Security Affairs

DECEMBER 4, 2021

The Hancitor downloader has been active since at least 2016 for dropping Pony and Vawtrak. Upon installing the ransomware, it downloads two executable files, which include the password stealer “pones.exe” and “krots.exe,” (aka) KPOT, which allows threat actors to write to the compromised system’s temporary (TMP) file.

Ransomware 135

Ransomware Hacking Malware Encryption 135

Security Affairs

SEPTEMBER 22, 2021

. “ “This permits an attacker to gain full control of device with an unrestricted root shell, which is far more access than even the owner of the device has as they are restricted to a limited “protected shell” (psh) which filters input to a predefined set of limited, mostly informational commands.” Pierluigi Paganini.

Hacking 109

Hacking Firmware IoT Internet 109

Security Affairs

MAY 13, 2024

” To defend against ransomware campaign like this one, NJCCIC provided the following recommendations: Security Awareness Training : Engage in security awareness training to enhance defense mechanisms and recognize potential signs of malicious communications.

Phishing 107

Phishing Ransomware Security Awareness Authentication 107

Security Affairs

DECEMBER 24, 2020

91541, 91534 CVE-2014-1812 05/13/2014 Microsoft Windows Group Policy Preferences Password Elevation of Privilege Vulnerability (KB2962486) 9 91148, 90951 CVE-2020-0688 02/11/2020 Microsoft Exchange Server Security Update for February 2020 8.8 If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Hacking 113

Hacking Cyber Attacks Passwords Software 113

Security Affairs

DECEMBER 25, 2023

The APT33 group has been around since at least 2013, since mid-2016, the group targeted the aviation industry and energy companies with connections to petrochemical production. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, APT33) South Korea, and Europe.

Passwords 122

Passwords Accountability Authentication Malware 122

Security Affairs

AUGUST 23, 2022

“This permits an attacker to gain full control of device with an unrestricted root shell, which is far more access than even the owner of the device has as they are restricted to a limited “protected shell” (psh) which filters input to a predefined set of limited, mostly informational commands.”. SecurityAffairs – hacking, Hikvision).

Hacking 112

Hacking Firmware Internet Internet 112

Security Affairs

MARCH 8, 2024

The Midnight Blizzard group (aka APT29 , SVR group , Cozy Bear , Nobelium , BlueBravo , and The Dukes ) along with APT28 cyber espionage group was involved in the Democratic National Committee hack and the wave of attacks aimed at the 2016 US Presidential Elections.

Passwords 94

Passwords Accountability Hacking Cybersecurity 94

Security Affairs

JULY 11, 2020

A jury found Russian hacker Yevgeniy Nikulin guilty for the hack of LinkedIn, Dropbox, and Formspring back in 2012 and for the sale of the stolen data on cybercrime black marketplaces. The Russian criminal was arrested in Prague in October 2016 in an international joint operation with the FBI. SecurityAffairs – hacking, cybercrime).

Hacking 76

Hacking Cybercrime Data breaches Advertising 76

Security Affairs

JUNE 17, 2020

A CIA elite hacking unit that developed cyber-weapons failed in protecting its operations, states an internal report on the Vault 7 data leak. In March, Joshua Schulte , a former CIA software engineer that was accused of stealing the agency’s hacking tools and leaking them to WikiLeaks, was convicted of only minor charges.

Hacking 112

Hacking Engineering Data breaches Advertising 112

Security Affairs

DECEMBER 29, 2023

On Christmas Eve, Resecurity’s HUNTER unit spotted the author of perspective password stealer Meduza has released a new version (2.2). Presently, Meduza password stealer supports Windows Server 2012/2016/2019/2022 and Windows 10/11.

Password Management 122

Password Management Cryptocurrency Passwords Authentication 122

Security Affairs

MAY 25, 2020

Some of the databases are dated as 2016, but data starts from March 28, 2020. Most of the listed databases are from online stores in Germany, others e-store hacked by threat actors are from Brazil, the U.S., The hacked stores were running Shopware, JTL-Shop, PrestaShop, OpenCart, Magento v1 and v2 e-commerce CMSs.

Hacking 87

Hacking Advertising Authentication Passwords 87

Security Affairs

JANUARY 26, 2024

The Seoul High Court Criminal Division 20 (Chief Judge Jeong Seon-jae Baek Suk-jong Lee Jun-hyun) charged Mr. A for being a developer for the TrickBot gang since 2016. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, Trickbot)

Malware 95

Malware Identity Theft Banking Ransomware 95

Security Affairs

DECEMBER 16, 2022

The exposed data include email addresses, password hashes, client IDs, IP addresses, and tokens for business API users, authentication tokens for connected accounts, and non-personal and internal data was compromised. The good news is that passwords are hashed using the BCrypt, a hashing algorithm that is considered robust.

