What's new arround internet
Last one

Src Date (GMT) Titre Description Tags Stories Notes
SecurityWeek.webp 2024-10-14 11:20:49 Cyperspies iraniennes exploitant la vulnérabilité récente du noyau Windows
Iranian Cyberspies Exploiting Recent Windows Kernel Vulnerability (lien direct)		 > Le pétrole APT lié à l'Iran a intensifié les cyber-opérations contre les Émirats arabes unis et la région du Golfe plus large.
>The Iran-linked APT OilRig has intensified cyber operations against the United Arab Emirates and the broader Gulf region. 		Vulnerability APT 34 ★★
The_Hackers_News.webp 2024-10-13 15:10:00 OilRig exploite Windows Flaw de noyau dans la campagne d'espionnage ciblant les EAU et le Golfe
OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf (lien direct)		 L'acteur iranien des menaces connu sous le nom de OilRig a été observé exploitant un défaut d'escalade de privilège désormais réglé impactant le noyau Windows dans le cadre d'une campagne de cyber-espionnage ciblant l'U.A.E.et la région du Golfe plus large. "Le groupe utilise des tactiques sophistiquées qui incluent le déploiement d'une porte dérobée qui tire parti des serveurs d'échange Microsoft pour le vol d'identification et l'exploitation des vulnérabilités
The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of a cyber espionage campaign targeting the U.A.E. and the broader Gulf region. "The group utilizes sophisticated tactics that include deploying a backdoor that leverages Microsoft Exchange servers for credentials theft, and exploiting vulnerabilities		 Vulnerability Threat APT 34 ★★
RiskIQ.webp 2024-10-11 21:41:42 Earth Simnavaz (alias Apt34) prélève des cyberattaques avancées contre les régions des EAU et du Golfe
Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against UAE and Gulf Regions (lien direct)		 #### Géolocations ciblées - Émirats arabes unis ## Instantané Les chercheurs de Trend Micro ont identifié une campagne de cyber-espionnage par Earth Simnavaz, également connu sous le nom d'APT34 et suivi par Microsoft comme [Hazel Sandstorm] (https: //security.microsoft.com/intel-profiles/6cea89977cc2795bb1a80cad76f4de2ffff256ac3989e757c530047912450e2d), ciblant les entités gouvernementales enLes EAU et la région du Golfe. ## Description Le groupe utilise des tactiques sophistiquées pour maintenir la persistance et exfiltrer des données sensibles, en utilisant une porte dérobée qui exploite les serveurs d'échange Microsoft pour le vol d'identification et le tirage de vulnérabilités comme le CVE-2024-30088 pour l'escalade des privilèges.Ils utilisent un mélange d'outils .NET personnalisés, de scripts PowerShell et de logiciels malveillants basés sur IIS, tels que la porte dérobée de Karkoff, pour mélanger l'activité malveillante avec le trafic réseau normal et l'évasion de la détection. La méthode d'infiltration initiale consiste à télécharger un shell Web sur un serveur Web vulnérable, permettant l'exécution du code PowerShell et des transferts de fichiers pour se développer.Les acteurs de la menace télécharge ensuite l'outil de gestion à distance NGROK pour faciliter le mouvement latéral et atteindre le contrôleur de domaine.Le groupe enregistre une DLL de filtre de mot de passe pour capturer les modifications de mot de passe et exfiltrant les informations d'identification cryptées via des serveurs d'échange gouvernementaux légitimes à l'aide d'un outil identifié comme Stealhook.Ils utilisent également une tâche planifiée exécutant un script nommé "U.PS1" pour persévérance et sont connus pour remplacer ce script par un script non fonctionnel pour entraver les efforts d'enquête. ## Recommandations Microsoft recommande les atténuations suivantes pour réduire l'impact de cette menace. - durcir les actifs orientés Internet et identifier et sécuriser les systèmes de périmètre que les attaquants pourraient utiliser pour accéder à votre réseau. - Allumez [Protection en livraison du cloud] (https://learn.microsoft.com/en-us/defender-endpoint/configure-lock-at-first-sight-microsoft-defender-antivirus) dans Microsoft Defender Antivirus ou leÉquivalent pour que votre produit antivirus couvre des outils et techniques d'attaquant en évolution rapide.Les protections d'apprentissage automatique basées sur le cloud bloquent une majorité de variantes nouvelles et