article thumbnail

XDSpy APT remained undetected since at least 2011

Security Affairs

Researchers from ESET uncovered the activity of a new APT group, tracked as XDSpy, that has been active since at least 2011. XDSpy is the name used by ESET researchers to track a nation-state actor that has been active since at least 2011. ” reads the abstract from the talk. ” concludes the report.

Malware 135
article thumbnail

Sandboxing: Advanced Malware Analysis in 2021

eSecurity Planet

To fill this gap and aid in the analysis, detection, and testing of malware, sandboxing is widely used to give organizations the setting, isolation, and security tools needed to preserve the integrity of the host network. In 2021, sandboxes are now a fundamental part of an organization’s cybersecurity architecture. Sandbox Features.

Malware 57
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

DePriMon downloader uses a never seen installation technique

Security Affairs

The new DePriMon downloader was used by the Lambert APT group, aka Longhorn, to deploy malware. According to a report published by Symantec in 2017, Longhorn is a North American hacking group that has been active since at least 2011. We believe DePriMon is the first example of malware using this technique ever publicly described.”

Malware 103
article thumbnail

Chinese APT Tropic Trooper target air-gapped military Networks in Asia

Security Affairs

The Tropic Trooper APT that has been active at least since 2011, it was first spotted in 2015 by security experts at Trend Micro when it targeted government ministries and heavy industries in Taiwan and the military in the Philippines. ” reads the analysis published by Trend Micro. ” continues the report.

article thumbnail

Unknown FinSpy Mac and Linux versions found in Egypt

Security Affairs

Since 2011 it was employed in attacks aimed at Human Rights Defenders (HRDs) in many countries, including Bahrain, Ethiopia, UAE, and more. It extracts the binary for the relevant architecture in /tmp/udev2 and executes it. Below the infection chain for the FinSpy for Linux, descrived by the researchers. ” continues the analysis.

Spyware 138
article thumbnail

NUVOLA: the new Cloud Security tool

Security Affairs

Still, with common configuration issues and other vulnerabilities becoming commonplace in AWS architecture, it’s important to understand how bad actors could exploit our environments by understanding the most common AWS privilege escalations used. Cloud Security Context. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

article thumbnail

Top 9 Network Access Control (NAC) Solutions

eSecurity Planet

Impluse SafeConnect offers automatic device discovery and can support anywhere from 250 to 25,000 endpoints and up with its scalable appliance architecture. It offers a rule-based architecture to automate access based on use cases. Aruba ClearPass may also be known as Avenda eTIPS after HPE acquired Avenda and its NAC solution in 2011.

Education 127