Security Affairs

OCTOBER 31, 2022

In the early afternoon of Friday 12 May 2017, the media broke the news of a global computer security attack carried out through a malicious code capable of encrypting data residing in information systems and demanding a ransom in cryptocurrency to restore them, the Wannacry ransomware. The infection chain.

Malware 96

Malware Computers and Electronics Encryption Ransomware 96

Security Affairs

SEPTEMBER 21, 2022

Russia-linked APT group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. Russia-linked cyberespionage group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. ” reads the report published by Recorded Future.

Malware 81

Malware Telecommunications DNS Hacking 81

Security Affairs

OCTOBER 3, 2021

TA544 is a financially motivated threat actor that is active at least since 2017, it focuses on attacks on banking users, it leverages banking malware and other payloads to target organizations worldwide, mainly in Italy and Japan. Upon enabling the macro, the infection process will start. Pierluigi Paganini.

Malware 82

Malware Banking Social Engineering Retail 82

Security Affairs

JULY 9, 2019

The malware samples shared by USCYBERCOM last week were first detected in December 2016 in attacks attributed to Iran-linked APT33. Last week the United States Cyber Command (USCYBERCOM) uploaded to VirusTotal a malware used by Iran-linked APT33 group in attacks in Dec 2016 and Jan 2017. ” reads the report.

Malware 73

Malware InfoSec Advertising Government 73

Security Affairs

NOVEMBER 24, 2023

North Korea-linked Konni APT group used Russian-language Microsoft Word documents to deliver malware. FortiGuard Labs researchers observed the North Korea-linked Konni APT group using a weaponized Russian-language Word document in an ongoing phishing campaign. ” concludes the report.

Encryption 105

Encryption Malware Phishing Hacking 105

Security Affairs

JANUARY 6, 2022

North Korea-linked APT group Konni targets Russian Federation’s Ministry of Foreign Affairs (MID) new versions of malware implants. Security researchers at Cluster25 uncovered a recent campaign carried out by the North Korea-linked Konni APT group aimed at Russian diplomatic entities that used new versions of malware implants.

Phishing 132

Phishing Malware Hacking Accountability 132

Security Affairs

APRIL 30, 2021

The state-sponsored hackers sent spear-phishing messages to a general director working at the Rubin Design Bureau , in Saint Petersburg, which is one of three main Russian centers of submarine design. The spear-phishing messages used a malicious Rich Text File (RTF) document that included descriptions of an autonomous underwater vehicle.

Phishing 129

Phishing Malware Antivirus Encryption 129

Security Affairs

APRIL 20, 2023

The researchers from Google TAG are warning of Russia-linked threat actors targeting Ukraine with phishing campaigns. Russia-linked threat actors launched large-volume phishing campaigns against hundreds of users in Ukraine to gather intelligence and aimed at spreading disinformation, states Google’s Threat Analysis Group (TAG).

Phishing 86

Phishing Education Accountability Telecommunications 86

Security Affairs

NOVEMBER 28, 2021

North Korea-linked threat actors posed as Samsung recruiters in a spear-phishing campaign aimed at employees at South Korean security firms. According to the Google Threat Horizons report, the state-sponsored hackers sent fake job offers to employees at the security companies. . ” reads the Google Threat Horizons report.

Malware 123

Malware Phishing Antivirus Hacking 123

Security Affairs

MAY 19, 2022

A previously unknown Chinese cyberespionage group, tracked as ‘Space Pirates’, targets enterprises in the Russian aerospace industry with spear-phishing attacks. The group has been active since at least 2017, researchers believe it is linked with other China-linked APT groups, including APT41 (Winnti), Mustang Panda , and APT27.

Malware 126

Malware Phishing Government Hacking 126

Security Affairs

AUGUST 9, 2022

The threat actors launched spear-phishing campaigns against the victims, in some cases, the messages contained information related to the victims which were not publicly available. The emails used weaponized Microsoft Word documents exploiting the CVE-2017-11882 vulnerability.

Encryption 96

Encryption Antivirus Malware Hacking 96

Security Affairs

JULY 6, 2023

A new variant of the Truebot malware was used in attacks against organizations in the United States and Canada. ALERT: Increased #Truebot malware activity targets U.S. & The attackers use the malware to escalate privileges and maintain persistence on the compromised systems. & Canada organizations.

Malware 83

Malware Cyber threats Phishing Hacking 83

Security Affairs

APRIL 30, 2023

CERT-UA warns of a spear-phishing campaign conducted by APT28 group targeting Ukrainian government bodies with fake ‘Windows Update’ guides. Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks.