inconnues. - Encouragez les utilisateurs à utiliser Microsoft Edge et d'autres navigateurs Web qui prennent en charge [SmartScreen] (https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx), qui identifie et bloque des sites Web malveillants, y compris des sites de phishing, des sites d'escroquerie et des sitesqui contiennent des exploits et hébergent des logiciels malveillants. ## Détections / requêtes de chasse ### Microsoft Defender pour le point de terminaison Les alertes avec les titres suivants dans le centre de sécurité peuvent indiquer une activité de menace sur votre réseau: - Activité de l'acteur de sable noisette détectée ## références [Earth Simnavaz (alias APT34) LEVIES CYBERATTADES AVANCÉES AVANT LES ÉMORS ET GULFERégions] (https://www.trendmicro.com/en_us/research/24/j/arth-simnavaz-cyberattacks-uae-gulf-regions.html).Trendmicro (consulté en 2024-10-11) [Hazel Sandstorm] (https://security.microsoft.com/intel-profiles/6cea89977cc2795bb1a80cad76f4de2ffff256ac3989e757c530047912450e2d).Microsoft (consulté en 2024-10-11) ## Copyright **&copie;Microsoft 2024 **.Tousdroits réservés.La reproduction ou la distribution du contenu de ce site, ou de toute partie de celle-ci, sans l'autorisation écrite de Microsoft est interdite.
#### Targeted Geolocations - United Arab Emirates ## Snapshot Researchers at Trend Micro have identif		 Malware Tool Vulnerability Threat Prediction APT 34 ★★★
Mandiant.webp 2024-09-19 14:00:00 UNC1860 et le temple de l'avoine: la main cachée d'Iran dans les réseaux du Moyen-Orient
UNC1860 and the Temple of Oats: Iran\\'s Hidden Hand in Middle Eastern Networks (lien direct)		 Written by: Stav Shulman, Matan Mimran, Sarah Bock, Mark Lechtik
Executive Summary UNC1860 is a persistent and opportunistic Iranian state-sponsored threat actor that is likely affiliated with Iran\'s Ministry of Intelligence and Security (MOIS). A key feature of UNC1860 is its collection of specialized tooling and passive backdoors that Mandiant believes supports several objectives, including its role as a probable initial access provider and its ability to gain persistent access to high-priority networks, such as those in the government and telecommunications space throughout the Middle East. UNC1860\'s tradecraft and targeting parallels with Shrouded Snooper, Scarred Manticore, and Storm-0861, Iran-based threat actors publicly reported to have targeted the telecommunications and government sectors in the Middle East. These groups have also reportedly provided initial access for destructive and disruptive operations that targeted Israel in late October 2023 with BABYWIPER and Albania in 2022 using ROADSWEEP. Mandiant cannot independently corroborate that UNC1860 was involved in providing initial access for these operations. However, we identified specialized UNC1860 tooling including GUI-operated malware controllers, which are likely designed to facilitate hand-off operations, further supporting the initial access role played by UNC1860. UNC1860 additionally maintains an arsenal of utilities and collection of “main-stage” passive backdoors designed to gain strong footholds into victim networks and establish persistent, long-term access. Among these main-stage backdoors includes a Windows kernel mode driver repurposed from a legitimate Iranian anti-virus software filter driver, reflecting the group\'s reverse engineering capabilities of Windows kernel components and detection evasion capabilities. These capabilities demonstrate that UNC1860 is a formidable threat actor that likely supports various objectives ranging from espionage to network attack operations. As tensions continue to ebb and flow in the Middle East, we belie		 Malware Tool Vulnerability Threat Cloud Technical APT 34 ★★★
RiskIQ.webp 2024-09-16 11:20:34 Faits saillants hebdomadaires, 16 septembre 2024
