article thumbnail

Dissecting the malicious arsenal of the Makop ransomware gang

Security Affairs

Cyber security researcher Luca Mella analyzed the Makop ransomware employed in a recent intrusion. Executive summary Insights from a recent intrusion authored by Makop ransomware operators show persistence capability through dedicated.NET tools. Everything is freeware software maintained by Voidtools.

article thumbnail

Stolen Nvidia certificates used to sign malware—here’s what to do

Malwarebytes

As we wrote on March 3, 2022 Nvidia, was recently attacked by the LAPSUS$ ransomware group. As is often the case in ransomware attacks, the exfiltrated data was published on a leak site. The two leaked Nvidia certificates have expired, being valid from 2011 to 2014 and 2015 to 2018.

Malware 101
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Exclusive: Lighting the Exfiltration Infrastructure of a LockBit Affiliate (and more)

Security Affairs

Our investigation revealed that this remote endpoint is associated with criminal activities dating back to 2019, indicating that these hosts were likely under the control of the same technical administration. Introduction Digging into ransomware infections always provides valuable insights.

Scams 130
article thumbnail

Updates from the MaaS: new threats delivered through NullMixer

Security Affairs

The Originating Malvertising Campaign According to CTI investigation on the adversary infrastructure, we were able to identify an ongoing campaign luring system administrators to install the malicious code into their machines. He is a former member of the ANeSeC CTF team, one of the firsts Italian cyber wargame teams born back in 2011.

Malware 91