Security Affairs

JANUARY 16, 2023

Antivirus firm Avast released a free decryptor for the BianLian ransomware family that allows victims to recover locked files. Security firm Avast has released a free decryptor for the BianLian ransomware to allow victims of the malware to recover locked files. It is also recommendable to check the virus vault of your antivirus.

Ransomware 94

Ransomware Malware Antivirus Encryption 94

Security Affairs

DECEMBER 12, 2021

. “A Russian national was sentenced today to 48 months in prison for operating a “crypting” service used to conceal the Kelihos malware from antivirus software, which enabled hackers to systematically infect approximately hundreds of thousands of victim computers around the world with malicious software, including ransomware.”

Antivirus 89

Antivirus Malware Cybercrime Cyber threats 89

Security Affairs

MARCH 20, 2023

Avast researchers reported that threat actors are abusing the legitimate Adobe Acrobat Sign service to distribute the RedLine information stealer. Adobe Acrobat Sign allows registered users to sign documents online and send a document signature request to anyone. ” reads the anaysis published by Avast.

Antivirus 77

Antivirus Malware Engineering Hacking 77

Security Affairs

DECEMBER 1, 2021

The RTF template injection technique abuses legitimate RTF template functionality to subvert the plain text document formatting properties of the file and retrieve a malicious payload from a remote server instead of a file resource via an RTF’s template control word capability. ” reads the analysis published by ProofPoint.

Phishing 122

Phishing Antivirus Engineering Hacking 122

Security Affairs

JUNE 14, 2021

Microsoft 365 Defender data shows that the SEO poisoning technique is effective, given that Microsoft Defender Antivirus has detected and blocked thousands of these PDF documents in numerous environments. — Microsoft Security Intelligence (@MsftSecIntel) June 11, 2021. ” state Microsoft.

Antivirus 70

Antivirus Security Intelligence Malware Insurance 70

Security Affairs

FEBRUARY 22, 2021

APOMacroSploit is a macro builder that was to create weaponized Excel documents used in multiple phishing attacks. Excel documents created with the APOMacroSploit builder are capable of bypassing antivirus software, Windows Antimalware Scan Interface (AMSI), and even Gmail and other email-based phishing detection.

Malware 115

Malware Antivirus Phishing Cryptocurrency 115

Security Affairs

AUGUST 31, 2021

The operators behind LockFile ransomware encrypt alternate blocks of 16 bytes in a document to evade detection. Instead, LockFile encrypts every other 16 bytes of a document. This means that a file such as a text document remains partially readable and looks statistically like the original. ” states Sophos.

Encryption 109

Encryption Ransomware Financial Services Antivirus 109

Security Affairs

SEPTEMBER 7, 2020

Recent spam campaigns used messages with malicious Word documents, or links to them, pretending to be an invoice, shipping information, COVID-19 information , resumes, financial documents, or scanned documents. Generally speaking, removal/cleaning by antivirus is not a sufficient guarantee.

Malware 115

Malware Advertising Antivirus Banking 115

Security Affairs

NOVEMBER 30, 2021

“VirusTotal does not showcase the evolution of detections of antivirus products over time, but almost all campaigns have or had a 0/62 FUD score on VirusTotal at some point in time, confirming the difficulty of detecting dropper apps with a minimal footprint.” ” reads the analysis published by the experts.

Banking 96

Banking Antivirus Malware Authentication 96

CyberSecurity Insiders

JANUARY 6, 2023

Test security of systems and networks regularly. Support information security within organizational policies and programs. Requirement 5: It is no longer sufficient to just have standard antivirus software. Restrict physical access to cardholder data. Log and monitor all access to system components and cardholder data.

Antivirus 138

Antivirus Retail Software Accountability 138

Security Affairs

OCTOBER 6, 2020

Recent spam campaigns used messages with malicious Word documents, or links to them, pretending to be an invoice, shipping information, COVID-19 information , resumes, financial documents, or scanned documents. In the middle-August, the malware was employed in fresh COVID19-themed spam campaign.

Government 136

Government Banking Advertising Malware 136

Security Affairs

JANUARY 7, 2021

“Both exchanges require identity documents in order to exchange cryptocurrencies for fiat or to make transfers to banks, however it isn’t clear if the documents they accept are scrutinized in any meaningful way. ” If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Ransomware 131

Ransomware Cryptocurrency Antivirus Banking 131

Security Affairs

JANUARY 20, 2020

” This new RAT is dropped to the victims via malicious Microsoft Office documents.” “The dropper, along with the Python RAT, attempts to gather information on the victim’s machine and then uses multiple cloud services: Google Drive, Twitter, ImgBB and Google Forms.”

