lazarus group, Lazarus, Andariel, Hidden Cobra, tasklist, Manuscrypt, Banking And Finance, Malicious documents, Macros Matanbuchus: Malware-as-a-Service with Demonic Intentions (published: June 15, 2021) In February 2021, BelialDemon advertised a new malware-as-a-service (MaaS) called Matanbuchus Loader and charged an initial rental price of $2,500. Malware loaders are malicious software that typically drop or pull down second-stage malware from command and control (C2) infrastructures. Analyst Comment: Malware as a Service (MaaS) is a relatively new development, which opens the doors of crime to anyone with the money to pay for access. A criminal organization that wants to carry out a malware attack on a target no longer requires in-house technical expertise or infrastructure. Such attacks in most cases share tactics, techniques, and even IOCs. This highlights the importance of intelligence sharing for proactive protection. MITRE ATT&CK: [MITRE ATT&CK] System Network Configuration Discovery - T1016 Tags: BelialDemon, Matanbuchus, Belial, WildFire, EU, North America Black Kingdom ransomware (published: June 17 Ransomware Data Breach Malware Vulnerability Threat Medical APT 38 APT 28
Anomali.webp 2021-06-08 15:00:00 Anomali Cyber Watch: TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations, Necro Python Bots Adds New Tricks, US Seizes Domains Used by APT29 and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, APT29, FluBot, Necro Python, RoyalRoad, SharpPanda, TeaBot and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations (published: June 4, 2021) Researchers at Palo Alto have identified a malware repo belonging to TeamTNT, the prominent cloud focused threat group. The repo shows the expansion of TeamTNTs abilities, and includes scripts for scraping SSH keys, AWS IAM credentials and searching for config files that contain credentials. In addition to AWS credentials, TeamTNT are now also searching for Google Cloud credentials, which is the first instance of the group expanding to GCP. Analyst Comment: Any internal only cloud assets & SSH/Privileged access for customer facing cloud infrastructure should only be accessible via company VPN. This ensures attackers don’t get any admin access from over the internet even if keys or credentials are compromised. Customers should monitor compromised credentials in public leaks & reset the passwords immediately for those accounts. MITRE ATT&CK: [MITRE ATT&CK] Permission Groups Discovery - T1069 Tags: AWS, Cloud, Credential Harvesting, cryptojacking, Google Cloud, IAM, scraping, TeamTnT, Black-T, Peirates Necro Python Bots Adds New Tricks (published: June 3, 2021) Researchers at Talos have identified updated functionality in the Necro Python bot. The core functionality is the same with a focus on Monero mining, however exploits to the latest vulnerabilities have been added. The main payloads are XMRig, traffic sniffing and DDoS attacks. Targeting small and home office routers, the bot uses python to support multiple platforms. Analyst Comment: Users should ensure they always apply the latest patches as the bot is looking to exploit unpatched vulnerabilities. Users need to change default passwords for home routers to ensure potential malware on your personal devices don’t spread to your corporate devices through router takeover. MITRE ATT&CK: [MITRE ATT&CK] Scripting - T1064 | [MITRE ATT&CK] Obfuscated Files or Information - T1027 | [MITRE ATT&CK] Process Injection - T1055 | [MITRE ATT&CK] Input Capture - T1056 | [MITRE ATT&CK] Exploit Public-Facing Application - T1190 | [MITRE ATT&CK] Remote Access Tools - T1219 Tags: Bot, botnet, Exploit, Monero, Necro Python, Python, Vulnerabilities, XMRig New SkinnyBoy Ma Ransomware Malware Vulnerability Threat Patching Guideline APT 29 APT 28
Anomali.webp 2021-04-27 17:24:00 Anomali Cyber Watch:  HabitsRAT Targeting Linux and Windows Servers, Lazarus Group Targetting South Korean Orgs, Multiple Zero-Days and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Android Malware, RATs, Phishing, QLocker Ransomware and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Zero-day Vulnerabilities in SonicWall Email Security Actively Exploited (published: April 21, 2021) US cybersecurity company SonicWall said fixes have been published to resolve three critical issues in its email security solution that are being actively exploited in the wild. The vulnerabilities are tracked as CVE-2021-20021, CVE-2021-20022, and CVE-2021-20023, impacting SonicWall ES/Hosted Email Security (HES) versions 10.0.1 and above. Analyst Comment: The patches for these vulnerabilities have been issued and should be applied as soon as possible to avoid potential malicious behaviour. SonicWall’s security notice can be found here https://www.sonicwall.com/support/product-notification/security-notice-sonicwall-email-security-zero-day-vulnerabilities/210416112932360/. It is important that your company has patch-maintenance policies in