System Administration 90

System Administration Government Phishing Malware 90

SC Magazine

MARCH 15, 2021

The school districts of Rockford, Illinois and Rockingham County, North Carolina learned some very valuable lessons in transparency and communication, timely incident response, access management, data redundancy and disaster recovery after each experienced a debilitating malware attack years ago. It appears the training has been effective.

Malware 78

Malware Backups Education Ransomware 78

Security Affairs

APRIL 19, 2023

Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks. According to the joint report, APT28 exploited the known vulnerability to carry out reconnaissance and reploy malware on unpatched Cisco routers. government institutions, and about 250 Ukrainian victims. ” reads the joint advisory.

Malware 84

Malware Firmware Government Education 84

Security Affairs

JULY 8, 2023

Iran-linked APT group tracked TA453 has been linked to a new malware campaign targeting both Windows and macOS systems. The Iran-linked threat actor TA453 has been linked to a malware campaign that targets both Windows and macOS. GorjolEcho maintains persistence by copying the initial stages malware in a StartUp entry.

Malware 92

Malware VPN Media Encryption 92

Security Affairs

MARCH 25, 2022

. “According to the indictment, between May and September 2017, the defendant and co-conspirators hacked the systems of a foreign refinery and installed malware, which cyber security researchers have referred to as “Triton” or “Trisis,” on a safety system produced by Schneider Electric, a multinational corporation.

Government 92

Government Energy and Utilities Malware Hacking 92

Krebs on Security

APRIL 15, 2020

The Coronavirus has prompted thousands of information security professionals to volunteer their skills in upstart collaborative efforts aimed at frustrating cybercriminals who are seeking to exploit the crisis for financial gain. “I’ve never seen this volume of phishing,” Rogers told Reuters. “I

Cybersecurity 301

Cybersecurity Cyber threats Government Phishing 301

Security Affairs

MAY 27, 2020

The updated Grandoreiro Malware equipped with latenbot-C2 features in Q2 2020 now extended to Portuguese banks. Cybercriminals attempt to compromise computers to generate revenue by exfiltrating information from victims’ devices, typically banking-related information. Technical Analysis. 100:51224/$rdgate?

Malware 66

Malware Banking Advertising Data collection 66

Security Affairs

JULY 21, 2021

Check Point Research (CPR) experts have spotted a cheap malware, dubbed XLoader variant, which was upgraded to target both Windows and macOS PCs. XLoader is a very cheap malware strain that is based on the popular Formbook Windows malware. Thus, a “Malware-as-a-Service” scheme is used. ” continues the report.

Spyware 99

Spyware Malware Cybercrime Advertising 99

Security Affairs

MARCH 17, 2020

FireEye compiled the report using data from dozens of ransomware infections that it has investigated from 2017 to 2019. The timing of the ransomware attacks is not casual, attackers attempt to deploy the malware when the presence of the IT staff is reduced and the likelihood to be detected is low.

Ransomware 111

Ransomware Advertising Malware Cybercrime 111

Security Affairs

AUGUST 27, 2022

In June 2017, Montenegro was targeted by the Russia-linked hacker group APT28 after Montenegro officially joined NATO alliance despite the strong opposition from the Russian Government that threatened to retaliate. Abazovic said it was politically motivated following the fall of his government last week.” ” reported the Reuters.

Cyber Attacks 80

Cyber Attacks Government Telecommunications Malware 80

Security Affairs

JULY 24, 2022

The attackers employed the Konni RAT (remote access trojan), which was first spotted by Cisco Talos researchers in 2017 and has been undetected since 2014 while being employed in highly targeted attacks. The attack chain starts with phishing messages that attempt to trick victims into opening a malicious attachment. Pierluigi Paganini.

Malware 92

Malware Encryption Phishing Hacking 92

Security Affairs

MAY 23, 2023

In October 2022, Kaspersky researchers uncovered a malware campaign aimed at infecting government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions with a previously undetected framework dubbed CommonMagic. Since 2017, there have been no traces of Groundbait and BugDrop operations.

Malware 76

Malware Spyware Encryption Phishing 76

Security Affairs

MARCH 8, 2023

The researchers pointed out that this is the first time the Soul malware framework is attributed to a known cluster of malicious activity, although it was previously used in attacks targeting the defense, healthcare, and ICT sectors in Southeast Asia. t Downloader and a second-stage loader that delivers the final backdoor.