Data breaches 91

Data breaches Passwords Media Phishing 91

Security Affairs

OCTOBER 20, 2021

China-linked cyberespionage group LightBasin hacked mobile telephone networks around the world and used specialized tools to access calling records. The cyberespionage group has been active since at least 2016, according to the CrowdStrike researchers it is using a very sophisticated toolset. huawei) for the initial compromise.

Telecommunications 112

Telecommunications Mobile Hacking Architecture 112

Security Affairs

JULY 15, 2021

SonicWall also provides recommendations to customers that can’t update their installs, the vendor suggests disconnecting devices immediately and reset their access passwords, and enable account multi-factor authentication, if supported. Continued use of this firmware or end-of-life devices is an active security risk,” states the alert.

Firmware 108

Firmware Ransomware Passwords Mobile 108

Security Affairs

SEPTEMBER 15, 2023

The man listed the credentials of more than 35,000 compromised computers for sale and according to the investigators, he obtained more than $350,000 in illicit proceeds between 2016 and 2019. The powerful malware was capable of compromising protected computers by decrypting login credentials, such as passwords.

Malware 92

Malware Marketing Passwords Hacking 92

SiteLock

AUGUST 27, 2021

In each of these cases, the cybercriminals behind the breaches were after usernames and passwords. The most commonly used passwords today are, “password” and “123456,” and it only takes a hacker.29 In May 2016, a massive set of data was stolen from Myspace to what’s said to be one of the largest breaches in history.

Data breaches 52

Data breaches Media Passwords Accountability 52

Security Affairs

JANUARY 26, 2024

The Midnight Blizzard group (aka APT29 , SVR group , Cozy Bear , Nobelium , BlueBravo , and The Dukes ) along with APT28 cyber espionage group was involved in the Democratic National Committee hack and the wave of attacks aimed at the 2016 US Presidential Elections.

Hacking 89

Hacking Cybersecurity Marketing Authentication 89

Security Affairs

NOVEMBER 10, 2022

APT29 along with APT28 cyber espionage group was involved in the Democratic National Committee hack and the wave of attacks aimed at the 2016 US Presidential Elections. “The queried LDAP attributes relate to usual credential information gathering (e.g. SecurityAffairs – hacking, APT29). Pierluigi Paganini.

Passwords 107

Passwords Hacking Accountability Encryption 107

eSecurity Planet

DECEMBER 3, 2021

Here are the top Twitter accounts to follow for the latest commentary, research, and much-needed humor in the ever-evolving information security space. Security enthusiast and Linux evangelist Binni Shah consistently offers valuable tutorials, guides, and insights for the cybersecurity community. Street @jaysonstreet.

Accountability 139

Accountability Cybersecurity Penetration Testing InfoSec 139

Security Affairs

MARCH 17, 2022

TrickBot is a popular Windows banking Trojan that has been around since October 2016, its authors have continuously upgraded it by implementing new features, including powerful password-stealing capabilities. SecurityAffairs – hacking, RouterOS Scanner). Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

Malware 118

Malware DNS Passwords Ransomware 118

Security Affairs

AUGUST 6, 2019

The STRONTIUM APT group (aka APT28 , Fancy Bear , Pawn Storm , Sofacy Group , and Sednit ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. The group was involved also in the string of attacks that targeted 2016 Presidential election. Pierluigi Paganini.

IoT 74

IoT Hacking Advertising Government 74

Security Affairs

APRIL 18, 2020

The news was reported by ZDNet, the stolen data were published on a well-known hacking forum. “The leaked information, which ZDNet obtained a copy with the help of data breach monitoring service Under the Breach, contains information on users who registered or used the Aptoide app store app between July 21, 2016, and January 28, 2018.”

Data breaches 110

Data breaches Advertising Mobile Hacking 110

Security Affairs

SEPTEMBER 13, 2021

While WhatsApp has already implemented end-to-end encrypion since 2016, the company still stores backups in the cloud unencrypted. WhatsApp will use a unique, randomly generated encryption key to encrypt the backup, user can choose to secure the key manually or with a user password. SecurityAffairs – hacking, E2EE).

Backups 79

Backups Encryption Passwords Accountability 79

Security Affairs

APRIL 12, 2022

These contained information for millions of credit cards, bank account numbers and routing information, and the usernames and associated passwords needed to access online accounts.” ” According to Europol, the joint effort and intense information sharing were the key to the success of Operation TOURNIQUET.

