Security Affairs

FEBRUARY 6, 2024

China-linked APT group breached the Dutch Ministry of Defence last year and installed malware on compromised systems. Dutch Military Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) published a joint report warning that a China-linked APT group breached the Dutch Ministry of Defence last year.

Malware 106

Malware Firmware VPN Backups 106

Krebs on Security

OCTOBER 28, 2020

Linus Larsson , the journalist who broke the story, says the hacked material was uploaded to a public server during the second half of September, and it is not known how many people may have gained access to it. In some cases, this allows the intruders to profit even if their malware somehow fails to do its job. ”

Hacking 342

Hacking Ransomware Banking Accountability 342

Security Affairs

SEPTEMBER 2, 2022

Researchers attribute the Raspberry Robin malware to the Russian cybercrime group known as Evil Corp group. IBM Security X-Force researchers discovered similarities between a component used in the Raspberry Robin malware and a Dridex malware loader, which was part of the malicious operations of the cybercrime gang Evil Corp.

Cybercrime 105

Cybercrime Malware Backups Manufacturing 105

Security Affairs

FEBRUARY 23, 2022

Iranian national media corporation, Islamic Republic of Iran Broadcasting (IRIB), was hit by a wiper malware in late January 2022. Researchers from CheckPoint that investigated the attack reported that the attackers used a wiper malware to disrupt the state’s broadcasting networks, damaging both TV and radio networks.

Malware 104

Malware Passwords Backups Hacking 104

Security Affairs

DECEMBER 24, 2022

“We found samples of the Raspberry Robin malware spreading in telecommunications and government office systems beginning September.” “The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools.”

Government 91

Government Malware Telecommunications Cybercrime 91

Security Affairs

OCTOBER 31, 2022

The infection chain was divided into four stages : The malware was installed through a dropper, a program executed by opening an attachment to a deceptive e-mail, probably a fake pdf or doc file, or executed directly from the Internet, without user interaction, exploiting the exploit described in the point 4. The infection chain.

Malware 97

Malware Computers and Electronics Encryption Ransomware 97

Security Affairs

JULY 29, 2022

Microsoft linked the recently discovered Raspberry Robin Windows malware to the notorious Evil Corp operation. On July 26, 2022, Microsoft researchers discovered that the FakeUpdates malware was being distributed via Raspberry Robin malware. The malware uses TOR exit nodes as a backup C2 infrastructure.

Malware 107

Malware Backups Manufacturing Accountability 107

The Last Watchdog

JUNE 21, 2020

Balaban This ransomware was doing the rounds over spam generated by the Gameover ZeuS botnet, which had been originally launched in 2011 as a toolkit for stealing victim’s banking credentials and was repurposed for malware propagation. These included PClock, CryptoLocker 2.0, Crypt0L0cker, and TorrentLocker. About the essayist.

Ransomware 243

Ransomware Hacking Encryption Penetration Testing 243

Security Affairs

JUNE 6, 2024

The script was also used for data exfiltration, the stolen data are sent to two different servers so the ransomware actors have a backup of the information. The malware then enters “VM mode” to encrypt files with specific extensions. The malware appends the “.locked”

Ransomware 97

Ransomware Encryption Backups Malware 97

Security Affairs

MAY 11, 2021

“The Australian Cyber Security Centre (ACSC) is aware an ongoing ransomware campaign utilising the Avaddon Ransomware malware. Scan emails and attachments to detect and block malware, and implement training and processes to identify phishing and externally-sourced emails. SecurityAffairs – hacking, Avaddon).

Ransomware 127

Ransomware Backups Antivirus DDOS 127

Security Affairs

JUNE 17, 2023

Margaret’s Health is the first hospital to cite a cyberattack as a reason for its closure A database containing data of +8.9 Margaret’s Health is the first hospital to cite a cyberattack as a reason for its closure A database containing data of +8.9

Data breaches 88

Data breaches DDOS Backups Firewall 88

Security Affairs

AUGUST 21, 2020

During the ordinary monitoring of Deepweb and Darkweb , researchers at Cyble came across the leak disclosure post published by the Maze ransomware operators that claim the hack of the Hoa Sen Group. SecurityAffairs – hacking, Maze Ransomware Operators). Hoa Sen Group is the no.1 Pierluigi Paganini.

Ransomware 128

Ransomware Hacking Advertising Backups 128

Security Affairs

NOVEMBER 19, 2023

The Talos researchers discovered a number of features implemented by Phobos allowing operators to establish persistence in a targeted system, perform speedy encryption, and remove backups. Disable system recovery, backup and shadow copies and the Windows firewall. Embedded configuration with more than 70 options available.