Weekly OSINT Highlights, 16 September 2024 (lien direct)		 ## Snapshot Last week\'s OSINT reporting highlighted a broad array of cyber threats, with ransomware activity and espionage campaigns prominently featured. Russian and Chinese APT groups were particularly in the spotlight, with Aqua Blizzard targeting Ukrainian military personnel and Twill Typhoon affecting governments in Southeast Asia. RansomHub, a ransomware-as-a-service (RaaS) variant, and the newly emerged Repellent Scorpius also exploited known vulnerabilities and abused legitimate tools, employing double extortion tactics. Emerging malware, including infostealers like YASS and BLX Stealer, underscores the growing trend of targeting sensitive consumer data and cryptocurrency wallets, demonstrating the adaptability of threat actors in an evolving digital landscape. ## Description 1. [TIDRONE Targets Taiwanese Military](https://sip.security.microsoft.com/intel-explorer/articles/14a1a551): Trend Micro reports that the Chinese-speaking threat group, TIDRONE, has targeted Taiwanese military organizations, particularly drone manufacturers, since early 2024. Using advanced malware (CXCLNT and CLNTEND), the group infiltrates systems through ERP software or remote desktops, engaging in espionage. 2. [Predator Spyware Resurfaces with New Infrastructure](https://sip.security.microsoft.com/intel-explorer/articles/b0990b13): Insikt Group reports that Predator spyware, often used by government entities, has resurfaced in countries like the Democratic Republic of the Congo and Angola. With upgraded infrastructure to evade detection, Predator targets high-profile individuals such as politicians and activists through one-click and zero-click attack vectors. 3. [Ransomware Affiliates Exploit SonicWall](https://sip.security.microsoft.com/intel-explorer/articles/07f23184): Akira ransomware affiliates exploited a critical SonicWall SonicOS vulnerability (CVE-2024-40766) to gain network access. Targeting firewalls, they bypassed security via local accounts, leading to breaches in organizations with disabled multifactor authentication. 4. [RansomHub Ransomware Threatens Critical Infrastructure](https://sip.security.microsoft.com/intel-explorer/articles/650541a8): RansomHub ransomware-as-a-service has attacked over 210 victims across critical infrastructure sectors since early 2024, using double extortion tactics. The group gains entry via phishing, CVE exploits, and password spraying, and exfiltrates data using tools like PuTTY and Amazon S3. 5. [YASS Infostealer Targets Sensitive Data](https://sip.security.microsoft.com/intel-explorer/articles/d056e554): Intezer discovered "Yet Another Silly Stealer" (YASS), a variant of CryptBot, deployed through a multi-stage downloader called “MustardSandwich.” YASS targets cryptocurrency wallets, browser extensions, and authentication apps, using obfuscation and encrypted communications to evade detection. 6. [WhatsUp Gold RCE Attacks](https://sip.security.microsoft.com/intel-explorer/articles/b89cbab7): Exploiting vulnerabilities in WhatsUp Gold (CVE-2024-6670, CVE-2024-6671), attackers executed PowerShell scripts via NmPoller.exe to deploy RATs like Atera Agent and Splashtop. These attacks highlight the risk of delayed patching and underscore the importance of monitoring vulnerable processes. 7. [Repellent Scorpius Expands RaaS Operations](https://sip.security.microsoft.com/intel-explorer/articles/1f424190): Unit 42 reports on the emerging ransomware group Repellent Scorpius, known for using Cicada3301 ransomware in double extortion attacks. The group recruits affiliates via Russian cybercrime forums and uses stolen credentials to execute attacks on various sectors globally. 8. [APT34\'s Advanced Malware Campaign](https://sip.security.microsoft.com/intel-explorer/articles/6289e51f): Check Point Research identified Iranian-linked APT34 targeting Iraqi government networks with sophisticated malware ("Veaty" and "Spearal"). Using DNS tunneling and backdoors, the group exploited email accounts for C2 communications, reflecting advanced espionage techniques. 9 Ransomware Malware Tool Vulnerability Threat Patching Prediction Cloud APT 34 ★★
RiskIQ.webp 2024-08-20 20:33:25 Aimez-vous les beignets;Voici un Donut Shellcode livré via PowerShell / Python
