Heimadal Security

FEBRUARY 2, 2023

1,894 web injects (overlays of phishing windows) are for sale on Russian cybercrime forums. The phishing windows are meant to steal credentials from banking, cryptocurrency exchange, and e-commerce apps imitating widely-used software, and they are compatible with various Android banking malware.

Cybercrime 75

Cybercrime Banking Cryptocurrency Phishing 75

Heimadal Security

OCTOBER 27, 2022

The North Korean cyberespionage group known as Kimsuky has been observed exploiting three different Android malware targeted specifically at South Korean users. Kimsuky, also known as Velvet Chollima, Thallium, or Black Banshee, is a North Korean-based cybercrime group with operations going back to 2017.

Malware 116

Malware Cybercrime Cybersecurity 116

Heimadal Security

OCTOBER 26, 2022

A recent federal indictment charges Mark Sokolovsky, a Ukrainian national, for partaking in the Raccoon Infostealer worldwide cybercrime operation, which corrupted millions of computers around the world with malware. Raccoon Stealer is a Trojan that steals information, deployed using the MaaS (malware-as-a-service) approach.

Malware 110

Malware Cybercrime Cybersecurity 110

Heimadal Security

NOVEMBER 23, 2022

At least seven well-known cybercrime groups are using the Aurora malware, either exclusively or in tandem with Redline and […]. The post Hackers Are Increasingly Using Aurora Infostealer Malware appeared first on Heimdal Security Blog.

Malware 91

Malware Cybercrime Cybersecurity 91

Security Affairs

APRIL 15, 2022

The cybercrime gang has been active since at least January 2020. The malware is also able to steal details from cryptocurrency wallets and load additional malware to conduct malicious operations. “It features the ability to steal sensitive information from victims and can download additional malware to infected systems.

Cybercrime 84

Cybercrime Malware Cryptocurrency Hacking 84

Security Affairs

APRIL 11, 2023

The experts pointed out that while the majority of zero-days they have discovered in the past were used by APT groups, this zero-day was exploited by a sophisticated cybercrime group. This group is known to have used similar CLFS driver exploits in the past that were likely developed by the same author.

Cybercrime 90

Cybercrime Ransomware Education Media 90

Security Affairs

MAY 20, 2023

FIN7 is a Russian criminal group (aka Carbanak ) that has been active since mid-2015, it focuses on restaurants, gambling, and hospitality industries in the US to harvest financial information that was used in attacks or sold in cybercrime marketplaces. They then use OpenSSH and Impacket to move laterally and deploy Clop ransomware.

Cybercrime 86

Cybercrime Ransomware Security Intelligence Hacking 86

Security Affairs

MAY 1, 2023

The previously undetected LOBSHOT malware is distributed using Google ads and gives operators VNC access to Windows devices. Threat actors are using an elaborate scheme of fake websites through Google Ads to spread their malware, the backdoors are embedded in installers for apparently legitimate applications, such as AnyDesk.

Malware 87

Malware Cybercrime Banking Software 87

Heimadal Security

SEPTEMBER 6, 2021

It’s possible that the malicious group behind the campaign to be the FIN7 group, a cybercrime group also known as Carbanak or Navigator that specializes in stealing payment card data. The post Windows 11 Alpha-Themed Docs Are Used to Deliver a New Malware appeared first on Heimdal Security Blog. What Happened?

Malware 129

Malware Cybercrime Cybersecurity 129

Heimadal Security

JUNE 3, 2022

Also known as the Dridex gang or INDRIK SPIDER, the Russian cybercriminal gang Evil Corp has been active since at least 2007 and is known for distributing the Dridex malware. In order to circumvent the restrictions imposed by the Office of Foreign Assets Control of the United States Treasury Department, the cybercrime organization […].

Malware 88

Malware Cybercrime Cybersecurity 88

Heimadal Security

JULY 19, 2022

Security experts think that Roaming Mantis is a financially-motivated Chinese cybercrime group that began attacking individuals living in Europe […]. The post Android and iOS Users Targeted in Malware, Phishing Attacks Conducted by Roaming Mantis Threat Actor appeared first on Heimdal Security Blog.

Phishing 119

Phishing Malware Cybercrime Cybersecurity 119

Heimadal Security

DECEMBER 10, 2021

The Advanced Persistent Threat (APT) known as StrongPity is distributing malware-laced Notepad++ installers to infect their victims. The post StrongPity Malware Spread Using Malicious Notepad++ Installers appeared first on Heimdal Security Blog. APT #StrongPity NotePad++ installer(npp.8.1.7.Installer.x64.exe) Installer.x64.exe)

Malware 94

Malware Cybercrime Cybersecurity 94

Security Affairs

APRIL 24, 2023

It is interesting to note that the domain was also hosting malware a variant of the TrueBot malware. .” The researchers noticed that the domain hosting the tools employed in the attack, windowservicecemter[.]com, com, was registered on April 12, 2023.