Cybercrime 140

Cybercrime Banking Accountability Hacking 140

Security Affairs

FEBRUARY 23, 2023

The powerful malware was capable of compromising protected computers by decrypting login credentials, such as passwords.” The man listed the credentials of more than 35,000 compromised computers for sale and according to the investigators, he obtained more than $350,000 in illicit proceeds between 2016 and 2019.

Malware 75

Malware Marketing Passwords Hacking 75

Security Affairs

DECEMBER 22, 2022

Experts observed the bot attempting to gain access to the device by using a combination of eight common usernames and 130 passwords for IoT devices over SSH and telnet on ports 23 and 2323. Adopt a comprehensive IoT security solution. SecurityAffairs – hacking, botnet). ” reads the analysis published by Microsoft.

IoT 113

IoT DDOS Malware Firmware 113

Security Affairs

MAY 2, 2022

IoT devices can spy on people, steal data, or bring down vast swathes of the internet, as happened in 2016 when Mirai malware infiltrated devices such as baby monitors and refrigerators and locked them into a botnet for the Dyn cyberattack. SecurityAffairs – hacking, IoT). appeared first on Security Affairs. Pierluigi Paganini.

IoT 126

IoT Cybersecurity VPN Internet 126

Security Affairs

DECEMBER 5, 2023

The group was involved also in the string of attacks that targeted 2016 Presidential election. It allows an attacker to provide covert, unauthorized access to email correspondence and was used after gaining access to email accounts through CVE-2023-23397 (Microsoft Outlook Vulnerability) or password-spraying.”

Accountability 101

Accountability Government Phishing Authentication 101

Security Affairs

OCTOBER 21, 2021

These emails persuade employees to reveal passwords for important applications or download malicious files to their devices. Using stolen passwords is an easy way to masquerade as a genuine user and access sensitive information or infiltrate deeper into your network. SecurityAffairs – hacking, attack vectors).

IoT 116

IoT Phishing Passwords Scams 116

Security Affairs

AUGUST 13, 2020

The group has been linked to several major cyber attacks, including the 2014 Sony Pictures hack , several SWIFT banking attacks since 2016, and the 2017 WannaCry ransomware infection. In September, the US Treasury placed sanctions on three North Korea-linked hacking groups, the Lazarus Group, Bluenoroff, and Andarial.

Cyber Attacks 118

Cyber Attacks Manufacturing Hacking Advertising 118

Security Affairs

OCTOBER 7, 2019

The StreetEasy data breach took place in the mid-2016 and exposed 988k records that included names, usernames, email addresses and SHA-1 password hashes. “In approximately June 2016, the real estate website StreetEasy suffered a data breach. 87% of addresses were already in @haveibeenpwned.

Data breaches 67

Data breaches Passwords Advertising Cybercrime 67

Security Affairs

JULY 26, 2021

Microsoft published mitigations for the recently discovered PetitPotam attack that allows attackers to force remote Windows machines to share their password hashes. The NTLM authentication hash can be used to carry out a relay attack or can be lately cracked to obtain the victim’s password. SecurityAffairs – hacking, SolarWinds).

Authentication 117

Authentication Passwords Encryption Hacking 117

Security Affairs

MARCH 26, 2021

Mamba was first spotted on September 2016 when experts at Morphus Labs discovered the infection of machines belonging to an energy company in Brazil with subsidiaries in the United States and India. Regularly, change passwords to network systems and accounts, and avoid reusing passwords for different accounts.

Ransomware 144

Ransomware Encryption Passwords Malware 144

Security Affairs

DECEMBER 30, 2022

Newspaper Theme on WordPress Access Control (vulnerability CVE-2016-10972). The researchers noticed that both trojan variants contain unimplemented functionality for hacking the administrator accounts of WordPress websites through a brute-force attack using special dictionaries. SecurityAffairs – hacking, Lunix Malware).

Malware 82

Malware Hacking Accountability Phishing 82

Security Affairs

MARCH 7, 2022

Kellerman explained that the flaw is similar to CVE-2016-5195 , aka Dirty Cow, and is more dangerous because it is easier to exploit. BleepingComputer reported a tweet published by the security researcher Phith0n who explained that it is possible to use the exploit to modify the /etc/passwd file to set the root user without a password.

Passwords 91

Passwords Hacking Accountability Information Security 91

Security Affairs

SEPTEMBER 11, 2023

TrickBot is a popular Windows banking Trojan that has been around since October 2016, its authors have continuously upgraded it by implementing new features, including powerful password-stealing capabilities. .” reads the announcement made by the U.S. Department of the Treasury.

Cybercrime 94

Cybercrime Government Ransomware Banking 94