Security Affairs

FEBRUARY 17, 2024

Ukrainian national Vyacheslav Igorevich Penchukov has pleaded guilty to his key roles in the Zeus and IcedID malware operations. Vyacheslav Igorevich Penchukov was a leader of two prolific malware groups that infected thousands of computers with malicious software.

Malware 93

Malware Cybercrime Banking Hacking 93

CyberSecurity Insiders

APRIL 5, 2023

North Korea has established a hacking group named APT43 to fund its cybercrime activities, aimed at advancing Pyongyang’s geopolitical interests. The post North Korea dedicates a hacking group to fund cyber crime appeared first on Cybersecurity Insiders.

Hacking 105

Hacking Social Engineering Cryptocurrency Manufacturing 105

Security Affairs

JULY 25, 2022

Operators behind the Amadey Bot malware use the SmokeLoader to distribute a new variant via software cracks and keygen sites. Amadey Bot is a data-stealing malware that was first spotted in 2018, it also allows operators to install additional payloads. Then the malware contacts the C2 and sends system information (i.e.

Software 118

Software Malware Cybercrime VPN 118

Security Affairs

SEPTEMBER 18, 2021

The group is suspected to have been running successful malware campaigns for more than five years. The attackers have used off-the-shelf malware since the beginning of their operations and have never developed their own malware. SecurityAffairs – hacking, malware). ” concludes the experts.

Malware 98

Malware Phishing DNS Cybercrime 98

Security Affairs

JANUARY 30, 2019

According to the ENISA Threat Landscape Report 2018, 2018 has brought significant changes in the techniques, tactics, and procedures associated with cybercrime organizations and nation-state actors. Nation-state hacking reduced the use of complex malware and appears to go towards low profile social engineering attacks.

Cyber threats 82

Cyber threats IoT Social Engineering Advertising 82

The Security Ledger

APRIL 24, 2019

billion to Internet-enabled theft, fraud and exploitation in 2018, with business e-mail compromise scams resulting in the highest of these financial losses, according to the FBI’s Internet Crime Complaint Center (IC3). The post FBI: Cybercrime Accounted for $2.7B in Losses in 2018 appeared first on The Security Ledger.

Cybercrime 40

Cybercrime Accountability Scams Internet 40

SecureList

OCTOBER 20, 2021

Having been in the field for so long, we have witnessed some major changes in the cybercrime world’s modus operandi. This report shares our insights into the Russian-speaking cybercrime world and the changes in how it operates that have happened in the past five years. Client-side attacks on the wane.

Cybercrime 137

Cybercrime Banking Malware Ransomware 137

Security Affairs

NOVEMBER 3, 2022

Sentinel Labs found evidence that links the Black Basta ransomware gang to the financially motivated hacking group FIN7. It focused on deploying POS malware and launching targeted spear-phishing attacks against organizations worldwide. SecurityAffairs – hacking, FIN7). Pierluigi Paganini.

Cybercrime 95

Cybercrime Ransomware Antivirus Malware 95

The Last Watchdog

JUNE 21, 2020

Balaban This ransomware was doing the rounds over spam generated by the Gameover ZeuS botnet, which had been originally launched in 2011 as a toolkit for stealing victim’s banking credentials and was repurposed for malware propagation. RaaS rollout 2015 – 2018. Targeting enterprises Late 2018 – present day.

Ransomware 243

Ransomware Hacking Encryption Penetration Testing 243

Security Affairs

MAY 30, 2022

The researchers attribute the botnet to the cybercrime group Keksec which focuses on DDoS-based extortion. Experts pointed out that the malware is being actively developed. LFI CVE-2018-16763 Fuel CMS 1.4.1 LFI CVE-2018-16763 Fuel CMS 1.4.1 The botnet targets multiple architectures, including arm, bsd, x64, and x86.

Malware 142

Malware DDOS IoT Cybercrime 142

Security Affairs

JULY 6, 2021

The alleged perpetrator, who turned out to be a citizen of Morocco, was arrested in May by the Moroccan police based on the data about his cybercrimes that was provided by Group-IB. Over the period from 2009 to 2018, the threat actor defaced over 130 web pages. SecurityAffairs – hacking, Operation Lyrebird). Pierluigi Paganini.

Cybercrime 95

Cybercrime Phishing Banking Telecommunications 95

SC Magazine

FEBRUARY 17, 2021

Charges against one of the three were first brought in 2018. The Department of Justice has unsealed an indictment against three members of Lazarus Group for a wide range of financially-motivated hacks against private businesses that authorities said were designed to steal $1.3 Mario Tama/Getty Images).