Cybercrime 74

Cybercrime Software Education Ransomware 74

Security Boulevard

JANUARY 7, 2024

Recent reports have highlighted the return of the Carbanak Malware. As per the reports, it’s a banking malware used in ransomware attacks that leverages updated tactics for increased effectiveness. In this blog, we’ll […] The post Alert: Carbanak Malware Strikes Again With Updated Tactics appeared first on TuxCare.

Malware 69

Malware Banking Ransomware Software 69

Krebs on Security

JANUARY 24, 2023

Denis Emelyantsev , a 36-year-old Russian man accused of running a massive botnet called RSOCKS that stitched malware into millions of devices worldwide, pleaded guilty to two counts of computer crime violations in a California courtroom this week. Kloster’s blog enthused. “We A copy of the passport for Denis Emelyantsev, a.k.a.

Cybercrime 221

Cybercrime Advertising IoT Malware 221

Security Boulevard

JUNE 6, 2023

On this forum, malicious actors can share various hacking techniques, malware samples, and proof of concept for exploits. The post Exploit Forum, Initial Access Brokers, and Cybercrime on the Dark Web appeared first on Security Boulevard.

Cybercrime 52

Cybercrime Cyber threats Malware Risk 52

Security Boulevard

NOVEMBER 2, 2022

Dear blog readers, Do you know a lot about information security cybercrime research OSINT and threat intelligence gathering including cyber threat actors research? Who is Dancho Danchev and what is Dancho Danchev's Blog? The post Who Wants to Become a Guest Blogger At This Blog? Stay tuned!

Cybercrime 52

Cybercrime InfoSec Cyber threats Accountability 52

Security Affairs

JUNE 9, 2022

Researchers uncovered a high stealth Linux malware, dubbed Symbiote, that could be used to backdoor infected systems. Once the malware has infected all the running processes, it provides the threat actor with rootkit capability and supports data-stealing capabilities. “Symbiote is a malware that is highly evasive.

Malware 144

Malware DNS Antivirus Passwords 144

Security Affairs

MAY 3, 2023

Threat actors are using the promise of generative AI like ChatGPT to deliver malware, Facebook parent Meta warned. Threat actors are taking advantage of the huge interest in generative AI like ChatGPT to trick victims into installing malware, Meta warns. ” reads the Meta’s Q1 2023 Security Reports.

Malware 94

Malware Education Accountability Media 94

Security Affairs

MAY 24, 2022

Interpol Secretary warns that nation-state malware will become available on the cybercrime underground in a couple of years. In the ongoing conflict between Russia and Ukraine, the malware developed by both nation-state actors and non state actors represents a serious risk for critical infrastructure and organizations worldwide.

Malware 105

Malware Cybercrime Government Engineering 105

Security Affairs

MAY 30, 2022

The researchers attribute the botnet to the cybercrime group Keksec which focuses on DDoS-based extortion. Experts pointed out that the malware is being actively developed. The malware can quickly adopt one-day vulnerabilities (within days of a published proof of concept).” ” concludes the report.

Malware 141

Malware DDOS IoT Cybercrime 141

Security Affairs

APRIL 24, 2023

EvilExtractor is a new “all-in-one” info stealer for Windows that is being advertised for sale on dark web cybercrime forums. The malware environment checking and Anti-VM functions. FortiGuard Labs observed this malware in a phishing email campaign on 30 March, which we traced back to the samples included in this blog.”

Cybercrime 87

Cybercrime Malware Education Phishing 87

Security Affairs

APRIL 25, 2023

North Korea-linked APT group BlueNoroff (aka Lazarus) was spotted targeting Mac users with new RustBucket malware. Researchers from security firm Jamf observed the North Korea-linked BlueNoroff APT group using a new macOS malware, dubbed RustBucket, family in recent attacks. The trojan can run on both ARM and x86 architectures.

Malware 82

Malware Social Engineering Architecture Education 82

Graham Cluley

SEPTEMBER 8, 2021

I hate to give advice to those who work for cybercrime gangs, but maybe - if they care about their liberty - they should think long and hard before making any international travel plans. Read more in my article on the Hot for Security blog.

Cybercrime 98

Cybercrime Malware Ransomware 98

Heimadal Security

AUGUST 18, 2023

As the cybercrime landscape evolves, you may wonder if the old Antivirus solution that you have installed on your organization’s endpoints still does the job. Traditional antivirus software initially offered sufficient defense against the majority of viruses before they evolved into other types of malware.

