Digital Shadows

MARCH 17, 2025

Key Findings Even years after their disclosure, VPN-related vulnerabilities like CVE-2018-13379 and CVE-2022-40684 remain essential tools for attackers, driving large-scale campaigns of credential theft and administrative control. CVE-2018-13379: The Eternal Exploit What is CVE-2018-13379?

VPN 133

VPN Authentication Ransomware Risk 133

Krebs on Security

AUGUST 30, 2022

A recent spate of SMS phishing attacks from one cybercriminal group has spawned a flurry of breach disclosures from affected companies, which are all struggling to combat the same lingering security threat: The ability of scammers to interact directly with employees through their mobile devices. 2, and Aug.

Mobile 339

Mobile Phishing Authentication Accountability 339

Krebs on Security

OCTOBER 9, 2023

The fake USPS phishing page. Recent weeks have seen a sizable uptick in the number of phishing scams targeting U.S. Here’s a look at an extensive SMS phishing operation that tries to steal personal and financial data by spoofing the USPS, as well as postal services in at least a dozen other countries. com usps.trckspost[.]com

Phishing 326

Phishing Scams Passwords Web Fraud 326

The Last Watchdog

AUGUST 28, 2018

If there is a data breach or some other cybersecurity incident, a phishing attack was probably involved. Over 90 percent of incidents begin with a phishing email. One of the more infamous hacks in recent years, the DNC data breach , was the result of a phishing attack. Related: Carpet bombing of phishing emails endures.

Phishing 194

Phishing Data breaches Scams Hacking 194

SecureWorld News

FEBRUARY 20, 2025

He urges enterprises to implement Privileged Access Management (PAM) solutions and multi-factor authentication (MFA) and to enforce robust password policies to reduce the risk of account compromise. Strengthening identity security Enforce phishing-resistant MFA for all privileged accounts. Develop and test ransomware response plans.

Ransomware 113

Ransomware IoT Encryption Social Engineering 113

Krebs on Security

AUGUST 19, 2020

The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks. The employee phishing page bofaticket[.]com. Image: urlscan.io.

Phishing 363

Phishing VPN Social Engineering Media 363

Krebs on Security

DECEMBER 16, 2021

Truglia admitted to a New York federal court that he let a friend use his account at crypto-trading platform Binance in 2018 to launder more than $20 million worth of virtual currency stolen from Michael Terpin , a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts.

Cryptocurrency 363

Cryptocurrency Mobile Accountability Scams 363

CyberSecurity Insiders

JUNE 10, 2021

According to research carried out by a Cybersecurity firm named NordLocker, a hacking group devised malware and distributed it onto millions of PCs in 2018. NordLocker report says that the malware whose name is yet to be identified was super-active between 2018-2020 and became dormant from February this year. . terabyte database. .

Passwords 115

Passwords Malware Banking Hacking 115

The Last Watchdog

MAY 1, 2019

Social engineering, especially phishing, continues to trigger the vast majority of breach attempts. In 2015, penetration tester Oliver Münchow was asked by a Swiss bank to come up with a better way to test and educate bank employees so that passwords never left the network perimeter. Related: Why diversity in training is a good thing.

Social Engineering 166

Social Engineering Engineering Phishing Banking 166

Malwarebytes

FEBRUARY 19, 2025

The latest, major threats to Mac computers can steal passwords and credit card details with delicate precision, targeting victims across the internet based on their device, location, and operating system. By 2018, TrickBot was the largest threat to businesses.

Malware 136

Malware Software Passwords Cryptocurrency 136

Krebs on Security

SEPTEMBER 27, 2023

First spotted in 2018 , the Snatch ransomware group has published data stolen from hundreds of organizations that refused to pay a ransom demand. According to DomainTools.com , this address also hosts or else recently hosted the usual coterie of Snatch domains, as well as quite a few domains phishing known brands such as Amazon and Cashapp.

Ransomware 322

Ransomware Internet Internet Phishing 322

Security Affairs

APRIL 23, 2019

We engaged one of the leading data security firms to conduct a thorough investigation, which traced the unauthorized activity to a phishing email received in July 2018. ” The company hired a security firm to investigate the incident, it discovered that the attack begun with a phishing email received in July 2018.

Passwords 102

Passwords Retail Accountability Data breaches 102

SiteLock

AUGUST 27, 2021

However, research indicates that phishing attacks are the most common threat — by far. Microsoft’s “ Security Intelligence Report, Volume 24 ” shows a 250% increase in the number of phishing emails and attacks since 2018. To avoid becoming a victim, it’s critical to prevent phishing attacks.

