CSO Magazine

APRIL 21, 2023

SimpleHelp itself, as used by the threat actors, has not been compromised — instead, the group has found a way to download the tool from the official website and use it in their attacks, according to a Group-IB blog post. To read this article in full, please click here

Hacking 109

Hacking 109

Security Affairs

JUNE 19, 2019

According to security researchers at Trend Micro, a cyberespionage campaign is targeting Android users in Middle Eastern countries. Security researchers at Trend Micro have spotted a cyberespionage campaign, dubbed ‘Bouncing Golf, that is targeting Android users in Middle Eastern countries. ” Trend Micro concludes.

Mobile 80

Mobile Malware Advertising Encryption 80

Heimadal Security

FEBRUARY 9, 2024

According to a joint alert from CISA, the NSA, the FBI, and partner Five Eyes organizations, the Chinese cyberespionage group Volt Typhoon entered a critical infrastructure network in the United States and remained undiscovered for at least five years before being identified.

Cybersecurity 92

Cybersecurity 92

Heimadal Security

NOVEMBER 7, 2023

Geopolitical agendas further complicate the threat landscape, as cyberattacks such as DDoS or cyberespionage have become part of the arsenal in geopolitical conflicts, such as the […] The post The Most Common Healthcare Cyberattacks appeared first on Heimdal Security Blog.

Healthcare 84

Healthcare Identity Theft Insurance DDOS 84

Heimadal Security

OCTOBER 27, 2023

According to security researchers, the cyberespionage group (also identified as TA473) was able to access the email servers of European governments through HTML email messages containing […] The post European Governments Email Servers Targeted by Threat Actors appeared first on Heimdal Security Blog.

Government 85

Government Cybersecurity 85

Heimadal Security

MAY 5, 2023

Kimsuky, a North Korean hacking group, has been observed employing a new version of its reconnaissance malware called “ReconShark” in a cyberespionage campaign with global reach.

Government 96

Government Malware Hacking Cybersecurity 96

Heimadal Security

OCTOBER 27, 2022

The North Korean cyberespionage group known as Kimsuky has been observed exploiting three different Android malware targeted specifically at South Korean users. The post South Korean Android Users Targeted by Three New Malware Strains appeared first on Heimdal Security Blog.

Malware 115

Malware Cybercrime Cybersecurity 115

Heimadal Security

FEBRUARY 15, 2023

Originating in the military, OPSEC became a popular practice in the private sector as well, helping organizations to protect customer data, address cyberespionage, and information security. OPSEC […] The post What Is OPSEC: Operational Security Explained appeared first on Heimdal Security Blog.

Information Security 96

Information Security Risk Cybersecurity 96

Heimadal Security

JULY 13, 2023

APT29, which is associated with the Russian government‘s Foreign Intelligence Service (SVR), has a history of conducting cyberespionage campaigns worldwide, with a particular focus on NATO, EU, and […] The post International Diplomats Targeted by Russian Hacking Group APT29 appeared first on Heimdal Security Blog.

Hacking 75

Hacking Government Cybersecurity 75

Heimadal Security

JUNE 22, 2023

RedClouds is a recently uncovered cyberespionage and hacking campaign that uses RDStealer malware to steal data from drives shared over Remote Desktop connections. The threat actors behind this campaign, whose identities remain unknown, exhibit advanced skills reminiscent of government-sponsored APT groups.

Government 74

Government Malware Hacking Cybersecurity 74

Heimadal Security

SEPTEMBER 24, 2021

A new cyberespionage group targeting hotels, governments, and private businesses all over the world has been recently spotted by cybersecurity specialists at ESET. According to them, the cyberespionage gang, dubbed FamousSparrow, is an Advanced Persistent Threat (APT) that has been operative since at least 2019.

Government 82

Government Hacking Cybersecurity 82

Heimadal Security

SEPTEMBER 22, 2023

Sandman: How This New Threat Operates In order to maximize its cyberespionage operations, Sandman adopts a low profile to […] The post New Threat Group: Sandman Targets Telecommunication Companies Across the World With Infostealers appeared first on Heimdal Security Blog.

Telecommunications 59

Telecommunications Malware Cybersecurity 59

Heimadal Security

FEBRUARY 14, 2022

Molerats APT group also dubbed TA402 returns by leading a new reportedly cyberespionage campaign that employs NimbleMamba malware. The post Molerats APT Makes a Comeback Now Leveraging NimbleMamba Malware appeared first on Heimdal Security Blog.