place. Once a vulnerability has been publicly reported,, threat actors will likely attempt to incorporate the exploitation of the vulnerability into their malicious operations. Patches should be reviewed and applied as soon as possible to prevent potential malicious activity. MITRE ATT&CK: [MITRE ATT&CK] Remote File Copy - T1105 | [MITRE ATT&CK] File and Directory Discovery - T1083 Tags: CVE-2021-20021, CVE-2021-20023, CVE-2021-20022 Massive Qlocker Ransomware Attack Uses 7zip to Encrypt QNAP Devices (published: April 21, 2021) The ransomware is called Qlocker and began targeting QNAP devices on April 19th, 2021. All victims are told to pay 0.01 Bitcoins, which is approximately $557.74, to get a password for their archived files. While the files are being locked, the Resource Monitor will display numerous '7z' processes which are the 7zip command-line executable. Analyst Comment: Attackers are using legitimate tools like 7zip to evade detections by traditional antiviruses. EDR solutions can help tracking suspicious command line arguments and process creations to potentially detect such attacks. Customers should use backup solutions to be able recover encrypted files. MITRE ATT&CK: [MITRE ATT&CK] Credentials in Files - T1081 Tags: Tor, Qlocker, CVE-2020-2509, CVE-2020-36195 Novel Email-Based Campaign Targets Bloomberg Clients with RATs (published: April 21, 2021) A new e-mail-based campaign by an emerging threat actor aims to spread various remote access trojans (RATs) to a very specific group of targets who use Bloomberg's industry-based services. Attacks start in the form of targeted emails to c Ransomware Malware Tool Vulnerability Threat Medical Wannacry Wannacry APT 38 APT 28
Anomali.webp 2020-09-15 15:00:00 Weekly Threat Briefing: APT Group, Malware, Ransomware, and Vulnerabilities (lien direct) The various threat intelligence stories in this iteration of the Weekly Threat Briefing discuss the following topics: APT, Conti Ransomware, Cryptominers, Emotet, Linux, US Election, and Vulnerabilities. The IOCs related to these stories are attached to the Weekly Threat Briefing and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence China’s ‘Hybrid War’: Beijing’s Mass Surveillance of Australia and the World for Secrets and Scandal (published: September 14, 2020) A database containing 2.4 million people has been leaked from a Shenzhen company, Zhenhua Data, believed to have ties to the Chinese intelligence service. The database contains personal information on over 35,000 Australians and prominent figures, and 52,000 Americans. This includes addresses, bank information, birth dates, criminal records, job applications, psychological profiles, and social media. Politicians, lawyers, journalists, military officers, media figures, and Natalie Imbruglia are among the records of Australians contained in the database. While a lot of the information is public, there is also non-public information contributing to claims that China is developing a mass surveillance system. Recommendation: Users should always remain vigilant about the information they are putting out into the public, and avoid posting personal or sensitive information online. Tags: China, spying US Criminal Court Hit by Conti Ransomware; Critical Data at Risk (published: September 11, 2020) The Fourth District Court of Louisiana, part of the US criminal court system, appears to have become the latest victim of the Conti ransomware. The court's website was attacked and used to steal numerous court documents related to defendants, jurors, and witnesses, and then install the Conti ransomware. Evidence of the data theft was posted to the dark web. Analysis of the malware by Emsisoft’s threat analyst, Brett Callow, indicates that the ransomware deployed in the attack was Conti, which has code similarity to another ransomware strain, Ryuk. The Conti group, believed to be behind this ransomware as a service, is sophisticated and due to the fact that they receive a large portion of the ransoms paid, they are motivated to avoid detections and continue to develop advanced attacking tools. This attack also used the Trickbot malware in its exploit chain, similar to that used by Ryuk campaigns. Recommendation: Defense in Depth, including vulnerability remediation and scanning, monitoring, endpoint protection, backups, etc. is key to thwarting increasingly sophisticated attacks. Ransomware attacks are particularly attractive to attackers due to the fact that each successful ransomware attack allows for multiple streams of income. The attackers can not only extort a ransom to decrypt the victim's files (especially in cases where the victim finds they do not have appropriate disaster recovery plans), but they can also monetize the exfiltrated data directly and/or use the data to aid in future attacks. This technique is increasingly used in supply chain compromises to build difficult to detect spearphishing attacks. Tags: conti, ryuk, ransomware Ransomware Malware Tool Vulnerability Threat Conference APT 35 APT 28 APT 31 ★★★
