Security Affairs

APRIL 26, 2023

On March 7, 2023, the researchers found a Linux variant of the PingPull that was uploaded to VirusTotal, it had a very low detection rate (3 out of 62) “Despite a largely benign verdict, additional analysis has determined that this sample is a Linux variant of PingPull malware. ” reads the analysis published by Unit 42.

Malware 95

Malware Telecommunications Government VPN 95

Security Affairs

MAY 1, 2023

Iranian authorities have been spotted using the BouldSpy Android malware to spy on minorities and traffickers. The researchers are tracking the spyware since March 2020, starting in 2023, multiple security experts [ 1 , 2 ] started monitoring its activity.

Surveillance 79

Surveillance Malware Spyware Education 79

Security Affairs

APRIL 5, 2023

The eFile.com online service, which is authorized by the US Internal Revenue Service (IRS), was spotted serving malicious malware to visitors. eFile.com , the personal online tax preparation and e-file service authorized by the US Internal Revenue Service (IRS), was spotted serving malware to visitors.

Malware 81

Malware Education Media Hacking 81

SC Magazine

MARCH 5, 2021

The author claims the program, dubbed Povlsomware, is designed to be an educational tool for testing anti-virus protections; however, it’s possible that cybercriminals could adopt and modify the code in order to launch their own attacks, warns Trend Micro, which detailed the ransomware in a new company blog post this week.

Education 82

Education Ransomware Malware Cybercrime 82

Security Affairs

APRIL 13, 2022

China-linked Hafnium APT group started using a new piece of new malware to gain persistence on compromised Windows systems. HAFNIUM primarily targets entities in the United States across multiple industries, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.

Malware 107

Malware Education Internet Internet 107

Spinone

OCTOBER 10, 2019

The best way to stay up-to-date with the recent trends is by reading the top cybersecurity blogs. Here’s our list of the best cybersecurity blogs to read and follow. Securing Tomorrow SecuringTomorrow is a blog by McAfee, one of the biggest security software providers.

Cybersecurity 56

Cybersecurity IoT Antivirus Education 56

Security Affairs

APRIL 24, 2023

The tool was developed by a company named Kodex, which claims that the tool was developed for an educational purpose. The malware environment checking and Anti-VM functions. FortiGuard Labs observed this malware in a phishing email campaign on 30 March, which we traced back to the samples included in this blog.”

Cybercrime 89

Cybercrime Malware Education Phishing 89

Security Affairs

APRIL 18, 2023

The two companies teamed up with Flare to curb the operations of the malware operators. The experts discovered that the malware control panels use GitHub repositories as dead-drop resolvers. The info-stealer is considered a commodity malware that is available through malware-as-a-service model.

Malware 87

Malware Education Media Authentication 87

Security Affairs

APRIL 29, 2023

Atomic macOS Stealer is a new information stealer targeting macOS that is advertised on Telegram for $1,000 per month. Cyble Research and Intelligence Labs (CRIL) recently discovered a Telegram channel advertising a new information-stealing malware, named Atomic macOS Stealer (AMOS). ” reads the report published by Cyble.

Advertising 82

Advertising Passwords Malware Password Management 82

Security Affairs

APRIL 7, 2023

.” The company reported the security breach to the relevant authorities, and it downplayed the incident, saying that the attack had no significant financial and operational impact. In response to the incident, the company announced it is enhancing the information security control measures of its network and infrastructure.

Ransomware 87

Ransomware Firmware Hacking Manufacturing 87

Security Affairs

APRIL 28, 2023

Google announced that a federal judge in the Southern District of New York unsealed its civil action against the operators of the information stealer Cryptbot. to disrupt the operations of the CryptBot malware, which experts estimate infected approximately 670,000 computers this past year. ” concludes the announcemebt.

Malware 93

Malware Cybercrime Cryptocurrency Media 93

Security Affairs

APRIL 20, 2023

Threat actors are hacking poorly secured and Interned-exposed Microsoft SQL servers to deploy the Trigona ransomware. Threat actors are hacking into poorly secured and public-facing Microsoft SQL servers to deploy Trigona ransomware. “V3 should be updated to the latest version so that malware infection can be prevented.