Do you Like Donuts; Here is a Donut Shellcode Delivered Through PowerShell/Python (lien direct)		 ## Instantané Des chercheurs de Sans Technology Institute ont identifié une nouvelle menace qui invoque un script PowerShell dans une chaîne d'attaque qui télécharge finalement Donut Shellcode.Le shellcode est capable d'injecter des charges utiles malveillantes dans des processus Windows arbitraires. ## Description L'attaque commence par un petit fichier .bat nommé 3650.bat, qui invoque initialement un script PowerShell pour télécharger et déballer une série d'archives zip.La recherche ne spécifie pas le mécanisme de livraison initial de ce fichier.Les archives ZIP contiennent un environnement Python complet avec les bibliothèques requises pour exécuter l'étape suivante.L'étape suivante consiste à télécharger et à exécuter un script Python obscurci.  Le script Python récupére et exécute finalement un shellcode final à partir de la mémoire, généré avec Donut, tentant de communiquer avec un serveur C2 à 160 \ [. \] 30 \ [. \] 21 \ [. \] 115: 7000. ### Analyse supplémentaire Le projet de beignet open-source permet la création d'un shellcode Shell-dépendant indépendant de la position capable de charger et d'exécuter des assemblages .NET à partir de la mémoire.En chargeant les charges utiles directement dans la mémoire, les acteurs de la menace [peuvent éviter la détection] (https://cloud.google.com/blog/topics/thereat-intelligence/staying-hidden-on-the-endpoint-evadeing-dection-with-shellcode) par logiciel antivirus traditionnel.  Des chercheurs en sécurité ont déjà rendu compte des groupes de menaces parrainés par l'État abusant du beignet.Par exemple, en octobre 2023, [Vérifier la recherche sur le point] (https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is- listening/) rapporté surLe groupe iranien marqué Manticore utilisant Shellcode généré en utilisant le projet Donut dans le cadre d'une campagne de cyber-espionnage ciblant les organisations de haut niveau au Moyen-Orient. ## Recommandations Microsoft recommande les atténuations suivantes pour réduire l'impact de cette menace.  - Comprendre et utiliser * ExecutionPolicy *: - La stratégie d'exécution de PowerShell \\ contrôle comment les scripts sont chargés et s'exécutent. - Définissez une politique d'exécution appropriée en fonction de vos besoins. - N'oubliez pas que la politique d'exécution n'est pas infaillible;il peut être contourné. - En savoir plus sur [les politiques d'exécution] (https://learn.microsoft.com/powershell/scripting/security/security-derutures?view=Powershell-7.4). - Activer et surveiller la journalisation PowerShell: - Activer la journalisation du bloc de script, la journalisation du module et la transcription. - Ces journaux fournissent une trace d'activité et aident à identifier les comportements malveillants. - Plongez plus profondément dans [PowerShell Security Fonctionnal] (https://learn.microsoft.com/powershell/scripting/security/security-deatures?view=powershell-7.4). - Mettre à jour régulièrement PowerShell: - Gardez votre environnement PowerShell à jour. - Les mises à jour incluent souvent des améliorations de sécurité et des correctifs pour les vulnérabilités connues. - En savoir plus sur [l'installation et la mise à jour de PowerShell sur Windows, Linux et MacOS] (https://learn.microsoft.com/powershell/scripting/install/installing-powershell?view=powershell-7.4). ## références [Aimez-vous les beignets;Voici un Donut Shellcode livré via PowerShell / Python] (https://isc.sans.edu/diary/rss/31182).Sans Technology Institute (consulté en 2024-08-19) [Utilisation malveillante de PowerShell] (https://sip.security.microsoft.com/intel-explorer/articles/3973dbaa).Microsoft (consulté en 2024-08-19) ## Copyright **&copie;Microsoft 2024 **.Tous droits réservés.La reproduction ou la distribution du contenu de ce site, ou de toute partie de celle-ci, sans l'autorisation écrite de Microsoft est in Vulnerability Threat Cloud APT 34 ★★★
Anomali.webp 2022-09-13 15:00:00 Anomali Cyber Watch: Iran-Albanian Cyber Conflict, Ransomware Adopts Intermittent Encryption, DLL Side-Loading Provides Variety to PlugX Infections, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: China, Cyberespionage, Defense evasion, DDoS, Iran, Ransomware, PlugX, and Spearphishing. