Security Affairs

JUNE 12, 2023

Researchers detailed a fully undetectable (FUD) malware obfuscation engine named BatCloak that is used by threat actors. Researchers from Trend Micro have analyzed the BatCloak, a fully undetectable (FUD) malware obfuscation engine used by threat actors to stealthily deliver their malware since September 2022.

Engineering 82

Engineering Malware Encryption Hacking 82

Security Affairs

SEPTEMBER 19, 2023

China-linked threat actor Earth Lusca used a new Linux malware dubbed SprySOCKS in a recent cyber espionage campaign. Researchers from Trend Micro, while monitoring the activity of the China-linked threat actor Earth Lusca , discovered an encrypted file hosted on a server under the control of the group.

Malware 96

Malware Encryption Telecommunications Authentication 96

Security Affairs

APRIL 4, 2023

A new ransomware strain named Rorschach ransomware supports the fastest file-encrypting routine observed to date. The researchers conducted five separate encryption speed tests in a controlled environment (with 6 CPUs, 8192MB RAM, SSD, and 220000 files to be encrypted), limited to local drive encryption only.

Encryption 85

Encryption Ransomware Malware Backups 85

Security Affairs

JULY 6, 2022

Hive ransomware operators have improved their file-encrypting module by migrating to Rust language and adopting a more sophisticated encryption method. The most important change in the latest Hive variant is the encryption mechanism it adopts. ” reads the post published by Microsoft. ” continues Microsoft. .

Encryption 109

Encryption Ransomware Cybercrime Malware 109

Security Affairs

FEBRUARY 7, 2023

A new Linux variant of the Clop ransomware has been observed in the wild, the good news is that its encryption algorithm is flawed. The researchers noticed that the encryption algorithm implemented in the ELF executable is flawed and can allow victims to decrypt locked files without paying a ransom. ” continues the report.

Encryption 82

Encryption Ransomware Cybercrime Engineering 82

eSecurity Planet

JUNE 7, 2022

They earned the highest score among providers named "Customer's Choice" in Gartner's 2022 "Voice of the Customer” Security Awareness Computer-Based Training report. Protect your company computers, laptops and mobile devices with security products all managed via a cloud-based management console. Get started today! CyberProof.

Cybersecurity 124

Cybersecurity Identity Theft Encryption Antivirus 124

Security Affairs

JANUARY 2, 2023

In 2022, ransomware attacks targeted 105 state or municipal governments or agencies in the US, reads a report published by Emsisoft. The only local government known to have paid a ransom in 2022 was Quincy, MA., In at least 17 incidents (68 percent), threat actors exfiltrated data including Protected Health Information (PHI).

Government 84

Government Ransomware Healthcare Education 84

Security Affairs

JANUARY 2, 2024

A team of researchers released a suite of tools that could help victims to decrypt data encrypted with by the Black Basta ransomware. Independent security research and consulting team SRLabs discovered a vulnerability in Black Basta ransomware’s encryption algorithm and exploited it to create a free decryptor.

Ransomware 110

Ransomware Encryption Insurance Malware 110

Security Affairs

JANUARY 16, 2023

Security firm Avast has released a free decryptor for the BianLian ransomware to allow victims of the malware to recover locked files. The BianLian ransomware emerged in August 2022, the malware was employed in attacks against organizations in various industries, including manufactoring, media and entertainment, and healthcare.

Ransomware 87

Ransomware Malware Antivirus Encryption 87

eSecurity Planet

JUNE 21, 2022

” Also read: Cybersecurity Employment in 2022: Solving the Skills Gap. How to Choose a Security Certification. Thycotic chief security scientist Joseph Carson told eSecurity Planet that choosing a certification should ultimately be about deciding which skillset or professional direction you want to focus on.

Cybersecurity 117

Cybersecurity Penetration Testing System Administration Cyber Attacks 117

CyberSecurity Insiders

FEBRUARY 21, 2023

But now a new file encrypting malware variant has emerged onto the block that demands ransom, based on the insurance cover. From Cyber Insurance POV, this seems like a scam stuck between the victim and those spreading the malware….

Insurance 124

Insurance Ransomware Cyber Insurance Encryption 124

Malwarebytes

AUGUST 3, 2022

docx ) that has weaponized with the Follina (CVE-2022-30190) vulnerability to drop Woody Rat. The used lure is in Russian is called “ Information security memo ” which provide security practices for passwords, confidential information, etc. The malware communicates with its C2 using HTTP requests.

Malware 112

Malware Encryption Antivirus Architecture 112

Security Affairs

MAY 7, 2022

Experts spotted a malware campaign that is the first one using a technique of hiding a shellcode into Windows event logs. In February 2022 researchers from Kaspersky spotted a malicious campaign using a novel technique that consists of hiding the shellcode in Windows event logs. which contains Cobalt Strike and Silent Break.