Ransomware 84

Ransomware Malware Encryption Hacking 84

Security Affairs

APRIL 29, 2023

A new variant of the information-stealing malware ViperSoftX implements sophisticated techniques to avoid detection. Trend Micro researchers observed a new ViperSoftX malware campaign that unlike previous attacks relies on DLL sideloading for its arrival and execution technique. c2 arrowlchat[.]com ” continues the report.

Encryption 88

Encryption Malware Cryptocurrency Software 88

Security Affairs

APRIL 17, 2023

Kaspersky researchers warn of a new QBot campaign leveraging hijacked business emails to deliver malware. In early April, Kaspersky experts observed a surge in attacks that QBot malware attacks (aka Qakbot , QuackBot, and Pinkslipbot ). Its modular structure allows operators to implement new features to extend their capabilities.

Malware 91

Malware Education Banking Media 91

Security Affairs

APRIL 20, 2023

On September 2022, the Sandworm group was observed impersonating telecommunication providers to target Ukrainian entities with malware. The group targeted multiple sectors, including government, defense, energy, transportation/logistics, education, and humanitarian organizations. and similar services.

Phishing 88

Phishing Education Accountability Telecommunications 88

Security Affairs

APRIL 27, 2023

Microsoft 365 Defender detects the exploitation, malware, & malicious activity in these Lace Tempest attacks. Microsoft is also monitoring a separate cluster of attacks exploiting PaperCut flaws to deliver the Lockbit ransomware. The company warns that other financially motivated groups could adopt a similar infection chain.

Ransomware 84

Ransomware Education Media Malware 84

Security Affairs

APRIL 30, 2023

Nominate here: [link] Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, newsletter ) The post Security Affairs newsletter Round 417 by Pierluigi Paganini – International edition appeared first on Security Affairs.

Cybercrime 89

Cybercrime Malware Hacking Accountability 89

Security Affairs

MAY 2, 2023

North Korea-linked ScarCruft APT group started using oversized LNK files to deliver the RokRAT malware starting in early July 2022. The infection chain used by the threat actors relies on large LNK files running PowerShell, leading to the execution of the previously undetected malware. ” concludes the report.

Malware 84

Malware Education Media Phishing 84

Security Affairs

APRIL 3, 2023

FortiGuard Labs researchers observed an ongoing hacking campaign targeting Cacti ( CVE-2022-46169 ) and Realtek ( CVE-2021-35394 ) vulnerabilities to spread ShellBot and Moobot malware. “Over the past few months, threat actors have been spreading ShellBot and Moobot malware on exploitable servers. ” concludes the report.

DDOS 84

DDOS Malware Hacking Education 84

Security Affairs

APRIL 27, 2023

The gang’s affiliates must keep the RTM Locker malware builds private to prevent they can be analyzed. Its malware is specifically geared toward ESXi hosts, as it contains two related commands. The affiliates are obliged to remain active, or their account will be removed after 10 days without notifying them upfront.

Encryption 87

Encryption Ransomware Malware Education 87

Security Affairs

APRIL 15, 2023

A new Android malware named Goldoson was distributed through 60 legitimate apps on the official Google Play store. ” The library can load web pages without user awareness, this means that the malware can load ads for financial profit.

Data collection 95

Data collection Mobile Malware Education 95

The Last Watchdog

APRIL 13, 2022

Educate your employees on threats and risks such as phishing and malware. Enforce strong passwords and implement multi-factor authentication (MFA) — by educating users about using a unique password for each account and enforcing higher security for privileged accounts (administrators, root).

Cybersecurity 214

Cybersecurity Cybercrime Education Government 214

Security Affairs

APRIL 16, 2023

Nominate here: [link] Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, LockBit ) The post Experts found the first LockBit encryptor that targets macOS systems appeared first on Security Affairs. It appears we are late to the game.

Encryption 97

Encryption Architecture Ransomware Education 97

Security Affairs

APRIL 17, 2023

The malware can exfiltrate collected data via Telegram chat using the Telegram Bot API. The experts believe that the tool is widely distributed and is likely paid malware. The sample analyzed by Cado Labs is a Python3 script of 21015 lines, it includes configurations for integrating with services such as Twilio and Shodan.