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Microsoft Investigates Iranian Attacks Against the Albanian Government (published: September 8, 2022) Microsoft researchers discovered that groups working under Iran’s Ministry of Intelligence and Security (MOIS, tracked as OilRig) attacked the government of Albania. The attackers started with initial intrusion in May 2021, proceeded with mailbox exfiltrations between October 2021 and January 2022, organized controlled leaks, and culminated on July 15, 2022, with disruptive ransomware and wiper attacks. This attack is probably a response to the June 2021 Predatory Sparrow’s anti-Iranian cyber operations promoting the Mujahedin-e Khalq (MEK), an Iranian dissident group largely based in Albania. Analyst Comment: MOIS attack on Albania uses messaging and targeting similar to the previous MEK-associated attack on Iran. It tells us that Iran has chosen to engage in a form of direct and proportional retaliation as it sees it. Still, the attack and its attribution caused Albania to cut diplomatic ties with Iran and expel the country's embassy staff. Organizations should implement multifactor authentication (MFA) for mailbox access and remote connectivity. Anomali platform users advised to block known OilRig network indicators. MITRE ATT&CK: [MITRE ATT&CK] Exploit Public-Facing Application - T1190 | [MITRE ATT&CK] Data Encrypted for Impact - T1486 | [MITRE ATT&CK] Impair Defenses - T1562 | [MITRE ATT&CK] Indicator Removal on Host - T1070 Tags: OilRig, Helix Kitten, APT34, MOIS, Ministry of Intelligence and Security, Predatory Sparrow, Wiper, CVE-2021-26855, CVE-2019-0604, CVE-2022-28799, Government, Albania, target-country:AL, Iran, source-country:IR, DEV-0842, DEV-0861, DEV-0166, DEV-0133, Europium, APT, detection:Jason, detection:Mellona BRONZE PRESIDENT Targets Government Officials (published: September 8, 2022) Secureworks researchers detected a new campaign by China-sponsored group Mustang Panda (Bronze President). In June and July 2022, the group used spearphishing to deliver the PlugX malware to government officials in Europe, the Middle East, and South America. To bypass mail-scanning antiviruses, the archived email attachment had malware embedded eight levels deep in a sequence of hidden folders named with special characters. Analyst Comment: Many advanced attacks start with basic techniques such as unwarranted email with malicious attachment that requires the user to open it and enable macros. It is important to teach your users basic online hygiene and phishing awareness. MITRE ATT&CK: [MITRE ATT&CK] Phishing - T1566 | Ransomware Malware Tool Vulnerability Threat Guideline APT 27 APT 34
NoticeBored.webp 2022-08-06 10:46:21 CISO workshop slides (lien direct) A glossy, nicely-constructed and detailed PowerPoint slide deck by Microsoft Security caught my beady this morning. The title 'CISO Workshop: Security Program and Strategy' with 'Your Name Here' suggests it might be a template for use in a workshop/course bringing CISOs up to speed on the governance, strategic and architectural aspects of information security, but in fact given the amount of technical detail, it appears to be aimed at informing IT/technology managers about IT or cybersecurity, specifically. Maybe it is intended for newly-appointed CISOs or more junior managers who aspire to be CISOs, helping them clamber up the pyramid (slide 87 of 142): Malware Vulnerability Threat Patching Guideline Medical Cloud Uber APT 38 APT 37 APT 28 APT 19 APT 15 APT 10 APT 34 Guam
Anomali.webp 2022-05-17 15:01:00 Anomali Cyber Watch: Costa Rica in Ransomware Emergency, Charming Kitten Spy and Ransom, Saitama Backdoor Hides by Sleeping, and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Conti ransomware, India, Iran, Russia, Spearphishing, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence COBALT MIRAGE Conducts Ransomware Operations in U.S. (published: May 12, 2022) Secureworks researchers describe campaigns by Iran-sponsored group Cobalt Mirage. These actors are likely part of a larger group, Charming Kitten (Phosphorus, APT35, Cobalt Illusion). In 2022, Cobalt Mirage deployed BitLocker ransomware on a US charity systems, and exfiltrated data from a US local government network. Their ransomware operations appear to be a low-scale, hands-on approach with rare tactics such as sending a ransom note to a local printer. The group utilized its own custom binaries including a Fast Reverse Proxy client (FRPC) written in Go. It also relied on mass scanning for known vulnerabilities (ProxyShell, Log4Shell) and using commodity tools for encryption, internal scanning, and lateral movement. Analyst Comment: However small your government or NGO organization is, it still needs protection from advanced cyber actors. Keep your system