Security Affairs

APRIL 21, 2024

A joint advisory published by CISA, the FBI, Europol, and the Netherlands’ National Cyber Security Centre (NCSC-NL) revealed that since early 2023, Akira ransomware operators received $42 million in ransom payments from more than 250 victims worldwide. It was this first time that the operators adopted this tactic.

Ransomware 101

Ransomware Encryption Antivirus VPN 101

Security Affairs

APRIL 17, 2022

The botnet targets multiple architectures, including arm, bsd, x64, and x86. The researchers attribute the botnet to the cybercrime group Keksec which focuses on DDoS-based extortion. Then the script downloads the actual Enemybot binary which is compiled for the target device’s architecture. To nominate, please visit:?

DDOS 132

DDOS Architecture Malware Cybercrime 132

Security Affairs

OCTOBER 17, 2022

There will be no architectural, performance improvements, or feature additions. Security patches are limited to one roll-up per year.” Let’s remember that it is very important to keep VMware ESXi servers up to date, numerous cybercrime and ransomware gangs (i.e. SecurityAffairs – hacking, VMware).

Architecture 94

Architecture Cybercrime Software Internet 94

Security Affairs

JULY 25, 2022

The malware is available for sale in illegal forums, in the past, it was used by cybercrime gangs like TA505 to install GandCrab ransomware or the FlawedAmmyy RAT. Then the malware contacts the C2 and sends system information (i.e. SecurityAffairs – hacking, malware). ” Follow me on Twitter: @securityaffairs and Facebook.

Software 115

Software Malware Cybercrime VPN 115

Security Affairs

FEBRUARY 27, 2024

The modular architecture of the IDAT loader allows it to easily add new features. Follow me on Twitter: @securityaffairs and Facebook Pierluigi Paganini ( SecurityAffairs – hacking, cyberattack) The loader already supports code injection and execution modules, distinguishing it from conventional loaders.

Malware 93

Malware Architecture Phishing Hacking 93

Security Affairs

FEBRUARY 10, 2024

The malware impersonates a Visual Studio update and was designed to support Intel and Arm architectures. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, backdoor) RustDoor is written in Rust language and supports multiple features. ” concludes the report.

Ransomware 116

Ransomware Architecture Malware Passwords 116

Security Affairs

JULY 14, 2023

Lumen Black Lotus Labs uncovered a long-running hacking campaign targeting SOHO routers with a strain of malware dubbed AVrecon. The experts discovered that the malicious code had been compiled for different architectures. The AVrecon malware was written in C to ensure portability and designed to target ARM-embedded devices.

Malware 80

Malware Advertising Cybercrime Passwords 80

Security Affairs

DECEMBER 4, 2023

Researchers at Cado Security Labs discovered a new variant of the P2Pinfect botnet that targets routers, IoT devices, and other embedded devices. This variant has been compiled for the Microprocessor without Interlocked Pipelined Stages (MIPS) architecture. ” The new bot targets devices embedded with 32-bit MIPS processor. .

IoT 94

IoT Architecture Malware Hacking 94

Security Affairs

MAY 9, 2022

Researchers warn of a remote access trojan called DCRat (aka DarkCrystal RAT) that is available for sale on Russian cybercrime forums. Cybersecurity researchers from BlackBerry are warning of a remote access trojan called DCRat (aka DarkCrystal RAT) that is available for sale on Russian cybercrime forums. To nominate, please visit:?

Cybercrime 86

Cybercrime Malware Surveillance DDOS 86

Security Affairs

AUGUST 20, 2022

SecurityAffairs – hacking, newsletter). The post Security Affairs newsletter Round 380 appeared first on Security Affairs. If you want to also receive for free the newsletter with the international press subscribe here. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

DDOS 74

DDOS Architecture Malware Cybercrime 74

Security Affairs

MAY 30, 2024

” The plugins for the macOS version are different from those for other platforms, reflecting the architecture of the target systems. Pierluigi Paganini Follow me on Twitter: @securityaffairs and Facebook and Mastodon ( SecurityAffairs – hacking, malware)

Spyware 84

Spyware Malware Surveillance Mobile 84

Security Affairs

AUGUST 28, 2023

KmsdBot supports multiple architectures, including as Winx86, Arm64, and mips64, x86_64, and does not stay persistent to avoid detection. Since mid-July 2023, the binary observed in the attacks includes support for telnet scanning and support for more CPU architectures.

IoT 88

IoT DDOS Architecture Internet 88

Security Affairs

AUGUST 25, 2022

We utilize an industry standard Zero Knowledge architecture that ensures LastPass can never know or gain access to our customers’ Master Password. SecurityAffairs – hacking, data breach). The post LastPass data breach: threat actors stole a portion of source code appeared first on Security Affairs. Pierluigi Paganini.

