SecureList

DECEMBER 1, 2023

To exfiltrate data and deliver next-stage malware, the attackers abuse cloud-based data storage, such as Dropbox or Yandex Disk, as well as a temporary file sharing service. libssl.dll or libcurl.dll was statically linked to implants to implement encrypted C2 communications. org domain did not occur in all cases.

Malware 98

Malware Ransomware Encryption Energy and Utilities 98

Security Affairs

MAY 23, 2023

In the latest campaign uncovered by Kaspersky, the APT group, used a modular framework dubbed CloudWizard that supports spyware capabilities, including taking screenshots, microphone recording, harvesting Gmail inboxes, and keylogging. Since 2017, there have been no traces of Groundbait and BugDrop operations.

Malware 73

Malware Spyware Encryption Phishing 73

Security Affairs

APRIL 5, 2019

A few days ago, the researchers of ZLab Yoroi-Cybaze dissected another attack wave of the infamous Ursnif malware, also known as Gozi ISFB , an offspring of the original Gozi which source code was leaked in 2014. Ursnif/Gozi is active from over a decade and was one of the most active malware listed in 2017 and 2018.

Banking 82

Banking Malware Cryptocurrency Advertising 82

SecureList

NOVEMBER 1, 2022

Since the malware in this incident was compiled on April 15, 2021, and compilation dates are the same for all known samples, this incident is likely to be the first involving Maui ransomware. This report included technical details of malware used in the campaign, such as Ecipekac, SodaMaster, P8RAT, FYAnti and QuasarRAT.

Malware 142

Malware Ransomware Spyware Encryption 142

Security Affairs

APRIL 28, 2020

The malware was an info stealer and according to the researchers, it was part of a long-term campaign, tracked as “PhantomLance” that has been active at least since December 2015. We informed Google of the malware, and it was removed from the market shortly after.” ” reads the analysis published by Kaspersky.

Malware 104

Malware Advertising Spyware Marketing 104

SecureList

AUGUST 30, 2023

Both infection methods resulted in the same malware (the DeathNote downloader), which uploaded the target’s information and retrieved the next-stage payload at the discretion of the C2 (Command and Control) server. It’s thought that the malware was spread through a vulnerability in the software.

Malware 78

Malware Spyware Cryptocurrency Government 78

SiteLock

AUGUST 27, 2021

Cyberattacks are often caused by malware, which is the umbrella term used to describe software created for malicious purposes. You may be most familiar with computer malware such as Trojan viruses and spyware, which can be used to retrieve sensitive data from a computer or even take control of the system. Ransomware.

Small Business 98

Small Business DDOS Malware Phishing 98

SecureList

NOVEMBER 18, 2022

Rootkits are malware implants that are installed deep in the operating system. However, on one of the infected machines, we found malware that we think is probably related to CosmicStrand. This malware creates a user named “aaaabbbb” in the operating system with local administrator rights.

Malware 105

Malware Computers and Electronics Adware Cryptocurrency 105

Security Affairs

JUNE 18, 2020

The group was first spotted by ESET in 2018, when the experts detected a sophisticated piece of spyware, tracked as InvisiMole, used in targeted attacks in Russia and Ukraine in the previous five years. The attack chain begins with the deployment of a TCP downloader that fetches the next stage payload.

DNS 76

DNS Advertising Spyware Software 76

The Last Watchdog

MAY 2, 2019

Last February, Dallas-based email encryption vendor Zix Corp. Gill Today, very sophisticated tools are out there for anyone to use and are being incorporated into a wider variety of malware families. AppRiver has been tracking Eternal Blue showing up regularly in malware samples targeting SMBs.

Risk 182

Risk Cyber Risk Cyber threats Banking 182

SecureList

JULY 27, 2023

The most remarkable findings Early in June, we issued an early warning of a long-standing campaign that we track under the name Operation Triangulation , involving a previously unknown iOS malware platform distributed via zero-click iMessage exploits. Kaspersky employees were also affected by this threat.

Malware 88

Malware Government Phishing Social Engineering 88

SecureList

APRIL 27, 2021

In our initial report on Sunburst , we examined the method used by the malware to communicate with its C2 (command-and-control) server and the protocol used to upgrade victims for further exploitation. This campaign made use of a previously unknown malware family we dubbed FourteenHi. webshells and Exaramel implants.

Malware 142

Malware Spyware Government Social Engineering 142

Herjavec Group

AUGUST 26, 2021

After being released in 2003, he uses WiFi to commit attacks, program malware and steal credit card information. 2008 — Heartland Payment Systems — 134 million credit cards are exposed through SQL injection to install spyware on Heartland’s data systems. 2017 — Equifax — Equifax, one of the largest U.S.

Cybercrime 135

Cybercrime Computers and Electronics Banking Hacking 135

SecureList

FEBRUARY 15, 2021

Agentb malware family. In most cases, scammers, as before, claimed to have used spyware to film the blackmail victim watching adult videos. Theft of work accounts and infecting of office computers with malware in targeted attacks are the main risk that companies have faced this year. Malware families. per cent).

Phishing 139

Phishing Malware Scams Accountability 139

SecureList

AUGUST 5, 2021

In addition to various cloud-related emails, we blocked messages disguised as business correspondence and containing links to malware. By following it, the recipient risks not only handing over their personal data to the attackers, but also downloading malware to their computer or phone. Malware families.

Phishing 118

Phishing Banking Scams Computers and Electronics 118

Security Affairs

JANUARY 10, 2021

The Cyber-attack resulted in a large volume of data to be encrypted including database servers and backup data. In December 2020, Symrise AG confirmed that they were the target of Clop Ransomware attack, when 500GB of their data from over 1000 infected devices was encrypted by cyber criminals.

Cyber Attacks 84

Cyber Attacks Government Surveillance Software 84

SecureList

MAY 3, 2021

In actual fact, scanning the code resulted in a data leak, money theft or device infection, if it contained a link to a web page with malware. Behind the link was a C&C server that was accessed by malware (various ransomware, including Trojan-Banker.Win32.Danabot). Malware families.

Phishing 109

Phishing Banking Accountability Computers and Electronics 109