Security Affairs

FEBRUARY 10, 2021

Antivirus firm Emsisoft discloses a data breach, a third-party had access to a publicly exposed database containing technical logs. The anti-malware solutions provider Emsisoft disclosed last week a data breach. If you want to receive the weekly Security Affairs Newsletter for free subscribe here. Pierluigi Paganini.

Malware 119

Malware Data breaches Antivirus Passwords 119

Security Affairs

JUNE 11, 2021

Experts spotted a new mysterious malware that was used to collect a huge amount of data, including sensitive files, credentials, and cookies. Threat actors used custom malware to steal data from 3.2 NordLocker experts speculate the malware campaign leveraged tainted Adobe Photoshop versions, pirated games, and Windows cracking tools.

Malware 109

Malware Computers and Electronics Software Financial Services 109

Security Affairs

AUGUST 21, 2022

Threat actors compromise WordPress sites to display fake Cloudflare DDoS protection pages to distribute malware. Recently security experts from Sucuri, spotted JavaScript injections targeting WordPress sites to display fake DDoS Protection pages which lead victims to download remote access trojan malware. Pierluigi Paganini.

DDOS 90

DDOS Malware Antivirus Firewall 90

Security Affairs

DECEMBER 18, 2023

Info stealers, the type of malware with its purpose in the name, can cripple businesses and everyday users alike. Info stealers, also known as information stealers, are a type of malicious software (malware) designed to covertly collect sensitive and personal information from a victim’s computer or network.

Banking 111

Banking Cybercrime Malware Accountability 111

Security Affairs

FEBRUARY 14, 2020

The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) released reports on North Korea-linked HIDDEN COBRA malware. The FBI, the US Cyber Command, and the Department of Homeland Security have published technical details of a new North-Korea linked hacking operation.

Malware 113

Malware Passwords Advertising Antivirus 113

Security Affairs

AUGUST 4, 2020

China-linked hackers carried out cyber espionage campaigns targeting governments, corporations, and think tanks with TAIDOOR malware. “CISA encourages users and administrators to review Malware Analysis Report MAR-10292089-1.v1 “CISA encourages users and administrators to review Malware Analysis Report MAR-10292089-1.v1

Malware 105

Malware Government Passwords System Administration 105

Security Affairs

JULY 28, 2022

Microsoft linked a private-sector offensive actor (PSOA) to attacks using multiple zero-day exploits for its Subzero malware. Microsoft states that multiple news reports have linked the company to the Subzero malware toolset used to hack a broad range of devices, phones, computers, and network and internet-connected devices.

Surveillance 88

Surveillance Malware Authentication DNS 88

Security Affairs

SEPTEMBER 22, 2020

US Cybersecurity and Infrastructure Security Agency (CISA) is warning of a notable increase in the use of LokiBot malware by threat actors since July 2020. The Agency’s EINSTEIN Intrusion Detection System has detected persistent malicious activity associated with the LokiBot malware. Enforce a strong password policy.

Malware 64

Malware Passwords Advertising Antivirus 64

The Last Watchdog

JANUARY 28, 2019

And the malware that subsequently gets installed continues to get more stealthy and capable with each advancing iteration. Researchers recently flushed out a new variety of the Xbash family of malware tuned to seek out administrators’ rights and take control of Linux servers. Use a password manager.

Passwords 196

Passwords Password Management Antivirus Internet 196

SecureList

MAY 28, 2024

But along with the advantages, such as saved time and resources, delegating non-core tasks creates new challenges in terms of information security. Access is set up using a certificate or a login/password pair, and in rare cases multi-factor authentication is added. Rounding out the top three is targeted phishing.

VPN 75

VPN Accountability Passwords Antivirus 75

Malwarebytes

AUGUST 3, 2022

The used lure is in Russian is called “ Information security memo ” which provide security practices for passwords, confidential information, etc. The threat actor has left some debugging information including a pdb path from which we derived and picked a name for this new Rat: Debug Information.

Malware 112

Malware Encryption Antivirus Architecture 112

Security Affairs

MAY 16, 2021

Hackers abuses Microsoft Build Engine (MSBuild) to filelessly deliver malware on targeted Windows systems, including RAT and password-stealer. ” reads a report published by Anomali. . ” Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini. SecurityAffairs – hacking, MSBuild).

Antivirus 114

Antivirus Malware Engineering Software 114

Security Affairs

JULY 8, 2022

The security firm states that the AstraLocker decryptor works for ransomware versions based on the Babuk malware that appends the.Astra or.babyk extensions to the name of the encrypted files. “Be sure to quarantine the malware from your system first, or it may repeatedly lock your system or encrypt files.