Data breaches 130

Data breaches Password Management Passwords Architecture 130

Security Affairs

SEPTEMBER 30, 2023

The FBI’s PIN provides recommendations to network defenders for being prepared to respond to cyber incidents, optimizing identity and access management, implementing protective controls and architecture, and enhancing vulnerability and configuration management.

Ransomware 113

Ransomware Architecture Encryption Malware 113

CyberSecurity Insiders

FEBRUARY 2, 2022

Ambitious information security experts serve as a critical part of cyber risk management. The corporation is responsible for structuring IT and information security activities to protect its data resources, such as hardware, software, and procedures. This blog was written by an independent guest blogger. Risk assessment.

Cyber Risk 99

Cyber Risk Risk Architecture Identity Theft 99

Security Affairs

NOVEMBER 9, 2021

Threat actors also scan the web for ports 2375, 2376, 2377, 4243, 4244, and attempt to gather server info such as the OS type, container registry, architecture, number of CPU cores, and the current swarm participation status. SecurityAffairs – hacking, Dockers). Experts noticed that the IP address 45[.]9[.]148[.]182

Cryptocurrency 97

Cryptocurrency Malware Cybercrime Architecture 97

Security Affairs

MAY 19, 2023

The Lemon Group cybercrime ring has reportedly pre-installed malware known as Guerilla on almost 9 million Android devices. A cybercrime group tracked has Lemon Group has reportedly pre-installed malware known as Guerilla on almost 9 million Android devices.

Mobile 85

Mobile Advertising Malware Cybercrime 85

Security Affairs

OCTOBER 30, 2020

The Netlogon service is an Authentication Mechanism used in the Windows Client Authentication Architecture which verifies logon requests, and it registers, authenticates, and locates Domain Controllers. The IT giant urged Windows administrators to install the released security updates as soon as possible. Pierluigi Paganini.

Authentication 129

Authentication Advertising Architecture Cybercrime 129

Security Affairs

SEPTEMBER 29, 2022

Researchers from Black Lotus Labs at Lumen Technologies, recently uncovered a multifunctional Go-based malware that was developed to target devices based on multiple architectures, including Windows and Linux. SecurityAffairs – hacking, Chaos malware). ” concludes the report. Pierluigi Paganini.

Malware 83

Malware DDOS Architecture Financial Services 83

Security Affairs

DECEMBER 7, 2022

Zerobot targets multiple architectures, including i386, amd64, arm, arm64, mips, mips64, mips64le, mipsle, ppc64, ppc64le, riscv64, and s390x. SecurityAffairs – hacking, Zerobot). The post New Go-based botnet Zerobot exploits dozens of flaws appeared first on Security Affairs. The bot is saved using the filename “zero.”.

IoT 98

IoT Architecture Internet Internet 98

Security Affairs

OCTOBER 8, 2023

The most interesting characteristic of the Triada Trojan apart is its modular architecture, which gives it theoretically a wide range of abilities. Triada was designed with the specific intent to implement financial frauds, typically hijacking the financial SMS transactions. ” concludes the report.

Firmware 142

Firmware Mobile Malware Retail 142

SC Magazine

MAY 17, 2021

Robbins and Jimmy Sanders, head of information security at Netflix, both noted during the RSA Conference the degree of change in security driven by the pandemic. If cybercrime were a country, Robbins said, the $6 trillion dollar a year industry would have the third highest GDP in the world after the U.S.

Architecture 54

Architecture Cybercrime Information Security Mobile 54

Security Affairs

MARCH 13, 2023

The botnet targets x86, x64 and ARM processor architectures, experts noticed that it relies on an internet relay chat (IRC) bot on the victim server to communicate with the attacker’s server. “Once a host is found, GoBruteforcer tries to get access to the server via brute force.

Passwords 97

Passwords Malware Architecture Authentication 97

Security Affairs

SEPTEMBER 1, 2023

SapphireStealer is an open-source information stealer written in.NET, which is available in multiple public malware repositories since its public release in December 2022. SapphireStealer allows operators to gather system data (i.e. The malware is also able to siphon files stored with specific extensions and take screenshots.

Malware 100

Malware Data collection Architecture Hacking 100

Security Affairs

MAY 9, 2023

” The variant analyzed by the researchers targets multiple architectures, including arm, m68k, mips, mpsl, sh4, spc, and x86. . “Users should be aware of this new threat and actively apply patches on affected devices as soon as they become available.”

