2014, Architecture and DNS - Cyber Security Informer

Godlua backdoor, the first malware that abuses the DNS over HTTPS (DoH)

Security Affairs

JULY 4, 2019

The peculiarity of this new piece of malware is the ability to communicate with C2 servers via DNS over HTTPS ( DoH ). The DoH protocol was a new standard proposed in October 2018 and it is currently supported by several publicly available DNS servers. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

DNS

DNS Malware Advertising DDOS

Massive increase in XorDDoS Linux malware in last six months

Malwarebytes

MAY 25, 2022

XorDDoS, a Linux Trojan known for its modularity and stealth, was first discovered in 2014 by the white hat research group, MalwareMustDie (MMD). The only simple (yet effective) tactic it uses is to brute force its way to gain root access to various Linux architectures. MMD believed the Linux Trojan originated in China.

Malware

Malware IoT DDOS DNS

Trend Micro observed notable malware activity associated with the Momentum Botnet

Security Affairs

DECEMBER 18, 2019

The Momentum bot targets various Linux platforms running upon multiple CPU architectures, including ARM, MIPS, Intel, and Motorola 68020. ” Momentum supports 36 different methods for DDoS attacks, including multiple reflection and amplifications attack methods that target MEMCACHE , LDAP , DNS and Valve Source Engine.

Malware

Malware DDOS Advertising DNS

Chalubo, a new IoT botnet emerges in the threat landscape

Security Affairs

OCTOBER 23, 2018

The IoT malware ran only on systems with an x86 architecture. The most important novelty is represented by the discovery of a variety of bot versions, designed to target different architectures, including 32-bit and 64-bit ARM, x86, x86_64, MIPS, MIPSEL, and PowerPC. Pierluigi Paganini. Securi ty Affairs – Chalubo, IoT botnet).

IoT

IoT DDOS Malware Architecture

Winnti Group was planning a devastating supply-chain attack against Asian manufacturer

Security Affairs

OCTOBER 14, 2019

The PortReuse backdoor has a modular architecture, experts discovered that its components are separate processes that communicate through named pipes. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Manufacturing

Manufacturing Mobile Malware Software

Iranian Charming Kitten APT used a new BellaCiao malware in recent wave of attacks

Security Affairs

APRIL 27, 2023

Iran-linked Charming Kitten group, (aka APT35 , Phosphorus , Newscaster , and Ajax Security Team) made the headlines in 2014 when experts at iSight issued a report describing the most elaborate net-based spying campaign organized by Iranian hackers using social media. Europe, the Middle East and India. Israel, Iraq, and Saudi Arabia.

Malware

Malware DNS Media Architecture

Winnti APT group uses skip-2.0 malware to control Microsoft SQL Servers

Security Affairs

OCTOBER 21, 2019

The PortReuse backdoor has a modular architecture, experts discovered that its components are separate processes that communicate through named pipes. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Malware

Malware Passwords Advertising DNS

Analyzing a Danabot Paylaod that is targeting Italy

Security Affairs

DECEMBER 20, 2018

exe process according to the architecture of the compromised host. Every DNS call from victim computer to internet, matching with the list of banking sites hard-coded in the malware, will be modified; the malware adds in the original page a piece of javascript to steal sensible information such as username, password and session cookie.

Banking

Banking Malware Internet Internet

Unveiling JsOutProx: A New Enterprise Grade Implant

Security Affairs

DECEMBER 20, 2019

For this reason, we decided to dig into this piece of malware and figure out its inner secrets, uncovering a modular architecture with advanced offensive capabilities, such as the presence of functionalities able to deal with multi-factor authentication (MFA). The “Dns” Plugin. The DnsPlugin handles the machine’s DNS configuration.

Malware

Malware DNS Architecture Advertising

New Linux/DDosMan threat emerged from an evolution of the older Elknot

Security Affairs

APRIL 1, 2019

2014), as described on the MMD blog when MMD detected 5 variants active under almost 15 panels scattered in China network. They are not aiming servers with x32 or x64 architecture but the router devices that runs on Linux too.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. On the MMD blog.

DDOS

DDOS Malware Encryption Penetration Testing

Group-IB presents its annual report on global threats to stability in cyberspace

Security Affairs

NOVEMBER 29, 2019

The past months have shown that the most dangerous hacks involved DNS hijacking, which helped attackers manipulate DNS records for MITM attacks. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Banking

Banking Telecommunications Marketing Internet

Best Network Monitoring Tools for 2022

eSecurity Planet

JANUARY 26, 2022

Founded in 2010 by veteran SaaS and DevOps industry leaders, Datadog specializes in optimizing the service-oriented architecture, helping organizations monitor user journeys and explore service relationships. The youngest of companies picked for this year’s list, Kentik has been a budding networking monitoring vendor since 2014.

