SecureList

MAY 31, 2021

Further investigation of the Sunburst backdoor revealed several features that overlap with a previously identified backdoor known as Kazuar , a.NET backdoor first reported in 2017 and tentatively linked to the Turla APT group. The sample extracts a URL from the “downloadURL” field for the next download.

Malware 138

Malware Adware Encryption Architecture 138

Cisco Security

AUGUST 28, 2023

XDR (eXtended Detection and Response) Integrations At Black Hat USA 2023, Cisco Secure was the official Mobile Device Management, DNS (Domain Name Service) and Malware Analysis Provider. SCA detected 289 alerts including Suspected Port Abuse, Internal Port Scanner, New Unusual DNS Resolver,and Protocol Violation (Geographic).

Wireless 87

Wireless DNS Mobile Technology 87

Cisco Security

MAY 27, 2022

In addition to the Meraki networking gear, Cisco Secure also shipped two Umbrella DNS virtual appliances to Black Hat Asia, for internal network visibility with redundancy, in addition to providing: . Malware Threat Intelligence made easy and available, with Cisco Secure Malware Analytics and SecureX by Ben Greenbaum .

Malware 100

Malware Accountability DNS Technology 100

Security Boulevard

JUNE 15, 2023

Prior to this date, in 2021, the domain was registered and hosted by a previous owner, with DNS resolution observed through October of 2021. After the new DNS registration by the Grand persona, the domain was initially live via authoritative DNS in regway.com on 2023-10-08, and then migrated to Cloudflare DNS on 2023-10-11.

Cryptocurrency 52

Cryptocurrency Password Management Malware DNS 52

ForAllSecure

MARCH 24, 2020

or-later Section: utils Architecture: x86_64 Installed-Size: 11797 Filename: attr_2.4.48-2_x86_64.ipk It looks like the bug was introduced in February 2017, almost three years ago: [link]. The modification to /etc/hosts is required to emulate a man-in-the-middle (or compromised DNS) situation. Exploitation. Remediation.

DNS 59

DNS Software Architecture Accountability 59

ForAllSecure

MARCH 24, 2020

or-later Section: utils Architecture: x86_64 Installed-Size: 11797 Filename: attr_2.4.48-2_x86_64.ipk It looks like the bug was introduced in February 2017, almost three years ago: [link]. The modification to /etc/hosts is required to emulate a man-in-the-middle (or compromised DNS) situation. Exploitation. Remediation.

DNS 52

DNS Software Architecture Accountability 52

ForAllSecure

MARCH 25, 2020

or-later Section: utils Architecture: x86_64 Installed-Size: 11797 Filename: attr_2.4.48-2_x86_64.ipk It looks like the bug was introduced in February 2017, almost three years ago: [link]. The modification to /etc/hosts is required to emulate a man-in-the-middle (or compromised DNS) situation. Exploitation. Remediation.

DNS 52

DNS Software Architecture Accountability 52

Fox IT

JUNE 23, 2020

Evil Corp were previously associated to the Dridex malware and BitPaymer ransomware, the latter came to prominence in the first half of 2017. Hence, TA505 activity is sometimes still reported as Evil Corp activity, even though these groups have not worked together since the second half of 2017. CobaltStrike C&C Domains.

Ransomware 44

Ransomware Encryption Malware Architecture 44

SecureList

APRIL 27, 2022

While we were unable to obtain the same results by analyzing the CERT-UA samples, we subsequently identified a different WhiteBlackCrypt sample matching the WhisperKill architecture and sharing similar code. On February 23, ESET published a tweet announcing new wiper malware targeting Ukraine.

Malware 145

Malware Firmware Government Phishing 145