Ransomware 119

Ransomware Encryption Malware Accountability 119

Security Affairs

DECEMBER 19, 2022

The main reasons to rewrite malware in Rust is to have lower AV detection rates, compared to malware written in most common languages, and to target multiple architectures. ” Upon executing the malware, the Rust binary prompts an error requiring a password to be passed as an argument. Pierluigi Paganini.

Ransomware 121

Ransomware Encryption Healthcare Education 121

Security Affairs

APRIL 25, 2022

The BlackCat/ALPHV a Ransomware was first discovered in December by malware researchers from Recorded Future and MalwareHunterTeam. The malware is the first professional ransomware strain that was written in the Rust programming language. Regularly back up data, air gap, and password-protect backup copies offline.

Ransomware 101

Ransomware Antivirus Passwords Malware 101

Security Affairs

MARCH 29, 2023

Researchers discovered malware-laced installers for the TOR browser that is spreading clipper malware in Russia and Eastern Europe. Kaspersky researchers discovered a Trojanized version of the Tor Browser that is spreading a clipper malware in Russia and Eastern Europe. A password-protected RAR archive (random password).

Malware 84

Malware Passwords Cryptocurrency Antivirus 84

CyberSecurity Insiders

NOVEMBER 25, 2021

So it’s important to teach all your employees that have access to the network how to identify possible security threats and train them to use cyber security best practices. Create a cyber security policy and make sure that all employees know that information security is a priority. Install Anti-malware Software.

Computers and Electronics 120

Computers and Electronics Cyber Attacks Data breaches Passwords 120

Daniel Miessler

MAY 8, 2020

There are security/hacker types that maintain massive repositories of passwords. Change all default passwords to something unique and strong. Most home networks get broken into through either phishing or some random device they have with a bad password. blocks just malware, and 1.1.1.3 Which is most people.

Passwords 255

Passwords DNS Accountability IoT 255

Security Affairs

MARCH 19, 2022

“As a result, AvosLocker indicators of compromise (IOCs) vary between indicators specific to AvosLocker malware and indicators specific to the individual affiliate responsible for the intrusion.” Regularly back up data, password protect backup copies offline. Avoid reusing passwords for multiple accounts.

Ransomware 95

Ransomware DDOS Passwords Backups 95

Security Affairs

JUNE 22, 2021

Experts defined DirtyMoe as a complex malware that has been designed as a modular system. The operations behind the DirtyMoe botnet rapidly changed since the end of 2020, when the malware authors added a worm module that could increase their activity by spread via the internet to other Windows systems. ” continues the report.

DNS 125

DNS Cryptocurrency Internet Internet 125

Security Affairs

APRIL 29, 2023

A new variant of the information-stealing malware ViperSoftX implements sophisticated techniques to avoid detection. Trend Micro researchers observed a new ViperSoftX malware campaign that unlike previous attacks relies on DLL sideloading for its arrival and execution technique. c2 arrowlchat[.]com ” concludes the report.

Encryption 85

Encryption Malware Cryptocurrency Software 85

SecureList

APRIL 24, 2023

It is worth noting that while we identified a few targets in other locations, all of them appear to be foreign diplomatic entities of the colored countries: Tomiris’s polyglot toolset Tomiris uses a wide variety of malware implants developed at a rapid pace and in all programming languages imaginable.

Malware 96

Malware DNS Government Software 96

Security Affairs

APRIL 9, 2020

Group-IB’s CERT-GIB analyzed hundreds of coronavirus -related phishing emails and discovered top malware strains in COVID-19 campaigns. Spyware turned out to be the most common malware class hiding in fraudulent COVID-19 emails, with AgentTesla topping the list of phishers’ favorite strains. SecurityAffairs – malware, Coronavirus).

Phishing 102

Phishing Malware Spyware DDOS 102

Security Affairs

AUGUST 28, 2022

Twilio hackers also breached the food delivery firm DoorDash Unprecedented cyber attack hit State Infrastructure of Montenegro Threat actor abuses Genshin Impact Anti-Cheat driver to disable antivirus Critical flaw impacts Atlassian Bitbucket Server and Data Center Iran-linked Mercury APT exploited Log4Shell in SysAid Apps for initial access GoldDragon (..)

DDOS 70

DDOS Data breaches Malware Antivirus 70

Malwarebytes

AUGUST 3, 2022

The used lure is in Russian is called " Information security memo " which provide security practices for passwords, confidential information, etc. The threat actor has left some debugging information including a pdb path from which we derived and picked a name for this new Rat: Debug Information.