Phishing 98

Phishing Passwords Education Password Management 98

Krebs on Security

APRIL 8, 2019

Researchers at Cisco Talos discovered the groups using the same sophisticated methods I employed last year — running a search on Facebook.com for terms unambiguously tied to fraud, such as “spam” and “phishing.” “While some groups were removed immediately, other groups only had specific posts removed.”

Cybercrime 259

Cybercrime Passwords Identity Theft Accountability 259

Adam Levin

JULY 24, 2020

Barely a day goes by without news of an elite hacking team creating a more stealth exploit– malware , elaborate spear-phishing attacks, trojans, and a killer array of ransomware that can take factories and other organizations offline, or even hobble entire cities. Cyberattacks are constantly getting more sophisticated.

Hacking 237

Hacking Phishing Risk Accountability 237

Krebs on Security

JANUARY 22, 2019

In July 2018, email users around the world began complaining of receiving spam which began with a password the recipient used at some point in the past and threatened to release embarrassing videos of the recipient unless a bitcoin ransom was paid. 13, 2018 bomb threat hoax. domaincontrol.com, and ns18.domaincontrol.com.

DNS 275

DNS Internet Internet Computers and Electronics 275

Krebs on Security

AUGUST 7, 2018

On July 18, 2018, Pasco County authorities arrested Ricky Joseph Handschumacher , an employee of the city of Port Richey, Fla, charging him with grand theft and money laundering. If, however, SMS-based authentication is the only option available, this is still far better than simply relying on a username and password to protect the account.

Mobile 248

Mobile Cryptocurrency Computers and Electronics Scams 248

Security Affairs

MARCH 27, 2020

Google announced to have warned users of almost 40,000 alerts of state-sponsored phishing or malware attacks during 2019. Google shared data on alerts related to state-sponsored attacks, the tech giant revealed that it issued almost 40,000 alerts of state-sponsored phishing or malware attacks to its users during 2019.

Phishing 145

Phishing Accountability Advertising Malware 145

Krebs on Security

FEBRUARY 18, 2019

government — along with a number of leading security companies — recently warned about a series of highly complex and widespread attacks that allowed suspected Iranian hackers to siphon huge volumes of email passwords and other sensitive data from multiple governments and private companies. The first domain was “ ns0.idm.net.lb

DNS 279

DNS Internet Internet Government 279

Troy Hunt

APRIL 17, 2018

link] — Nodestack (@NodestackUK) April 12, 2018. In the case above, HostGator was being taken to task for storing passwords in a retrievable fashion (i.e. gdlinux — Guardian Digital (@gdlinux) April 13, 2018. — Jason Snelders (@JasonSnelders) April 12, 2018.

Media 246

Media Advertising Accountability Marketing 246

Krebs on Security

SEPTEMBER 6, 2021

The Manipulaters’ core brand in the underground is a shared cybercriminal identity named “ Saim Raza ,” who for the past decade across dozens of cybercrime sites and forums has peddled a popular spamming and phishing service variously called “ Fudtools ,” “ Fudpage ,” “ Fudsender ,” etc.

Software 311

Software Phishing Cybercrime Accountability 311

Krebs on Security

AUGUST 25, 2018

The sextortion email scam last month that invoked a real password used by each recipient and threatened to release embarrassing Webcam videos almost certainly was not the work of one criminal or even one group of criminals. In early June 2018, uscourtsgov-dot-com was associated with a Sigma ransomware scam delivered via spam.

Scams 164

Scams Internet Internet Passwords 164

Security Affairs

DECEMBER 1, 2019

Over 90 percent of the users identified by Google were targeted via “credential phishing emails” that attempt to trick victims into providing their password or other account credentials to hijack their Google account. “TAG tracks more than 270 targeted or government-backed groups from more than 50 countries. .”We

Phishing 145

Phishing Accountability Advertising Cyber Attacks 145

The Last Watchdog

JANUARY 28, 2019

Why we’re in the ‘Golden Age’ of cyber espionageThe fact is cyber criminals are expert at refining and carrying out phishing, malvertising and other tried-and-true ruses that gain them access to a targeted victim’s Internet-connected computing device. Use a password manager. Everyone should be using one.

Passwords 196

Passwords Password Management Internet Internet 196

Krebs on Security

APRIL 14, 2019

But when the interested party inquires about the listing, they are sent a link to a site that looks like Airbnb.com but which is actually a phishing page. The fake site simply forwards all requests on this page to Airbnb.com, and records any usernames and passwords submitted through the site.