Hacking 103

Hacking Cryptocurrency Banking Malware 103

Security Affairs

JANUARY 22, 2023

Roaming Mantis threat actors were observed using a new variant of their mobile malware Wroba to hijack DNS settings of Wi-Fi routers. Researchers from Kaspersky observed Roaming Mantis threat actors using an updated variant of their mobile malware Wroba to compromise Wi-Fi routers and hijack DNS settings. Agent.eq (a.k.a

DNS 91

DNS Mobile Malware Hacking 91

Security Affairs

FEBRUARY 23, 2022

The code of the recently-emerged Entropy ransomware has similarities with the one of the infamous Dridex malware. The recently-emerged Entropy ransomware has code similarities with the popular Dridex malware. Experts from Sophos analyzed the code of Entropy ransomware employed in two distinct attacks. ” continues the report.

Ransomware 95

Ransomware Malware Cybercrime Banking 95

Security Affairs

NOVEMBER 9, 2022

Experts noticed that the Amadey malware is being used to deploy LockBit 3.0 Researchers from AhnLab Security Emergency Response Center (ASEC) reported that the Amadey malware is being used to deploy LockBit 3.0 Amadey Bot is a data-stealing malware that was first spotted in 2018, it also allows operators to install additional payloads.

Malware 89

Malware Ransomware Cybercrime Phishing 89

Security Affairs

NOVEMBER 1, 2021

Researchers demonstrated how crooks could hack Diebold Nixdorf’s Wincor Cineo ATMs to bypass black-box attack protections and withdraw cash. The ATM black box attacks are quite popular in the cybercrime underground and several threat actors offer the hardware equipment and malware that could be used to compromise the ATMs.

Hacking 115

Hacking Firmware Encryption Manufacturing 115

Security Affairs

NOVEMBER 16, 2018

According to Group-IB’s report findings, Asia is one of the most actively attacked regions in the world, the company presented latest cybercrime trends. In 2017-2018 hackers’ interest in cryptocurrency exchanges ramped up. In 2018 the direct financial losses from these attacks amounted to almost $20 million. Attacks on Crypto.

Cybercrime 83

Cybercrime Hacking Banking Phishing 83

Hot for Security

JUNE 25, 2021

The Western District of Washington has sentenced a Ukrainian man to seven years in prison for his role in a hacking gang that are estimated to have caused more than one billion dollars worth of damage. If the recipient opened the included attachment, their computer would be infected by a version of the Carbanak malware.

Hacking 137

Hacking Penetration Testing Social Engineering Retail 137

Security Affairs

SEPTEMBER 14, 2021

The network equipment maker MikroTik revealed that the routers were previously compromised in 2018. “As far as we have seen, these attacks use the same routers that were compromised in 2018, when MikroTik RouterOS had a vulnerability, that was quickly patched.” SecurityAffairs – hacking, botnet). Pierluigi Paganini.

DDOS 79

DDOS Firewall Passwords Internet 79

Security Affairs

JULY 29, 2019

According to experts at Sonicwall, scanning of random ports and the diffusion of encrypted malware are characterizing the threat landscape. In 2018, global malware volume recorded by SonicWall hit a record-breaking 10.52 ” In 2018 Sonicwall had logged more than 2.8 ” In 2018 Sonicwall had logged more than 2.8

IoT 84

IoT Encryption Malware Advertising 84

Security Affairs

DECEMBER 4, 2023

Microsoft warns of ongoing malvertising attacks using the DanaBot malware to deploy the CACTUS ransomware. Storm-0216 has historically used Qakbot malware for initial access, but has switched to other malware for initial access after the takedown of the Qakbot infrastructure.

Ransomware 105

Ransomware Malware Banking Hacking 105

Security Affairs

MARCH 26, 2024

A new variant of TheMoon malware infected thousands of outdated small office and home office (SOHO) routers and IoT devices worldwide. The researchers believe that the malware connects the NTP to verify the infected device’s internet connection and confirm it is not operating within a sandbox environment.

IoT 123

IoT Cybercrime Internet Internet 123

Security Affairs

DECEMBER 13, 2021

The TinyNuke malware is back and now was used in attacks aimed at French users working in manufacturing, technology, construction, and business services. Proofpoint researchers uncovered a campaign exclusively targeting French entities and organizations with operations in France with the banking malware TinyNuke. Pierluigi Paganini.

Banking 96

Banking Malware Manufacturing Business Services 96

Security Affairs

JANUARY 18, 2019

First detailed in September 2018, the toolkit was observed delivering malware families ranging from ransomware to backdoors, but also fingerprinting the browser profile to identify targets of interest. Security researcher Kafeine identified that Fallout is now the second exploit kit to add CVE-2018-15982.”

Advertising 91

Advertising Ransomware Healthcare Malware 91

Security Affairs

MARCH 14, 2024

“The fake installers contained a sideloaded DLL file that decrypted and infected users with a DarkGate malware payload.” The malware is considered a sophisticated threat and is continuously improved. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, malware)

Phishing 104

Phishing Malware Software Internet 104

Security Affairs

JULY 23, 2020

North Korea-linked Lazarus APT Group has used a new multi-platform malware framework, dubbed MATA, to target entities worldwide. The MATA malware framework could target Windows, Linux, and macOS operating systems. The malware framework implements a wide range of features that allow attackers to fully control the infected systems.