Ransomware 124

Ransomware Encryption Backups Manufacturing 124

Security Affairs

AUGUST 30, 2019

PerCSoft is a cloud management provider for Digital Dental Record (DDR), that operates the online data backup service called DDS Safe. DDS Safe, is a HIPAA Compliant 3 layered online dental backup system that provides dental offices triple the protection of traditional online back-up solutions. SecurityAffairs – DDS Safe, hacking).

Backups 92

Backups Ransomware Advertising Encryption 92

Security Affairs

JUNE 16, 2024

Patch it now!

Data breaches 65

Data breaches Hacking Ransomware Cyber Attacks 65

Security Affairs

DECEMBER 24, 2022

“We found samples of the Raspberry Robin malware spreading in telecommunications and government office systems beginning September.” “The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools.”

Government 52

Government Malware Telecommunications Cybercrime 52

Security Affairs

AUGUST 10, 2020

Researchers from threat intelligence firm Cyble reported that Nefilim ransomware operators allegedly hacked The SPIE Group , an independent European leader in multi-technical services. SecurityAffairs – hacking, SPIE group). Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Ransomware 107

Ransomware Hacking Advertising Backups 107

Security Affairs

NOVEMBER 8, 2023

The FBI also published recommendations for organizations to improve their security posture in response to these new activity trends. The FBI also recommends reviewing the security posture of third-party vendors.

Ransomware 106

Ransomware Backups Encryption Phishing 106

Security Affairs

APRIL 9, 2023

Every week the best security articles from Security Affairs are free for you in your email box. A new round of the weekly SecurityAffairs newsletter arrived! billion rubles. billion rubles.

Computers and Electronics 81

Computers and Electronics Backups Cybercrime Marketing 81

Security Affairs

FEBRUARY 11, 2024

Raspberry Robin is a Windows worm discovered by cybersecurity researchers from Red Canary, the malware propagates through removable USB devices. The malware uses TOR exit nodes as a backup C2 infrastructure. The malicious code uses Windows Installer to reach out to QNAP-associated domains and download a malicious DLL.

Malware 113

Malware Backups Manufacturing Hacking 113

Security Affairs

NOVEMBER 24, 2020

Following the takedown, the operators behind the TrickBot malware have implemented several improvements to make it more resilient. What’s more, the malware operators appear to have switched to using MikroTik routers as C&C servers, and were observed using an EmerDNS domain as a backup server. ” contunues the analysis.

Malware 83

Malware Backups Ransomware Hacking 83

Security Affairs

JULY 2, 2023

WordPress sites using the Ultimate Member plugin are under attack LockBit gang demands a $70 million ransom to the semiconductor manufacturing giant TSMC Avast released a free decryptor for the Windows version of the Akira ransomware Iran-linked Charming Kitten APT enhanced its POWERSTAR Backdoor miniOrange’s WordPress Social Login and Register plugin (..)

Cybercrime 86

Cybercrime Hacking Ransomware Malware 86

Security Affairs

DECEMBER 18, 2022

years in jail for spying on behalf of Saudi Arabia Social Blade discloses security breach Data of 5.7M years in jail for spying on behalf of Saudi Arabia Social Blade discloses security breach Data of 5.7M years in jail for spying on behalf of Saudi Arabia Social Blade discloses security breach Data of 5.7M Pierluigi Paganini.

Data breaches 93

Data breaches Hacking DDOS VPN 93

Security Affairs

MAY 4, 2024

Such drastic containment measures are typically associated with malware infections, while the unavailability of affected systems often suggests a ransomware infection. In November 2022, Sentinel Labs researchers reported having found evidence that links the Black Basta ransomware gang to the financially motivated hacking group FIN7.

Ransomware 99

Ransomware Data breaches Malware Backups 99

Security Affairs

JANUARY 17, 2022

The operators of the SFile ransomware (aka Escal) have developed a Linux version of their malware to expand their operations. The principle is simple, according to the authors of the malware, recent files may be more important for some victims and typically they are not included in recent backups. ” reported The Record.

Ransomware 139

Ransomware Encryption Backups Malware 139

Security Affairs

SEPTEMBER 1, 2023

The Key Group ransomware deletes volume shadow copies using living-off-the-land binaries (LOLBINs) and backups made with the Windows Server Backup tool. The ransomware also disables updates from multiple anti-malware solutions (i.e Avast, ESET, and Kaspersky) by modifying the hosts file inside the Windows OS.