Scams 277

Scams Advertising Accountability Phishing 277

The Last Watchdog

JUNE 21, 2020

The Archiveus Trojan from 2006 was the first one to use RSA cipher, but it was reminiscent of a proof of concept and used a static 30-digit decryption password that was shortly cracked. RaaS rollout 2015 – 2018. It vanished from the radar in June 2018, when the ransomware plague took another sharp turn.

Ransomware 243

Ransomware Hacking Encryption Penetration Testing 243

Krebs on Security

NOVEMBER 6, 2018

In late September 2018, the REACT Task Force spearheaded an investigation that led to the arrest of two Missouri men — both in their early 20s — who are accused of conducting SIM swaps to steal $14 million from a cryptocurrency company based in San Jose, Calif. . million customers.

Mobile 274

Mobile Cryptocurrency Accountability Passwords 274

Security Affairs

JUNE 24, 2020

The CryptoCore group, aks Crypto-gang, “Dangerous Password”, and “Leery Turtle” has been active since 2018. “While the group’s key infiltration vector to the exchange is usually through spear-phishing against the corporate network, the executives’ personal email accounts are the first to be targeted.”

Cryptocurrency 117

Cryptocurrency Phishing Accountability Passwords 117

Malwarebytes

OCTOBER 8, 2021

Discord, a group text chat/VoiP app of choice for many gaming communities, is having a bit of trouble with phishing links. This week it’ll be a bot promoting a “red hot” offer from 2018. When sneaky sites go phishing… The sites here use a common trick. Hunting for phish. Tackling the Discord phishers.

Scams 136

Scams Phishing Accountability Passwords 136

Security Affairs

AUGUST 7, 2019

Credential stuffing attacks involve botnets to try stolen login credentials usually obtained through phishing attacks and data breaches. This kind of attacks is very efficient due to the bad habit of users of reusing the same password over multiple services. The experts detected 8.3 billion per month. The experts detected 8.3

Insurance 110

Insurance Data breaches Financial Services Passwords 110

Troy Hunt

FEBRUARY 11, 2019

rows of email addresses and passwords in total, but only 1.6B They learned about the phenomenon that is data breaches and credential stuffing lists, they read about password managers and 2FA and inevitably, many of them subsequently made behavioural changes to their security practices. There were 2.7B

Passwords 241

Passwords Data breaches Media InfoSec 241

eSecurity Planet

SEPTEMBER 15, 2021

Microsoft for the past few years has been among the loudest vendors calling for a security future that doesn’t include passwords. In 2018, the software giant took the step of doing away with passwords for people signing into its Edge web browser, saying instead they could use a number of alternatives. Passwords are Unpopular.

Accountability 125

Accountability Passwords Authentication Phishing 125

BH Consulting

OCTOBER 24, 2024

The EU GDPR text makes this clear, but the Dutch privacy regulator had taken a different view back in 2018, and issued a €525,000 fine. It’s been a busy few weeks for the Data Protection Commission, which fined Meta €91 million for storing millions of user passwords in plaintext. MORE Have you signed up to our monthly newsletter?

Social Engineering 69

Social Engineering Passwords Cybersecurity Ransomware 69

Krebs on Security

NOVEMBER 21, 2018

It does not appear USPS account passwords were exposed via this API, although KrebsOnSecurity conducted only a very brief and limited review of the API’s rather broad functionality before reporting the issue to the USPS. . “This could easily be leveraged to build up mass targeted spam or spear phishing,” Hansen said.

Accountability 279

Accountability Authentication Identity Theft Advertising 279

Krebs on Security

MARCH 2, 2020

In 2018, security intelligence firm HYAS discovered a malware network communicating with systems inside of a French national power company. 001 explains how to use a RAT he developed called “Little Boy” to steal credit card numbers and passwords from victims. to for a user named “ fatal.001.”

DNS 315

DNS Penetration Testing Malware Hacking 315

SecureList

FEBRUARY 23, 2022

The research in this report is a continuation of our previous annual financial threat reports ( 2018 , 2019 and 2020 ), providing an overview of the latest trends and key events across the threat landscape. Phishing: In 2021, 8.2% of users were hit by phishing. of all phishing schemes in 2021, compared to the 11.1%

Banking 141

Banking Phishing Cryptocurrency Malware 141

Security Affairs

NOVEMBER 23, 2019

“We can confirm that all payment information, passwords and accounts are safe, but certain users’ name, contact number, email and shipping address may have been exposed. Impacted users may receive spam and phishing emails as a result of this incident.” .” reads the statement published by the company.

Data breaches 139

Data breaches Passwords Advertising Accountability 139