updated, and employ mitigation strategies when updates for critical vulnerabilities are not available. MITRE ATT&CK: [MITRE ATT&CK] Exploit Public-Facing Application - T1190 | [MITRE ATT&CK] OS Credential Dumping - T1003 | [MITRE ATT&CK] Command and Scripting Interpreter - T1059 | [MITRE ATT&CK] Modify Registry - T1112 | [MITRE ATT&CK] Create Account - T1136 | [MITRE ATT&CK] Account Manipulation - T1098 | [MITRE ATT&CK] Proxy - T1090 | [MITRE ATT&CK] Data Encrypted for Impact - T1486 Tags: Cobalt Mirage, Phosphorous, Cobalt Illusion, TunnelVision, Impacket, wmiexec, Softperfect network scanner, LSASS, RDP, Powershell, BitLocker, Ransomware, Fast Reverse Proxy client, FRP, FRPC, Iran, source-country:IR, USA, target-country:US, Cyberespionage, Government, APT, Go, Log4j2, ProxyShell, CVE-2021-34473, CVE-2021-45046, CVE-2021-44228, CVE-2020-12812, CVE-2021-31207, CVE-2018-13379, CVE-2021-34523, CVE-2019-5591 SYK Crypter Distributing Malware Families Via Discord (published: May 12, 2022) Morphisec researchers discovered a new campaign abusing popular messaging platform Discord content distribution network (CDN). If a targeted user activates the phishing attachment, it starts the DNetLoader malware that reaches out to the hardcoded Discord CDN link and downloads a next stage crypter such as newly-discovered SYK crypter. SYK crypter is being loaded into memory where it decrypts its configuration and the next stage payload using hardcoded keys and various encryption methods. It detects and impairs antivirus solutions and checks for d Ransomware Malware Tool Vulnerability Threat Conference APT 35 APT 15 APT 34
Anomali.webp 2021-04-13 15:49:00 Anomali Cyber Watch: Android Malware, Government, Middle East and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, Cobalt Group, FIN6, NetWalker, OilRig, Rocke Group, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Iran’s APT34 Returns with an Updated Arsenal (published: April 8, 2021) Check Point Research discovered evidence of a new campaign by the Iranian threat group APT34. The threat group has been actively retooling and updating its payload arsenal to try and avoid detection. They have created several different malware variants whose ultimate purpose remained the same, to gain the initial foothold on the targeted device. Analyst Comment: Threat actors are always innovating new methods and update tools used to carry out attacks. Always practice Defense in Depth (do not rely on single security mechanisms - security measures should be layered, redundant, and failsafe). MITRE ATT&CK: [MITRE ATT&CK] Command-Line Interface - T1059 | [MITRE ATT&CK] Exploitation of Remote Services - T1210 | [MITRE ATT&CK] Spearphishing Attachment - T1193 | [MITRE ATT&CK] Custom Cryptographic Protocol - T1024 | [MITRE ATT&CK] Web Service - T1102 | [MITRE ATT&CK] Remote File Copy - T1105 | [MITRE ATT&CK] Scripting - T1064 Tags: OilRig, APT34, DNSpionage, Lab Dookhtegan, TONEDEAF, Dookhtegan, Karkoff, DNSpionage, Government, Middle East New Wormable Android Malware Spreads by Creating Auto-Replies to Messages in WhatsApp (published: April 7, 2021) Check Point Research recently discovered Android malware on Google Play hidden in a fake application that is capable of spreading itself via users’ WhatsApp messages. The malware is capable of automatically replying to victim’s incoming WhatsApp messages with a payload received from a command-and-control (C2) server. This unique method could have enabled threat actors to distribute phishing attacks, spread false information or steal credentials and data from users’ WhatsApp accounts, and more. Analyst Comment: Users’ personal mobile has many enterprise applications installed like Multifactor Authenticator, Email Client, etc which increases the risk for the enterprise even further. Users should be wary of download links or attachments that they receive via WhatsApp or other messaging apps, even when they appear to come from trusted contacts or messaging groups. The latest security patches should be installed for both applications and the operating system. Tags: Android, FlixOnline, WhatsApp Ransomware Malware Vulnerability Threat Guideline APT 34