Ransomware 112

Ransomware Encryption Backups Malware 112

Security Affairs

APRIL 23, 2021

The malware moves all files stored on the device to password-protected 7zip archives and demand the payment of a $550 ransom. The Taiwanese vendor published a security advisory to warn its customers of the ongoing attacks and is urging them to install the latest Malware Remover version and scan their devices for indicators of compromise.

Ransomware 118

Ransomware Backups Media Malware 118

Security Affairs

JUNE 7, 2022

The QBot malware operation has partnered with Black Basta ransomware group to target organizations worldwide. Researchers from NCC Group spotted a new partnership in the threat landscape between the Black Basta ransomware group and the QBot malware operation. SecurityAffairs – hacking, Black Basta ransomware).

Ransomware 141

Ransomware Backups Malware Firewall 141

Security Affairs

JANUARY 6, 2023

The MegaCortex ransomware first appeared on the threat landscape in May 2019 when it was spotted by security experts at Sophos. The experts noticed that in MegaCortex attacks other malware like Emotet and Qbot (aka Qakbot) were present in the same network. SecurityAffairs – hacking, ransomware). Pierluigi Paganini.

Ransomware 95

Ransomware Antivirus Encryption Backups 95

Security Affairs

MARCH 12, 2023

PlugX malware delivered by exploiting flaws in Chinese programs Prometei botnet evolves and infected +10,000 systems since November 2022 CISA adds VMware’s Cloud Foundation bug to Known Exploited Vulnerabilities Catalog Law enforcement seized the website selling the NetWire RAT and arrested a Croatian man Latest version of Xenomorph Android malware (..)

Data breaches 83

Data breaches Banking Government Ransomware 83

Security Affairs

JULY 5, 2023

The malware allows operators to steal information from various browsers, it also supports ransomware capabilities. The malware communicates with the command and control servers through HTTPS. Furthermore, the malware exhibits stealer functionalities, enabling the theft of user data.”

Energy and Utilities 83

Energy and Utilities Ransomware Backups Malware 83

Security Affairs

AUGUST 26, 2019

A new ransomware, called Nemty ransomware, has been discovered over the weekend by malware researchers. ” Victims could upload their configuration file, in turn, the operators behind the ransomware will provide with the link to another website that comes with a chat function and more information on the demands.

Ransomware 92

Ransomware Malware Antivirus Encryption 92

Security Affairs

NOVEMBER 6, 2022

Cisco addressed several high-severity flaws in its products LockBit ransomware gang claims the hack of Continental automotive group 250+ U.S. Cisco addressed several high-severity flaws in its products LockBit ransomware gang claims the hack of Continental automotive group 250+ U.S. SecurityAffairs – hacking, newsletter).

Hacking 88

Hacking Ransomware Cybercrime Backups 88

Security Affairs

MAY 9, 2024

Below is the request employed in the attacks observed by the experts:, GET /api/v1/totp/user-backup-code/././license/keys-status/{Any The fact that Mirai was delivered through this vulnerability will also mean the deployment of other harmful malware and ransomware is to be expected.

Authentication 97

Authentication Backups Cyber threats Malware 97

Security Affairs

MARCH 26, 2023

NCA infiltrates the cybercriminal underground with fake DDoS-for-hire sites Pwn2Own Vancouver 2023 awarded $1,035,000 and a Tesla for 27 0-days CISA announced the Pre-Ransomware Notifications initiative China-linked hackers target telecommunication providers in the Middle East City of Toronto is one of the victims hacked by Clop gang using GoAnywhere (..)

Data breaches 78

Data breaches DDOS Backups Ransomware 78

Security Affairs

JULY 3, 2022

Raspberry Robin is a Windows worm discovered by cybersecurity researchers from Red Canary, the malware propagates through removable USB devices. The malware uses TOR exit nodes as a backup C2 infrastructure. SecurityAffairs – hacking, malware). In the example below, q:erpbirel.yax deciphers to d:recovery.lnk.”.

Manufacturing 99

Manufacturing Malware Backups Technology 99

Security Affairs

MAY 2, 2021

The company is currently working to restore operations from its backups with the help of experts from HPE and Microsoft. The backup systems can be used for recovery. If you want to receive the weekly Security Affairs Newsletter for free subscribe here. SecurityAffairs – hacking, ransomware). Pierluigi Paganini.

Ransomware 126

Ransomware Backups Cyber Attacks Malware 126