Marketing

Marketing DDOS Threat Detection DNS

Iranian Threat Actors: Preliminary Analysis

Security Affairs

JANUARY 15, 2020

If so we are facing a state-sponsored group with high capabilities in developing persistence and hidden communication channels (for example over DNS) but without a deep interest in exploiting services. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Cleaver TTP. Pierluigi Paganini.

Computers and Electronics

Computers and Electronics Penetration Testing Malware Government

Trickbot module descriptions

SecureList

OCTOBER 19, 2021

Trickbot (aka TrickLoader or Trickster), is a successor of the Dyre banking Trojan that was active from 2014 to 2016 and performed man-in-the-browser attacks in order to steal banking credentials. It retrieves the DNS names of all the directory trees in the local computer’s forest. Trickbot was first discovered in October 2016.

Banking

Banking Passwords Internet Internet

WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group

Fox IT

JUNE 23, 2020

Evil Corp has been operating the Dridex malware since July 2014 and provided access to several groups and individual threat actors. However, a bug is included in the architecture identification code. The ransomware authors use a well-known method to identify the operating system architecture. CobaltStrike C&C Domains.

Ransomware

Ransomware Encryption Malware Architecture

Security Ledger Podcast: Security Automation Is (And Isn't) The Future Of InfoSec

ForAllSecure

OCTOBER 9, 2019

So in 2014, the Defense Advanced Research Project Agency, DARPA, the people who really funded the original internet said, "Can we make cyber fully autonomous?" For example, they may think, "Hey, the user's going to give me an input and it's only going to be as long as maybe a DNS record." but they never actually checked that.

InfoSec

InfoSec Artificial Intelligence Computers and Electronics Software

Security Ledger Podcast: Security Automation Is (And Isn't) The Future Of InfoSec

ForAllSecure

OCTOBER 9, 2019

So in 2014, the Defense Advanced Research Project Agency, DARPA, the people who really funded the original internet said, "Can we make cyber fully autonomous?" For example, they may think, "Hey, the user's going to give me an input and it's only going to be as long as maybe a DNS record." but they never actually checked that.

InfoSec

InfoSec Artificial Intelligence Computers and Electronics Software

SECURITY LEDGER PODCAST: SECURITY AUTOMATION IS (AND ISN'T) THE FUTURE OF INFOSEC

ForAllSecure

OCTOBER 9, 2019

So in 2014, the Defense Advanced Research Project Agency, DARPA, the people who really funded the original internet said, "Can we make cyber fully autonomous?" For example, they may think, "Hey, the user's going to give me an input and it's only going to be as long as maybe a DNS record." but they never actually checked that.

InfoSec

InfoSec Artificial Intelligence Computers and Electronics Software

Key Takeaway from the Colonial Pipeline Attack

Cisco Security

MAY 24, 2021

Average fuel prices rose to their highest since 2014 and President Joe Biden declared a state of emergency to allow additional transport of fuel by road to alleviate shortages. Enforce security at the DNS layer. Cisco has designed a reference architecture that will help you phase your project. OT and IT networks have converged.

Firewall

Firewall IoT DNS Cyber Attacks

Cyber Security Informer

Godlua backdoor, the first malware that abuses the DNS over HTTPS (DoH)

Massive increase in XorDDoS Linux malware in last six months

Trending Sources

Trend Micro observed notable malware activity associated with the Momentum Botnet

Chalubo, a new IoT botnet emerges in the threat landscape

Winnti Group was planning a devastating supply-chain attack against Asian manufacturer

Iranian Charming Kitten APT used a new BellaCiao malware in recent wave of attacks

Winnti APT group uses skip-2.0 malware to control Microsoft SQL Servers

Analyzing a Danabot Paylaod that is targeting Italy

Unveiling JsOutProx: A New Enterprise Grade Implant

New Linux/DDosMan threat emerged from an evolution of the older Elknot

Group-IB presents its annual report on global threats to stability in cyberspace

Best Network Monitoring Tools for 2022

Iranian Threat Actors: Preliminary Analysis

Trickbot module descriptions

WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group

Security Ledger Podcast: Security Automation Is (And Isn't) The Future Of InfoSec

Security Ledger Podcast: Security Automation Is (And Isn't) The Future Of InfoSec

SECURITY LEDGER PODCAST: SECURITY AUTOMATION IS (AND ISN'T) THE FUTURE OF INFOSEC

Key Takeaway from the Colonial Pipeline Attack

Stay Connected