Antivirus 67

Antivirus Malware Advertising Accountability 67

Security Affairs

AUGUST 23, 2020

A bug in Google Drive could be exploited by threat actors to distribute malicious files disguised as legitimate documents or images. An unpatched weakness in Google Drive could be exploited by threat actors to distribute weaponized files disguised as legitimate documents or images.

Malware 134

Malware Phishing Advertising Antivirus 134

Security Affairs

MAY 22, 2021

. “The main goal of the hackers was to completely compromise the IT infrastructure and steal confidential information, including documents from closed segments and mail correspondence of key federal executive authorities.” Group to download the collected data.

Computers and Electronics 116

Computers and Electronics Malware Antivirus Government 116

Security Affairs

JULY 1, 2019

On June 26, 2019, experts at eSentire Threat Intelligence discovered a C2 infrastructure pointing to a similar Dridex variant that was undetected by most of the antivirus listed in VirusTotal service. At the time of discovery, using data from VirusTotal, only six antivirus solutions of about 60 detected suspicious behavior [ 2 ].

Banking 78

Banking Antivirus Advertising Encryption 78

CyberSecurity Insiders

MAY 17, 2023

This can include measures such as firewalls , antivirus, access management and data backup policies, etc. ISO/IEC 27001 ISO/IEC 27001 is an international standard that provides a framework for information security management systems (ISMS). It outlines best practices for managing and protecting sensitive information.

Cybersecurity 124

Cybersecurity Risk Insurance Firewall 124

Security Affairs

DECEMBER 28, 2021

The tool also includes features to bypass Antivirus engines and perform other malicious activities. . The leak was by the experts as “ Lost in Translation ” leak. . DanderSpritz has a modular structure and includes a wide variety of tools for persistence, reconnaissance, lateral movement.

Antivirus 95

Antivirus Malware Hacking Engineering 95

Security Affairs

AUGUST 9, 2022

The emails used weaponized Microsoft Word documents exploiting the CVE-2017-11882 vulnerability. EXE which is responsible for the insertion and editing of equations (OLE objects) in documents. The CVE-2017-11882 flaw is a memory-corruption issue that affects all versions of Microsoft Office released between 2000 and 2017.

Antivirus 101

Antivirus Encryption Malware Hacking 101

Security Affairs

JULY 10, 2020

The archive contains LNK (shortcut) files that extract and execute JavaScript code while displaying a decoy document (usually a photo of an ID, credit card, or a bill to prove the physical address). The version 4.0 The image is stored in a file called SC4.P7D

eCommerce 99

eCommerce Advertising Malware Spyware 99

Security Affairs

AUGUST 28, 2022

Twilio hackers also breached the food delivery firm DoorDash Unprecedented cyber attack hit State Infrastructure of Montenegro Threat actor abuses Genshin Impact Anti-Cheat driver to disable antivirus Critical flaw impacts Atlassian Bitbucket Server and Data Center Iran-linked Mercury APT exploited Log4Shell in SysAid Apps for initial access GoldDragon (..)

DDOS 74

DDOS Data breaches Malware Antivirus 74

Security Affairs

MAY 23, 2019

The first two are techniques related to Office documents, used to hide malicious payload and lure the users. The third one is related to binary payloads abusing code signature tricks to evade traditional security controls. External resource in the analyzed document. Corrupted document. Classic phishing document view.

Antivirus 84

Antivirus Malware Advertising Cyber Attacks 84

Security Affairs

JUNE 7, 2021

In February, the Ukraine ‘s government blamed a Russia-linked APT group for an attack on a government document management system, the System of Electronic Interaction of Executive Bodies (SEI EB). According to Ukrainian officials, the hackers aimed at disseminating malicious documents to government agencies.

Phishing 95

Phishing Government Antivirus Passwords 95

SecureList

OCTOBER 18, 2023

Each phishing document contains an external link to fetch a remote page containing a CVE-2021-26411 exploit. The attackers continued to send malicious documents via email until the end of September 2022. Next, they were able to access the control panels of two security solutions simultaneously.

Malware 97

Malware Phishing Internet Internet 97

Security Affairs

FEBRUARY 16, 2021

Latin American Javali trojan weaponizing Avira antivirus legitimate injector to implant malware. After that, the following files are extracted, namely: Avira.exe : Legitimate injector from Avira Antivirus. In the last few years, many banking trojans developed by Latin American criminals have increased in volume and sophistication.

