Security Affairs

MAY 23, 2022

SEKOIA researchers started their investigation after the publication of Google’s Threat Analysis Group (TAG)’s report “ Update on cyber activity in Eastern Europe ” which detailed the activity of nation-state actors against Eastern Europe. org jadlactnato.webredirect[.]org. ” reads the analysis published by the experts.

Government 116

Government Hacking Cybersecurity Information Security 116

eSecurity Planet

MARCH 16, 2023

Block TCP 445/SMB outbound from your network by using a perimeter firewall, a local firewall, and via your VPN settings. Two More Critical Flaws Action1 vice president of vulnerability and threat research Mike Walters highlighted two other critical flaws in a blog post.

Energy and Utilities 96

Energy and Utilities Authentication Firewall Engineering 96

CyberSecurity Insiders

FEBRUARY 25, 2022

This blog was jointly written with Santiago Cortes. According to these blogs, at least 10 companies may have been impacted by these ransomware campaigns in the first two weeks of February. Blog BotenaGo. Windows SMB Server Maximum Concurrent Requests Set To Maximum Value. Executive summary. USM Anywhere Correlation Rules.

Ransomware 119

Ransomware Encryption Malware Backups 119

Pentester Academy

FEBRUARY 23, 2023

This ransomware made use of the EternalBlue , an exploit of Microsoft’s implementation of their SMB protocol, released by The Shadow Brokers hacker group in April 2017, to gain access to remote Windows machines in most cases. However, it also made use of DoublePulsar backdoor to spread itself from the infected machines.

Ransomware 52

Ransomware Encryption Cryptocurrency Banking 52

SecureList

FEBRUARY 25, 2021

Google TAG has recently published a post about a campaign by Lazarus targeting security researchers. In our previous blog about Lazarus group, we mentioned the Bookcode cluster attributed to Lazarus group; and recently the Korea Internet and Security Agency (KISA) also published a report about the operation. SMB/Windows Admin Shares.

Malware 132

Malware Phishing Passwords Encryption 132

SecureList

DECEMBER 23, 2020

In this blog, we describe two separate incidents. SMB/Windows Admin Shares. Each attack used different tactics, techniques and procedures (TTPs), but we found connections between the two cases and evidence linking those attacks to the notorious Lazarus group. Relationship of recent Lazarus group attack. System Information Discovery.

Malware 75

Malware Cryptocurrency Encryption Passwords 75