Malware 102

Malware Phishing Government Cybersecurity 102

Heimadal Security

JULY 8, 2021

The APT group has been operational since at least 2019 and seems to focus on targets of value in cyberespionage. The post Indian Government Officials Targeted by SideCopy Actors with New RATs appeared first on Heimdal Security Blog. Last […].

Government 117

Government Cybersecurity 117

Heimadal Security

APRIL 19, 2023

The APT28 threat group is known for a wide range of attacks and cyberespionage activities on European and US organizations and also for abusing zero-day exploits. According to Bleepingcomputer: A […] The post APT28 Russian Hackers Inject Routers with Jaguar Tooth Custom Malware appeared first on Heimdal Security Blog.

Malware 71

Malware Cybersecurity 71

Heimadal Security

MARCH 3, 2023

This year, the Chinese cyberespionage group Mustang Panda began deploying a new custom backdoor named ‘MQsTTang’ in attacks. This advanced persistent threat (APT), also known as TA416 and Bronze President, targets organizations worldwide with customized versions of PlugX malware.

Malware 75

Malware Government Cybersecurity 75

Heimadal Security

OCTOBER 1, 2022

Witchetty is reportedly operating a new cyberespionage campaign launched in February […]. The post Backdoor Malware Hidden Inside Windows Logo Image appeared first on Heimdal Security Blog. The group is believed to be heavily tied to the Chinese state-backed threat actor APT10 (“Cicada”).

Malware 77

Malware Hacking Cybersecurity 77

Heimadal Security

FEBRUARY 15, 2023

On Monday, Microsoft attributed a China-based cyberespionage actor to a set of attacks targeting diplomatic entities in South America. Chinese adversarial collectives with links to the Ministry […] The post Chinese Hackers Use ShadowPad Against South American Diplomatic Entities appeared first on Heimdal Security Blog.

Security Intelligence 68

Security Intelligence Cybersecurity 68

Heimadal Security

APRIL 27, 2023

Alloy Taurus is a Chinese nation-state-affiliated threat actor that focuses on cyberespionage and is best known for targeting major telecommunications […] The post Chinese APT Alloy Taurus Is Back – Linux Variant of PingPull Malware Is Active appeared first on Heimdal Security Blog.

Telecommunications 62

Telecommunications Malware Government Cybersecurity 62

Heimadal Security

JANUARY 19, 2023

At least since 2010, the Chinese APT group has conducted cyberespionage campaigns against government and diplomatic entities across North America, South America, Africa, and the Middle East, often operating under the names APT15, KeChang, NICKEL, […] The post BackdoorDiplomacy Is Going after Iranian Government Entities appeared first on Heimdal (..)

Government 52

Government Cybersecurity 52

Heimadal Security

JUNE 10, 2021

Researchers from ESET have recently linked a stealthy cyberespionage group known as Gelsemium to the NoxPlayer Android emulator supply-chain attack that targeted gamers a few months ago. Active since 2014, Gelsemium deploys its malware against a small number of victims, which suggests its involvement in cyberespionage.

Malware 52

Malware Cybersecurity 52

Security Affairs

JUNE 13, 2022

Since 2021, the cyberespionage group has started targeting financial institutions and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia and Vietnam. . The group is improving its cyberespionage capabilities. However, the group has been active at least since 2012.

Telecommunications 88

Telecommunications Government Internet Internet 88

Security Affairs

MAY 4, 2022

A sophisticated cyberespionage campaign, dubbed Operation CuckooBees, conducted by the China-linked Winnti group remained undetected since at least 2019. Researchers from Cybereason uncovered a sophisticated cyberespionage campaign, dubbed Operation CuckooBees, aimed at stealing intellectual property from the victims.

Manufacturing 104

Manufacturing Passwords Malware Hacking 104

Security Affairs

MAY 19, 2022

A new China-linked cyberespionage group known as ‘Space Pirates’ is targeting enterprises in the Russian aerospace industry. A previously unknown Chinese cyberespionage group, tracked as ‘Space Pirates’, targets enterprises in the Russian aerospace industry with spear-phishing attacks. Pierluigi Paganini.

Malware 128

Malware Phishing Government Hacking 128

Security Affairs

MARCH 18, 2022

Google’s Threat Analysis Group (TAG) researchers uncovered cyberespionage operations conducted by the Chinese People’s Liberation Army (PLA) and other China-linked APT groups and that targeted Ukraine’s government to gather info on the ongoing conflict. We will continue to update our recent blog as necessary.