Antivirus 121

Antivirus Malware Banking Internet 121

Security Affairs

SEPTEMBER 28, 2020

“When the attack happened multiple antivirus programs were disabled by the attack and hard drives just lit up with activity. ” Some reports circulating online reveal that the ransomware added the “ ryk” extension to the filenames of encrypted documents, a circumstance that confirms a Ryuk ransomware infection.

Ransomware 119

Ransomware Healthcare Advertising Antivirus 119

Security Affairs

AUGUST 31, 2022

Upon opening the document, a malicious template file is downloaded and saved on the system. At the time of publication, this particular file is undetected by all antivirus vendors according to VirusTotal” The Base64 encoded payload, once decrypted, is a Windows 64-bit executable (1.7MB) called “msdllupdate.exe.”.

Malware 85

Malware DNS Antivirus Encryption 85

Security Affairs

SEPTEMBER 20, 2019

Once provided the login credentials, the user will be informed of a pending refund and will be asked to download a document, print and sign it. The signed document has to be sent or uploaded to the portal. The analysis published by Cofense includes the Indicators of Compromise (IoCs).

Phishing 83

Phishing Social Engineering Malware Advertising 83

Notice Bored

OCTOBER 14, 2021

"Information transfer" is another ambiguous, potentially misleading title for a policy, even if it includes "information security". Transmission of information through broadcasting, training and awareness activities, reporting, policies, documentation, seminars, publications, blogs etc.,

Information Security 56

Information Security Risk Media Encryption 56

Security Affairs

JUNE 11, 2021

Most of the stolen files (50%+) were text files, some of them containing software logs, passwords, personal notes, and other sensitive information. Experts found over 650,000 Word documents and.pdf files in the archive. More than 1 million images have been stolen by the malware, including 696,000.png png and 224,000.jpg

Malware 115

Malware Computers and Electronics Software Financial Services 115

SecureWorld News

JANUARY 28, 2021

One way that EMOTET was so effective was due to its ability to spread via word documents. In the past, EMOTET email campaigns have also been presented as invoices, shipping notices and information about COVID-19. Most antivirus programs look for known malware codes, making a code change difficult to be detected.

Cybercrime 52

Cybercrime Malware Antivirus Banking 52

Security Affairs

JUNE 17, 2021

In the documented attack, once the backdoor is deployed, UNC2465 interactively established an NGROK tunnel and performed lateral movements in less than 24 hours. “A well-rounded security program is essential to mitigate risk from sophisticated groups such as UNC2465 as they continue to adapt to a changing security landscape.”

Cybercrime 106

Cybercrime Ransomware Antivirus Software 106

SecureList

DECEMBER 14, 2020

Detecting an exploit or trojan that explicitly runs on a device is not a problem for an antivirus solution. For example, when a phishing email document is opened in Microsoft Office, all actions will be performed by the office application. Fin7 document with DDE execution. Legitimate software can hide risks. gov/fonts.txt')).

Technology 70

Technology Malware Antivirus Software 70

Security Affairs

MAY 7, 2020

When malware initiates, it requests Google Drive documents for details on the C2’s IP address. This new threat takes advantage of google-sites and Google Drive documents to distribute the threat in Portugal. This is a mechanism that makes C2 persistence and dynamics. The high-level diagram of this threat is presented below.

Banking 113

Banking Malware Phishing Social Engineering 113

Security Affairs

MARCH 2, 2019

In February 2019, SI-LAB captured multiple samples of phishing campaigns using an Office Excel document carrying a malicious Excel 4.0 This technology is stored in the Workbook OLE stream in Excel 97-2003 format which makes it very difficult to detect and parse by antivirus (AV) engines. macro code.

Malware 86

Malware Antivirus Technology Phishing 86

Lenny Zeltser

OCTOBER 12, 2018

” Eugene was prophetic in predicting that fileless malware “will become one of the most widespread forms of malicious programs” due to antivirus’ ineffectiveness against such threats. Paul Rascagnères at G Data mentioned that Poweliks infected systems by using a boobietrapped Microsoft Word document.

Malware 84

Malware Antivirus Software Cybersecurity 84

Centraleyes

MARCH 12, 2024

Audit Focus: Review and assess documentation to verify compliance with industry standards (ISO 27001, NIST, GDPR, etc.) Evaluate the organization’s processes for staying informed about changes in regulations and promptly adapting to them. and applicable regulations.

Risk 52

Risk Cybersecurity Government Firewall 52