Malware 66

Malware Encryption Antivirus Architecture 66

Security Affairs

OCTOBER 17, 2023

If your friend or colleague is suddenly asking you for money or to change your password, call them on the phone and ask if they really sent the message. Use a strong password and store it correctly: Strong passwords consist of a combination of uppercase and lowercase letters, numbers, and special symbols such as punctuation.

Social Engineering 108

Social Engineering Ransomware Engineering Phishing 108

Cytelligence

FEBRUARY 25, 2023

Phishing: Phishing is a type of social engineering attack where cybercriminals trick people into giving away sensitive information such as usernames, passwords, and credit card details. Ransomware: Ransomware is a type of malware that encrypts data on a victim’s computer and demands payment in exchange for the decryption key.

Cyber Attacks 52

Cyber Attacks IoT Authentication Antivirus 52

Security Affairs

MAY 22, 2021

The threat actors employed two previosuly undetected piece of malware dubbed Mail-O and Webdav-O. “Webdav-O is another malware that has never been described before. The malware supports two authentication methods: basic (with login and password) and oauth (with using a token).”

Computers and Electronics 108

Computers and Electronics Malware Antivirus Government 108

Security Affairs

MAY 2, 2021

WeSteal is a Python-based malware that uses regular expressions to search for strings related to wallet addresses that victims have copied to their clipboard. “When pursuing cases against malware authors, prosecutors typically need to demonstrate the author’s intent for the malware. There is the name of the malware itself.

Cryptocurrency 105

Cryptocurrency Malware Advertising System Administration 105

eSecurity Planet

DECEMBER 3, 2021

Here are the top Twitter accounts to follow for the latest commentary, research, and much-needed humor in the ever-evolving information security space. Brian Krebs is an independent investigative reporter known for his coverage of technology, malware , data breaches , and cybercrime developments. Brian Krebs | @briankrebs.

Accountability 139

Accountability Cybersecurity Penetration Testing InfoSec 139

Security Affairs

NOVEMBER 19, 2019

To bypass antivirus systems, hackers send out malicious emails in non-working hours with delayed activation. The first half of 2019 saw a 10-fold increase in the number of password-protected objects, such as documents and archive files, being used to deliver malware. Another trend was disguising malware in emails.

Ransomware 69

Ransomware Antivirus Malware Banking 69

Security Affairs

OCTOBER 6, 2020

In the middle-August, the malware was employed in fresh COVID19-themed spam campaign. Recent spam campaigns used messages with malicious Word documents, or links to them, pretending to be an invoice, shipping information, COVID-19 information , resumes, financial documents, or scanned documents.

Government 132

Government Banking Advertising Malware 132

Security Affairs

MARCH 18, 2023

ransomware is a modular malware that is more evasive than its previous versions, its shared similarities with Blackmatter and Blackcat ransomware. ransomware, then a password argument is mandatory during the execution of the ransomware.” It also supports a Safe Mode feature to bypass endpoint antivirus and detection.

Ransomware 79

Ransomware Penetration Testing Encryption Accountability 79

Security Affairs

JULY 9, 2020

More than 15 billion username and passwords are available on cybercrime marketplaces, including over 5 billion unique credentials, states the experts. According to the company, most of the username and password combinations are available for free, and 5 billion of the above credentials are “unique.”

Cybercrime 116

Cybercrime Antivirus Marketing Accountability 116

eSecurity Planet

JUNE 7, 2022

From keeping tabs on your enterprise devices, data, and apps to securing those endpoints against threats and attacks, Desktop Central ticks all the boxes of a unified endpoint management solution. It also includes advanced features such as SAML-based single sign-on (SSO) and the company's security architecture has never been hacked.

Cybersecurity 124

Cybersecurity Identity Theft Encryption Antivirus 124

Security Affairs

MAY 19, 2023

The Lemon Group cybercrime ring has reportedly pre-installed malware known as Guerilla on almost 9 million Android devices. A cybercrime group tracked has Lemon Group has reportedly pre-installed malware known as Guerilla on almost 9 million Android devices. 231 banking malware.

Mobile 85

Mobile Advertising Malware Cybercrime 85

Security Affairs

AUGUST 9, 2022

The Portdoor backdoor implements multiple functionalities, including the ability to do reconnaissance, target profiling, delivery of additional payloads, privilege escalation, process manipulation static detection antivirus evasion, one-byte XOR encryption, AES-encrypted data exfiltration.

Encryption 94

Encryption Antivirus Malware Hacking 94