Antivirus 90

Antivirus Cybercrime Malware Software 90

SiteLock

AUGUST 27, 2021

In a recent interview with Barry Moltz on Blog Talk Radio, Neill Feather, President of SiteLock, responds to the growing concern, particularly for small businesses, of website risks and how adding website security can protect online businesses and their reputation. Protect your website from hackers and cybercrime.

Cybercrime 52

Cybercrime Small Business Malware Technology 52

Krebs on Security

SEPTEMBER 24, 2022

A native of Omsk, Russia, Kloster came into focus after KrebsOnSecurity followed clues from the RSOCKS botnet master’s identity on the cybercrime forums to Kloster’s personal blog , which featured musings on the challenges of running a company that sells “security and anonymity services to customers around the world.”

Cybercrime 207

Cybercrime Data breaches Malware Ransomware 207

Security Affairs

MAY 1, 2023

Iranian authorities have been spotted using the BouldSpy Android malware to spy on minorities and traffickers. Despite BouldSpy spyware supports ransomware capabilities, Lookout researchers have yet to see the malicious code using them, a circumstance that suggests the malware is under development or it is a false flag used by its operators.

Surveillance 77

Surveillance Malware Spyware Education 77

Security Affairs

APRIL 5, 2023

The eFile.com online service, which is authorized by the US Internal Revenue Service (IRS), was spotted serving malicious malware to visitors. eFile.com , the personal online tax preparation and e-file service authorized by the US Internal Revenue Service (IRS), was spotted serving malware to visitors.

Malware 79

Malware Education Media Internet 79

Security Affairs

APRIL 28, 2022

Threat actors have replaced the BazaLoader and IcedID malware with a new loader called Bumblebee in their campaigns. Cybercriminal groups that were previously using the BazaLoader and IcedID as part of their malware campaigns seem to have adopted a new loader called Bumblebee. It is used by multiple cybercrime threat actors.”

Malware 80

Malware Cybercrime Encryption Hacking 80

Security Affairs

APRIL 13, 2023

Security experts warn that a Kyocera Android printing app is vulnerable to improper intent handling and can be abused to drop malware. An improper intent handling issue affecting the Kyocera Android printing app can allow malicious applications to drop malware.

Malware 94

Malware Mobile Education Media 94

Heimadal Security

MAY 24, 2021

Check Point noted more than half a year ago that Phorpiex was distributing the new Avaddon cybersecurity service that was destined to be rented out to cybercrime groups to […]. The post Long-Lasting Malware Bot Phorpiex Adapts and Has New Ways of Deployment appeared first on Heimdal Security Blog.

Malware 62

Malware Antivirus Cybercrime Cybersecurity 62

Krebs on Security

JANUARY 27, 2021

and Bulgarian authorities this week seized the darkweb site used by the NetWalker ransomware cybercrime group to publish data stolen from its victims. The following advertisement (translated into English by cybersecurity firm Intel 471 ) was posted by the NetWalker affiliate program manager last year to a top cybercrime forum.

Ransomware 283

Ransomware Cybercrime Antivirus Encryption 283

Security Affairs

APRIL 28, 2023

to disrupt the operations of the CryptBot malware, which experts estimate infected approximately 670,000 computers this past year. Google targeted the distributors of the malware who are paid to spread and deliver the malicious code and infect a larger number of systems as possible. ” reads the announcement published by Google.

Malware 92

Malware Cybercrime Cryptocurrency Media 92

Security Affairs

MARCH 2, 2023

Cyber criminals are targeting law firms with GootLoader and FakeUpdates (aka SocGholish) malware families. The firms were targeted as part of two distinct campaigns aimed at distributing GootLoader and FakeUpdates (aka SocGholish) malware. One campaign attempted to infect law firm employees with the GootLoader malware.

Malware 81

Malware Ransomware Engineering Internet 81

Spinone

OCTOBER 10, 2019

The best way to stay up-to-date with the recent trends is by reading the top cybersecurity blogs. Here’s our list of the best cybersecurity blogs to read and follow. Securing Tomorrow SecuringTomorrow is a blog by McAfee, one of the biggest security software providers. Their main focus is on cybercrime investigations.

Cybersecurity 56

Cybersecurity IoT Antivirus Education 56

Security Affairs

APRIL 30, 2023

Nominate here: [link] Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, newsletter ) The post Security Affairs newsletter Round 417 by Pierluigi Paganini – International edition appeared first on Security Affairs.

Cybercrime 88

Cybercrime Malware Hacking Accountability 88