Malware 100

Malware Ransomware Advertising Encryption 100

Security Affairs

OCTOBER 15, 2019

Chinese-speaking cybercrime gang Rocke that carried out several large-scale cryptomining campaigns, has now using news tactics to evade detection. Chinese-speaking cybercrime gang Rocke, that carried out several large-scale cryptomining campaigns in past , has now using news tactics to evade detection. Pierluigi Paganini.

Cybercrime 64

Cybercrime DNS Malware Advertising 64

Security Affairs

FEBRUARY 23, 2022

UK and US cybersecurity agencies linked Cyclops Blink malware to Russia’s Sandworm APT. US and UK cybersecurity and law enforcement agencies published a joint security advisory about a new malware, dubbed Cyclops Blink, that has been linked to the Russian-backed Sandworm APT group. SecurityAffairs – hacking, CISA).

Malware 91

Malware Firmware Architecture Firewall 91

Security Affairs

APRIL 8, 2022

A Ukrainian man was sentenced in the US to 5 years in prison for his criminal activity in the cybercrime group FIN7. for high-level hacking activity in the cybercrime group FIN7 (aka Carbanak Group and the Navigator Group). Iarmak was involved in FIN7 criminal activities from approximately November 2016 through November 2018.

Cybercrime 106

Cybercrime Hacking Software Phishing 106

Krebs on Security

SEPTEMBER 30, 2023

.” New York City-based cyber intelligence firm Flashpoint said the Snatch ransomware group was created in 2018, based on Truniger’s recruitment both on Russian language cybercrime forums and public Russian programming boards. ” In at least some of those recruitment ads — like one in 2018 on the forum sysadmins[.]ru

Ransomware 218

Ransomware Accountability Cybercrime Backups 218

Security Affairs

AUGUST 11, 2023

Threat actors employed a new variant of the SystemBC malware, named DroxiDat, in attacks aimed at African critical infrastructure. The malware was tracked as “SystemBC” based on the URI path shown in the advertisement’s panel screenshots. The malware is 8kb in size and was used as a system profiler and a simple SOCKS5-capable bot.

Malware 85

Malware Data collection Healthcare Cybercrime 85

Security Affairs

SEPTEMBER 1, 2020

Iran-linked APT group Pioneer Kitten is now trying to monetize its efforts by selling access to some of the networks it has hacked to other hackers. Iran-linked APT group Pioneer Kitten, also known as Fox Kitten or Parisite, is now trying to monetize its efforts by selling access to some of the networks it has hacked to other hackers.

Hacking 90

Hacking VPN Advertising Financial Services 90

Security Affairs

APRIL 18, 2021

The Carbanak gang (aka FIN7 , Anunak or Cobalt ) stole over a billion euros from banks across the world, the name “Carbanak” comes with the name of the malware they used to compromise computers at banks, other financial institutions, restaurants, and other industries. ” reads the press release published by DoJ.

System Administration 116

System Administration Penetration Testing Malware Banking 116

Security Affairs

JANUARY 2, 2022

In a classified report cited by Chosun, the US National Intelligence Service (DNI) found that North Korea was financing its ‘priority policies’, such as nuclear and missile development, through cybercrime. ” The report states that North Korea-linked attacks employed the AppleJeus malware to steal cryptocurrency.

Cryptocurrency 127

Cryptocurrency Cybercrime Media Government 127

Security Affairs

JULY 19, 2020

The four malware families are named Guildma, Javali, Melcoz, and Grandoreiro, experts believe are the result of a Brazilian banking group/operation that is evolving its capabilities targeting banking users abroad. Experts noticed that the malware uses the BITSAdmin tool to download the additional modules. ” continues Kaspersky.

Banking 103

Banking Malware Phishing Advertising 103

Security Affairs

AUGUST 1, 2020

A 30-year-old Moldovan man pleaded guilty this week for creating the FastPOS malware that infected PoS systems worldwide. The Moldovan citizen Valerian Chiochiu (30), aka Onassis, pleaded guilty on Friday for creating the infamous FastPOS Point-of-Sale (POS) malware. SecurityAffairs – hacking, FastPOS). and infraud.ws.

Malware 73

Malware Advertising Cybercrime Hacking 73

Security Affairs

SEPTEMBER 1, 2021

Securities and Exchange Commission (SEC) announced sanctions against several organizations over email account hacking. Securities and Exchange Commission (SEC) announced sanctions against eight entities belonging to three companies over email account hacking due to cybersecurity failures. Pierluigi Paganini.

Accountability 82

Accountability Hacking Financial Services Cybersecurity 82