Government 98

Government Engineering Phishing Hacking 98

Security Affairs

APRIL 5, 2022

In November 2021, Ukraine’s premier law enforcement and counterintelligence revealed the real identities of five FSB members behind the Gamaredon cyberespionage group. In December 2019, the APT group targeted several Ukrainian diplomats, government and military officials, and law enforcement. To nominate, please visit:? Pierluigi Paganini.

Phishing 115

Phishing Government Hacking Malware 115

Security Affairs

APRIL 17, 2023

The APT41 group, aka Winnti , Axiom, Barium , Blackfly, HOODOO) is a China-linked cyberespionage group that has been active since at least 2007. The attack took place in October 2022, threat actors sent phishing emails that contained links to a password-protected file hosted in Drive.

Media 93

Media Accountability Government Malware 93

Security Affairs

APRIL 8, 2022

Microsoft on Thursday announced it has obtained a court order to take over seven domains used by Russia-linked cyberespionage group APT28 in attacks against Ukraine. Microsoft obtained a court order to take over seven domains used by the Russia-linked APT28 group to target Ukraine. To nominate, please visit:? Pierluigi Paganini.

Government 111

Government Media Malware Hacking 111

Security Affairs

MAY 3, 2022

Google TAG also observed Russia-linked APT28 (aka Fancy Bear) cyberespionage group targeting users in Ukraine with a new variant of a.Net malware distributed via email attachments inside of password protected zip files (ua_report.zip). The malware is able to steal cookies and saved passwords from Chrome, Edge and Firefox browsers.

Manufacturing 111

Manufacturing Government Phishing Passwords 111

eSecurity Planet

OCTOBER 1, 2022

Vietnamese security firm GTSC published a blog post this week warning of a new zero-day remote code execution (RCE) flaw in Microsoft Exchange Server, which it said has been actively exploited at least since early August. respectively. respectively. We detected webshells, mostly obfuscated, being dropped to Exchange servers,” GTSC wrote.

Malware 123

Malware Government Cybersecurity 123

Security Affairs

APRIL 9, 2022

Experts noticed multiple links between the certificate and multiple China-linked cyberespionage campaigns. Most of the compromised devices acted as ShadowPad C2 servers, most of them shared a unique SSL certificate spoofing Microsoft on port 443. ”concludes the report. To nominate, please visit:? Pierluigi Paganini.

Hacking 82

Hacking Technology Cybersecurity Information Security 82

Security Affairs

JUNE 9, 2022

The APT primary focus on cyberespionage against targets in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. “Aoqin Dragon is an active cyberespionage group that has been operating for nearly a decade. We have observed the Aoqin Dragon group evolve TTPs several times in order to stay under the radar. Pierluigi Paganini.

Malware 83

Malware DNS Encryption Education 83

Security Affairs

JUNE 15, 2023

Symantec researchers reported that in some cases, the cyberespionage group remained undetected in the target networks for three months. Researchers from Symantec, part of Broadcom, blogged about Backdoor.Pterodo in April 2022 , documenting how we had found four variants of the backdoor with similar functionality.”

Malware 81

Malware Government Phishing Hacking 81

Security Affairs

MAY 3, 2022

Both PlugX and ShadowPad malware are very common among China-linked cyberespionage groups. A China-linked APT group, tracked as Moshen Dragon, has been observed targeting the telecommunication sector in Central Asia with ShadowPad and PlugX malware, SentinelOne warns. To nominate, please visit:? Pierluigi Paganini.

Software 106

Software Malware Telecommunications Antivirus 106

Security Affairs

APRIL 6, 2023

Google’s Threat Analysis Group (TAG) warns of a North Korea-linked cyberespionage group tracked as ARCHIPELAGO.

Phishing 79

Phishing Media Passwords Malware 79

Security Affairs

APRIL 13, 2022

The China-backed Hafnium cyberespionage group is likely behind a piece of a new malware, dubbed Tarrask, that’s used to maintain persistence on compromised Windows systems, reported Microsoft Threat Intelligence Center (MSTIC) experts. .” To nominate, please visit:? Follow me on Twitter: @securityaffairs and Facebook.

Malware 107

Malware Education Internet Internet 107

Security Affairs

DECEMBER 1, 2020

Microsoft warns of Vietnam-linked Bismuth group that is deploying cryptocurrency miner while continues its cyberespionage campaigns. Researchers from Microsoft reported that the Vietnam-linked Bismuth group, aka OceanLotus , Cobalt Kitty , or APT32 , is deploying cryptocurrency miners while continues its cyberespionage campaigns.

Cryptocurrency 96

Cryptocurrency Antivirus Manufacturing Government 96