Malware 81

Malware Encryption Hacking Cybersecurity 81

Security Affairs

JANUARY 23, 2024

The Black Basta ransomware group has been active since April 2022 , like other ransomware operations, it implements a double-extortion attack model. A joint research by Elliptic and Corvus Insurance revealed that the group accumulated at least $107 million in Bitcoin ransom payments since early 2022.

Hacking 109

Hacking Encryption Ransomware Insurance 109

Krebs on Security

APRIL 20, 2023

Researchers at ESET say this job offer from a phony HSBC recruiter on LinkedIn was North Korean malware masquerading as a PDF file. Mandiant found the compromised 3CX software would download malware that sought out new instructions by consulting encrypted icon files hosted on GitHub. Image: Mandiant.

Malware 290

Malware Software Technology Accountability 290

Security Affairs

MAY 4, 2023

Facebook discovered a new information-stealing malware, dubbed ‘NodeStealer,’ that is being distributed on Meta. NodeStealer is a new information-stealing malware distributed on Meta that allows stealing browser cookies to hijack accounts on multiple platforms, including Facebook, Gmail, and Outlook.

Malware 89

Malware Accountability Advertising Education 89

Security Affairs

NOVEMBER 19, 2023

Phobos variants are usually distributed by the SmokeLoader , but in 8Base campaigns, it has the ransomware component embedded in its encrypted payloads. The group has been active since March 2022, it focused on small and medium-size businesses in multiple industries, including finance, manufacturing, business services, and IT.

Ransomware 118

Ransomware Encryption Backups Manufacturing 118

Security Affairs

NOVEMBER 30, 2022

When you buy a Sony, Lexar, or Sandisk USB key or any other storage device, it comes with an encryption solution to keep your data safe. The software is developed by a third-party vendor – ENC Security. The data was accessible from 27 May 2021 up until 9 November 2022. SecurityAffairs – hacking, ENC Security).

Encryption 95

Encryption Phishing Marketing Software 95

Security Affairs

MARCH 25, 2024

The threat actors sent out spam emails with attachments that eventually launched the StrelaStealer malware. The malware StrelaStealer is an email credential stealer that DCSO_CyTec first documented in November 2022. “The JScript file then drops a Base64-encrypted file and a batch file. ” concludes the report.

Malware 94

Malware Encryption Manufacturing Phishing 94

Security Affairs

OCTOBER 25, 2022

Researchers reported that threat actors used 2 PoS malware variants to steal information about more than 167,000 credit cards. Cybersecurity firm Group-IB discovered two PoS malware to steal data associated with more than 167,000 credit cards from point-of-sale payment terminals. MajikPOS is written using the “.NET

Malware 75

Malware Cybercrime Banking Marketing 75

Security Affairs

APRIL 9, 2024

The campaign is notable for its utilization of the BatCloak malware obfuscation engine and ScrubCrypt to distribute the malware through obfuscated batch scripts. BatCloak is a fully undetectable (FUD) malware obfuscation engine used by threat actors to stealthily deliver their malware since September 2022.

Engineering 88

Engineering Phishing Malware Hacking 88

Security Affairs

DECEMBER 2, 2022

Cuba ransomware gang received more than $60 million in ransom payments related to attacks against 100 entities worldwide as of August 2022. Dollars (USD) and received more than $60 million in ransom payments from over 100 victims worldwide as of August 2022, the US government states. ” reads the report. ” reads the report.

Ransomware 79

Ransomware Financial Services Manufacturing Healthcare 79

Security Affairs

MAY 30, 2024

Since 2011, Wang and his co-conspirators had been distributing malware through malicious VPN applications, including MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN. The compromised devices were recruited in the 911 S5 residential proxy service. ” reads the press release published by DoJ. based online service providers.

VPN 83

VPN Cryptocurrency Malware Software 83

Security Affairs

APRIL 28, 2022

Threat actors have replaced the BazaLoader and IcedID malware with a new loader called Bumblebee in their campaigns. Cybercriminal groups that were previously using the BazaLoader and IcedID as part of their malware campaigns seem to have adopted a new loader called Bumblebee. It is used by multiple cybercrime threat actors.”

Malware 76

Malware Cybercrime Encryption Hacking 76

Security Affairs

MARCH 31, 2024

ESET first discovered a new Linux version of DinodasRAT in October 2023, but experts believe it has been active since 2022. The campaign seems active since at least early 2022 and focuses primarily on government organizations. The malware establishes persistence on the host by using SystemV or SystemD startup scripts.