DDOS 96

DDOS Wireless Architecture Advertising 96

Security Affairs

DECEMBER 6, 2022

“This sample demonstrates how a ransomware’s weak architecture and programming can quickly turn it into a wiper that does not allow data recovery. SecurityAffairs – hacking, cryptonite ransomware toolkit). The post Ransomware Toolkit Cryptonite turning into an accidental wiper appeared first on Security Affairs.

Ransomware 121

Ransomware Encryption Malware Architecture 121

Security Affairs

APRIL 16, 2023

BleepingComputer confirmed that the zip archive contained “previously unknown encryptors for macOS, ARM, FreeBSD, MIPS, and SPARC” architectures. The experts pointed out that the archive has been bundled as March 20, 2023, it also includes builds for PowerPC CPUs, which are used in older macOS systems.

Encryption 96

Encryption Architecture Ransomware Education 96

Security Affairs

MAY 30, 2022

The botnet targets multiple architectures, including arm, bsd, x64, and x86. The researchers attribute the botnet to the cybercrime group Keksec which focuses on DDoS-based extortion. Please vote for Security Affairs and Pierluigi Paganini in every category that includes them (e.g. SecurityAffairs – hacking, EnemyBot).

Malware 140

Malware DDOS IoT Cybercrime 140

Security Affairs

OCTOBER 22, 2020

The Netlogon service is an Authentication Mechanism used in the Windows Client Authentication Architecture which verifies logon requests, and it registers, authenticates, and locates Domain Controllers. SecurityAffairs – hacking, QNap). The CVE-2020-1472 flaw is an elevation of privilege that resides in the Netlogon.

Authentication 80

Authentication Advertising Architecture Cybercrime 80

Security Affairs

NOVEMBER 4, 2023

. “He further clarifies that the exploit is grounded in the exploitation methodology detailed in the Qualys writeup, asserting its compatibility with x86(_64) and aarch64 architectures, and highlighting its potential for extension through the addition of new target offsets. The script is accessible for review here.

Architecture 95

Architecture Cryptocurrency Hacking Cybercrime 95

Security Affairs

JULY 31, 2023

Replication allows instances of Redis to be run in a distributed architecture, aka leader/follower topology. This variant exploiting the replication feature to compromises exposed instances of the Redis data store. ” The report includes Indicators of Compromise (IoCs) and Yara rules for binary detection.

Malware 92

Malware Architecture Firewall Passwords 92

Security Affairs

FEBRUARY 9, 2020

According to security experts at Fox-IT, the ransomware attack is compatible with other attacks carried out by the TA505 cybercrime gang. TA505 hacking group has been active since 2014 focusing on Retail and banking sectors. “It is a decision that was not taken lightly by the Executive Board.

Ransomware 105

Ransomware Cyber Attacks Architecture Backups 105

Security Affairs

OCTOBER 12, 2020

The Netlogon service is an Authentication Mechanism used in the Windows Client Authentication Architecture which verifies logon requests, and it registers, authenticates, and locates Domain Controllers. SecurityAffairs – hacking, Zerologon). The CVE-2020-1472 flaw is an elevation of privilege that resides in the Netlogon.

VPN 138

VPN Government Authentication Advertising 138

SecureList

MAY 11, 2023

Security researchers discovered an archive that contained test builds of the malware for a number of less common platforms, including macOS and FreeBSD, as well as for various non-standard processor architectures, such as MIPS and SPARC. As for the second trend, we saw that BlackCat adjusted their TTPs midway through the year.

Ransomware 121

Ransomware Malware Architecture Telecommunications 121

Security Affairs

JULY 31, 2023

The experts discovered that the malicious code had been compiled for different architectures. On infected a router, the malware enumerates the victim’s SOHO router and sends that information back to a C2 server whose address is embedded in the code. Usually, these users have no idea their systems are compromised.”

Malware 89

Malware Small Business Advertising Passwords 89

Security Affairs

DECEMBER 1, 2022

“The first use of the command is activated to receive information about the CPU architecture. SecurityAffairs – hacking, Redis). The post New Go-based Redigo malware targets Redis servers appeared first on Security Affairs. ” reads the analysis published by AquaSec. Pierluigi Paganini.

Malware 141

Malware DDOS Architecture Cryptocurrency 141

Security Affairs

NOVEMBER 14, 2022

Akamai Security Research discovered a new evasive Golang-based malware, tracked as KmsdBot, that infects systems via an SSH connection that uses weak login credentials. KmsdBot supports multiple architectures, including as Winx86, Arm64, and mips64, x86_64, and does not stay persistent to avoid detection. ” Pierluigi Paganini.

DDOS 90

DDOS Malware Cryptocurrency Architecture 90