Anomali.webp 2021-03-17 18:03:00 Anomali Cyber Watch: APT, Ransomware, Vulnerabilities and More (lien direct) The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: APT, AlientBot, Clast82, China, DearCry, RedXOR, and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity. Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Trending Cyber News and Threat Intelligence Google: This Spectre proof-of-concept shows how dangerous these attacks can be (published: March 15, 2021) Google has released a proof of concept (PoC) code to demonstrate the practicality of Spectre side-channel attacks against a browser's JavaScript engine to leak information from its memory. Spectre targeted the process in modern CPUs called speculative execution to leak secrets such as passwords from one site to another. While the PoC demonstrates the JavaScript Spectre attack against Chrome 88's V8 JavaScript engine on an Intel Core i7-6500U CPU on Linux, Google notes it can easily be tweaked for other CPUs, browser versions and operating systems. Analyst Comment: As the density of microchip manufacturing continues to increase, side-channel attacks are likely to be found across many architectures and are difficult (and in some cases impossible) to remediate in software. The PoC of the practicality of performing such an attack using javascript emphasises that developers of both software and hardware be aware of these types of attacks and the means by which they can be used to invalidate existing security controls. Tags: CVE-2017-5753 Threat Assessment: DearCry Ransomware (published: March 12, 2021) A new ransomware strain is being used by actors to attack unpatched Microsoft Exchange servers. Microsoft released patches for four vulnerabilities that are being exploited in the wild. The initial round of attacks included installation of web shells onto affected servers that could be used to infect additional computers. While the initial attack appears to have been done by sophisticated actors, the ease and publicity around these vulnerabilities has led to a diverse group of actors all attempting to compromise these servers. Analyst Comment: Patch and asset management are a critical and often under-resourced aspect of defense in depth. As this particular set of vulnerabilities and attacks are against locally hosted Exchange servers, organization may want to assess whether a hosted solution may make sense from a risk standpoint MITRE ATT&CK: [MITRE ATT&CK] Data Encrypted - T1022 | [MITRE ATT&CK] Exploit Public-Facing Application - T1190 | [MITRE ATT&CK] File and Directory Discovery - T1083 | [MITRE ATT&CK] Email Collection - T1114 | [MITRE ATT&CK] Obfuscated Files or Information - T1027 | [MITRE ATT&CK] System Service Discovery - T1007 | [MITRE ATT&CK] Data Encrypted for Impact - T1486 | Ransomware Tool Vulnerability Threat Guideline Wannacry APT 41 APT 34
Mandiant.webp 2017-12-07 17:00:00 Nouvelle attaque ciblée au Moyen-Orient par APT34, un groupe de menaces iranien présumé, en utilisant le CVE-2017-11882 Exploiter
New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit (lien direct)		 Moins d'une semaine après que Microsoft a publié un correctif pour CVE-2017-11882 Le 14 novembre 2017, Fireeye a observé un attaquant utilisant un exploit pour la vulnérabilité de Microsoft Office pour cibler une organisation gouvernementale au Moyen-Orient.Nous évaluons que cette activité a été réalisée par un groupe de menaces de cyber-espionnage iranien présumé, que nous appelons APT34, en utilisant une porte dérobée PowerShell personnalisée pour atteindre ses objectifs. Nous pensons que l'APT34 est impliqué dans une opération de cyber-espionnage à long terme largement axé sur les efforts de reconnaissance au profit des intérêts iraniens de l'État-nation et est opérationnel depuis
Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14, 2017, FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East. We assess this activity was carried out by a suspected Iranian cyber espionage threat group, whom we refer to as APT34, using a custom PowerShell backdoor to achieve its objectives. We believe APT34 is involved in a long-term cyber espionage operation largely focused on reconnaissance efforts to benefit Iranian nation-state interests and has been operational since at		 Vulnerability Threat APT 34 APT 34 ★★★★
Last update at: 2025-05-10 20:07:21
See our sources.
My email:

To see everything: Our RSS (filtrered) Twitter