Encryption 128

Encryption Malware Government Hacking 128

Security Affairs

SEPTEMBER 28, 2022

North Korea-linked Lazarus APT group continues to target macOS with a malware campaign using job opportunities as a lure. The SentinelOne investigation is based on a previous one conducted by ESET in August , when Lazarus APT has been observed targeting job seekers with macOS malware working also on Intel and M1 chipsets.

Malware 87

Malware Cryptocurrency Architecture Advertising 87

Security Affairs

NOVEMBER 28, 2022

While the malware written in.NET is new, its deployment is similar to previous attacks attributed to #Sandworm. 1/9 pic.twitter.com/WyxzCZSz84 — ESET research (@ESETresearch) November 25, 2022. In September 2022, Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware.

Ransomware 113

Ransomware Encryption Telecommunications Malware 113

SecureList

APRIL 24, 2023

It is worth noting that while we identified a few targets in other locations, all of them appear to be foreign diplomatic entities of the colored countries: Tomiris’s polyglot toolset Tomiris uses a wide variety of malware implants developed at a rapid pace and in all programming languages imaginable.

Malware 96

Malware DNS Government Software 96

Security Affairs

MAY 16, 2022

Researchers devised an attack technique to tamper the firmware and execute a malware onto a Bluetooth chip when an iPhone is “off.” Unlike NFC and UWB chips, the Bluetooth firmware is neither signed nor encrypted opening the doors to modification. To nominate, please visit:? Pierluigi Paganini.

Malware 93

Malware Wireless Firmware Mobile 93

Security Affairs

NOVEMBER 24, 2022

The operators of the RansomExx ransomware (aka Defray777 and Ransom X) have developed a new variant of their malware, tracked as RansomExx2, that was ported into the Rust programming language. The main reason to rewrite malware in Rust is to have lower AV detection rates, compared to malware written in more common languages.

Ransomware 97

Ransomware Encryption Malware Manufacturing 97

Security Affairs

JULY 15, 2022

RedAlert is human-operated ransomware, the ransomware uses NTRUEncrypt public key encryption algorithm for encryption. crypt[Random number] ” extension to the filenames of encrypted files. The malware appends the “.lilith” lilith” extension to the filenames of encrypted files. log), swap files(.vswp),

Ransomware 123

Ransomware Encryption Malware Hacking 123

Malwarebytes

AUGUST 3, 2022

docx ) that has weaponized with the Follina (CVE-2022-30190) vulnerability to drop Woody Rat. The used lure is in Russian is called " Information security memo " which provide security practices for passwords, confidential information, etc. The malware communicates with its C2 using HTTP requests.

Malware 66

Malware Encryption Antivirus Architecture 66

Security Affairs

JANUARY 18, 2024

Google warns that the Russia-linked threat actor COLDRIVER expands its targeting and is developing a custom malware. Recently, TAG has observed COLDRIVER delivering custom malware via phishing campaigns using PDFs as lure documents. When the victims opens the PDF, an encrypted text is displayed. ” concludes the report.

Phishing 89

Phishing Malware Encryption Accountability 89

Security Affairs

AUGUST 31, 2022

A malware campaign tracked as GO#WEBBFUSCATOR used an image taken from NASA’s James Webb Space Telescope (JWST) as a lure. Securonix Threat researchers uncovered a persistent Golang-based malware campaign tracked as GO#WEBBFUSCATOR that leveraged the deep field image taken from the James Webb telescope. Pierluigi Paganini.

Malware 77

Malware DNS Antivirus Encryption 77

Security Affairs

JANUARY 5, 2024

The seller, who goes online with moniker RET, explained that it wasn’t the author of the ransomware malware, it had acquired the package without a license and cracked the builder version. To each encrypted file, it appends a randomized nine-digit hexadecimal number as an extension. reads the joint advisory.

Ransomware 98

Ransomware Hacking Encryption Malware 98

Thales Cloud Protection & Licensing

MARCH 23, 2022

Shifting Risk and Business Environment Demand creates a Shift in Security Strategies. Thu, 03/24/2022 - 05:00. The 2022 Thales Data Threat Report, based on data from a survey of almost 2,800 respondents from 17 countries across the globe, illustrates these trends and changes. 2022 Report. The quantum computing threat.

Risk 126

Risk Encryption Ransomware Technology 126

Security Affairs

NOVEMBER 21, 2022

The AXLocker ransomware encrypts victims’ files and steals Discord tokens from the infected machine. The malware only targets specific file extensions and excludes a list of directories from the encryption process. The malware appeared in the threat landscape around October 2022 and is offered for USD400.

Ransomware 86

Ransomware Encryption Malware Hacking 86