Government 80

Government Malware Architecture Healthcare 80

Security Affairs

OCTOBER 4, 2021

In March, the cyberespionage group was observed leveraging ProxyShell against targets in 10 countries and used a variety of malware in its campaign. FRP, Cobalt Strike Beacon, and Tiny Shell) and previously undetected malware tracked as ProxyT, BeaconLoader and the DoorMe backdoor. ” reads the analysis published by the experts.

Energy and Utilities 88

Energy and Utilities Malware Technology Antivirus 88

Security Affairs

FEBRUARY 19, 2020

The DRBControl APT group has been targeting gambling and betting companies worldwide with malware that links to two China-linked APT groups. Security researchers from TrendMicro have uncovered a cyber espionage campaign carried out by an APT group tracked as DRBControl that employed a new family of malware.

Malware 99

Malware Advertising Phishing Passwords 99

Security Affairs

JULY 30, 2020

The attackers sent out spear-phishing emails using boobytrapped documents leveraging the fake job offer as bait. Threat actors behind this campaign are utilizing compromised infrastructure from multiple European countries to host their C2 infrastructure and distribute the malware to the targets.

Advertising 98

Advertising Data collection Malware Phishing 98

Security Affairs

MARCH 28, 2022

Ukraine CERT-UA uncovered a spear-phishing campaign conducted by Belarus-linked GhostWriter APT group targeting Ukrainian state entities with Cobalt Strike Beacon. The phishing messages use a RAR-archive named “Saboteurs.rar”, which contains RAR-archive “Saboteurs 21.03.rar.”

Phishing 91

Phishing Government Hacking Accountability 91

Security Affairs

MAY 9, 2020

30), we have observed three SilverTerrier actors/groups launch a series of 10 COVID-19 themed malware campaigns.” ” Between January 30 and April 30, 2020, the researchers observed three SilverTerrier groups launching ten COVID-19-themed malware campaigns, some of them also targeted organizations involved in the COVID-19 response.

Healthcare 64

Healthcare Government Energy and Utilities Insurance 64

The Last Watchdog

JANUARY 28, 2019

Why we’re in the ‘Golden Age’ of cyber espionageThe fact is cyber criminals are expert at refining and carrying out phishing, malvertising and other tried-and-true ruses that gain them access to a targeted victim’s Internet-connected computing device. Apps from other sources can carry malware or spyware.

Passwords 196

Passwords Password Management Antivirus Internet 196

Security Affairs

JUNE 15, 2020

The threat actors are spreading the malware through watering hole attacks targeting Tibet, Turkey, and Taiwan, The malware was first spotted in April 2020, but experts believe the ActionSpy spyware has been active at least since 2017.

Spyware 66

Spyware Advertising Encryption Phishing 66

Security Affairs

DECEMBER 30, 2019

Microsoft sued Thallium North Korea-linked APT for hacking into its customers’ accounts and networks via spear-phishing attacks. Microsoft sued a North Korea-linked cyber espionage group tracked as Thallium for hacking into its customers’ accounts and networks via spear-phishing attacks. 27 in the U.S.

Computers and Electronics 64

Computers and Electronics Phishing Accountability Malware 64

Security Affairs

FEBRUARY 10, 2020

The attackers aimed at stealing confidential documents from government systems after having infected them with malware. The attackers exploit the CVE-2014-6352 and CVE-2017-0199 Office vulnerabilities to drop and execute the malware on the victim’s computer. ” reads the alert issued by MyCERT.

Government 122

Government Advertising Malware Hacking 122

Security Affairs

JUNE 13, 2021

million customers impacted. million customers impacted. million customers impacted. million customers impacted.

Data breaches 61

Data breaches Hacking Cryptocurrency Scams 61

Security Affairs

APRIL 8, 2022

Iarmak was directly involved in designing phishing emails embedded with malware, intruding on victim networks, and extracting data such as payment card information,” said U.S. Polite, Jr. of the Justice Department’s Criminal Division. “Mr. Attorney Nicholas W. Brown of the Western District of Washington. .

Cybercrime 104

Cybercrime Hacking Software Phishing 104

Security Affairs

SEPTEMBER 1, 2022

The National Security Agency said that Montenegro was “under a hybrid war at the moment.”. The state has been a Russian ally since 2017 when it joined NATO despite strong opposition from Russia, it also expressed support to Ukraine after its invasion. The Government believes that the attack was orchestrated by a nation-state actor.

Government 73

Government Cyber Attacks Telecommunications Malware 73