Anomali.webp 2020-09-09 16:24:00 Weekly Threat Briefing: Skimmer, Ransomware, APT Group, and More (lien direct) The various threat intelligence stories in this iteration of the Weekly Threat Briefing discuss the following topics: APT, Baka, DDoS, Netwalker, PyVil, Windows Defender, TA413, and Vulnerabilities. The IOCs related to these stories are attached to the Weekly Threat Briefing and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence ‘Baka’ Javascript Skimmer Identified (published: September 6, 2020) Visa have issued a security alert based on identification of a new skimmer, named “Baka”. Based on analysis by Visa Payment Fraud Disruption, the skimmer appears to be more advanced, loading dynamically and using an XOR cipher for obfuscation. The attacks behind Baka are injecting it into checkout pages using a script tag, with the skimming code downloading from the Command and Control (C2) server and executing in memory to steal customer data. Recommendation: eCommerce site owners must take every step necessary to secure their data and safeguard their payment card information. Visa has also released best practices in the security advisory. Tags: Baka, Javascript, Skimmer Netwalker Ransomware Hits Argentinian Government, Demands $4 Million (published: September 6, 2020) The Argentinian immigration agency, Dirección Nacional de Migaciones suffered a ransomware attack that shut down border crossings. After receiving many tech support calls, the computer networks were shut down to prevent further spread of the ransomware, which led to a cecission in border crossings until systems were up again. The ransomware used in this attack is Netwalker ransomware, that left a ransom note demanding initalling $2 million, however when this wasn’t paid in the first week, the ransom increased to $4 million. Recommendation: Ransomware can potentially be blocked by using endpoint protection solutions (HIDS). Always keep your important files backed up following the 3-2-1 rule: have at least 3 different copies, on 2 different mediums, with 1 off-site. In the case of ransomware infection, the affected system must be wiped and reformatted. Other devices on the network should be checked for similar infections. Always check for a decryptor before considering payment; avoid payment at all costs. Ransomware should be reported to law enforcement agencies who are doing their best to track these actors and prevent ransom from being a profitable business for cyber criminals. MITRE ATT&CK: [MITRE ATT&CK] Data Encrypted for Impact - T1486 Tags: Argentina, Government, Netwalker, Ransomware No Rest for the Wicked: Evilnum Unleashes PyVil RAT (published: September 3, 2020) Researchers on the Cybereason Nocturnus team have published their research tracking the threat actor group known as Evilnum, and an ongoing change in their tooling and attack procedures. This includes a new Remote Access Trojan (RAT), written in python that they have begun to use. The actor group attacks targets in the financial services sector using highly targeted spearphishing. The phishing lures leverage "Know Your Customer" (KY Ransomware Malware Tool Vulnerability Threat Medical APT 38 APT 28 ★★★★
Mandiant.webp 2015-04-18 11:10:00 Opération Russiandoll: Adobe & Windows Exploits zéro-day Probablement exploités par APT28 de Russie dans une attaque très ciblée
Operation RussianDoll: Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia\\'s APT28 in Highly-Targeted Attack (lien direct)		 Fireeye Labs a récemment détecté une campagne APT limitée exploitant les vulnérabilités zéro-jours dans Adobe Flash et une toute nouvelle à Microsoft Windows.En utilisant le Dynamic Keen Intelligence Cloud (DTI) , les chercheurs de Fireeye ont détecté un modèle d'attaques commençant le 13 avril Th , 2015. Adobe a indépendamment corrigé la vulnérabilité (CVE-2015-3043) dans APSB15-06 .Grâce à la corrélation des indicateurs techniques et des infrastructures de commandement et de contrôle, FireEye évalue que l'APT28 est probablement responsable de cette activité. Microsoft est conscient de la vulnérabilité d'escalade locale exceptionnelle dans Windows
FireEye Labs recently detected a limited APT campaign exploiting zero-day vulnerabilities in Adobe Flash and a brand-new one in Microsoft Windows. Using the Dynamic Threat Intelligence Cloud (DTI), FireEye researchers detected a pattern of attacks beginning on April 13th, 2015. Adobe independently patched the vulnerability (CVE-2015-3043) in APSB15-06. Through correlation of technical indicators and command and control infrastructure, FireEye assess that APT28 is probably responsible for this activity. Microsoft is aware of the outstanding local privilege escalation vulnerability in Windows		 Vulnerability Threat Cloud APT 28 APT 28 ★★★★
Last update at: 2025-05-10 16:07:24
See our sources.
My email:

To see everything: Our RSS (filtrered) Twitter