Mobile 87

Mobile Hacking Malware Accountability 87

Security Affairs

APRIL 16, 2023

In 2021, CISA added Remcos to the list of top malware strains due to its use in mass phishing attacks using COVID-19 pandemic themes targeting businesses and individuals. The phishing attacks began in February 2023, the IT giant reported.

Accountability 90

Accountability Phishing Financial Services Surveillance 90

Security Affairs

APRIL 17, 2023

” Upon installing the malware on the target system, it queries Google Sheets to obtain attacker commands. Secondly, it also points to the growing adoption of malware and tools written in the Go programming language, owing to its cross-platform compatibility and its modular nature. ” continues the report.

Media 94

Media Accountability Government Malware 94

Security Affairs

MAY 2, 2023

“Through exchanges, attackers channeled assets obtained as a result of malware attacks (cryptoviruses) and online fraud. Such services were provided to facilitate the legalization and laundering of money obtained illegally.” ” states the press release published by the Ukraine’s Cyber Police.

Cybercrime 89

Cybercrime Cryptocurrency Advertising Education 89

Security Affairs

APRIL 7, 2023

. “More specifically, cracked versions of Cobalt Strike allow Defendants to gain control of their victim’s machine and move laterally through the connected network to find other victims and install malware. ” reads the court order. ” Example of an attack flow by threat actor DEV-0243. .”

Penetration Testing 84

Penetration Testing Ransomware Malware Hacking 84

Security Affairs

APRIL 4, 2023

The products from multiple cybersecurity vendors started detecting the popular software as malware suggesting that the company has suffered a supply chain attack. Upon executing the Gopuram backdoor, the malware connects to a C2 server and await further commands. The backdoor is able to launch at least eight in-memory modules.

Cryptocurrency 81

Cryptocurrency Malware Software Manufacturing 81

Security Affairs

APRIL 6, 2023

. “When recipients replied expressing interest in an interview, ARCHIPELAGO continued the correspondence over several emails before finally sending a OneDrive link to a password-protected file that contained malware.” ” The threat actor has also sent links that lead to “ browser-in-the-browser ” phishing pages.

Phishing 82

Phishing Media Passwords Malware 82

Security Affairs

APRIL 19, 2023

Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks. According to the joint report, APT28 exploited the known vulnerability to carry out reconnaissance and reploy malware on unpatched Cisco routers. For some of the targeted devices, threat actors abused an SNMP exploit to deploy the Jaguar Tooth Malware.

Malware 86

Malware Firmware Government Education 86

Security Affairs

MAY 4, 2023

However, CBS News Texas obtained an image the ransomware note dropped by the malware on the infected systems. According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. Source J.D.

Ransomware 93

Ransomware Healthcare Education Encryption 93

Security Affairs

APRIL 30, 2023

Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks. The group operates out of military unity 26165 of the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS).

System Administration 92

System Administration Government Phishing Malware 92

Security Affairs

JUNE 15, 2022

Researchers discovered a new Golang-based peer-to-peer (P2P) botnet, dubbed Panchan, targeting Linux servers in the education sector since March 2022. Akamai security researchers discovered a new Golang-based P2P Botnet, tracked as Panchan, that is targeting Linux servers that has been active since March 2022. Pierluigi Paganini.

Malware 91

Malware Cryptocurrency Education Engineering 91

Security Affairs

APRIL 9, 2023

Nominate here: [link] Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, newsletter newsletter) The post Security Affairs newsletter Round 414 by Pierluigi Paganini – International edition appeared first on Security Affairs. billion rubles.

Computers and Electronics 82

Computers and Electronics Backups Cybercrime Marketing 82

Security Affairs

MAY 19, 2023

TurkoRat is an information-stealing malware that can obtain a broad range of data from the infected machine, including account login credentials, cryptocurrency wallets, and website cookies. The malware also supports anti-sandbox and analysis functionalities to avoid detection and prevent being analyzed. file ( agent-base ).

Encryption 80

Encryption Social Engineering Malware Cryptocurrency 80

Security Affairs

APRIL 6, 2023

Nominate here: [link] Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, MSI) The post Money Message ransomware group claims to have hacked IT giant MSI appeared first on Security Affairs.

Hacking 78

Hacking Ransomware Manufacturing Education 78