Remove Computers and Electronics Remove DNS Remove Malware Remove Penetration Testing
article thumbnail

Analyzing the APT34’s Jason project

Security Affairs

Distributed in a ZIP container (a copy is available here ) the interface is quite intuitive: the Microsoft exchange address and its version shall be provided (even if in the code a DNS-domain discovery mode function is available). I am a computer security scientist with an intensive hacking background.

article thumbnail

OilRig APT group: the evolution of attack techniques over time

Security Affairs

T1388) , from group_b to group_d time frames OilRig used real Compromised User Accountsextracted by Malware (rif. T1094) mainly developed using DNS resolutions (which is actually one of the main characteristic of the attacker group). I am a computer security scientist with an intensive hacking background.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

TA505 Cybercrime targets system integrator companies

Security Affairs

The two Macros decoded a Javascript payload acting as a drop and execute by using a well-known strategy as described in: “ Frequent VBA Macros used in Office Malware ”. The TA505 group , that is known to have operated both the Dridex and Locky malware families, continues to make small changes to its operations. net http[://com-mk84.net.

article thumbnail

APT34: Glimpse project

Security Affairs

Indeed we might observe a File-based command and control (a quite unusual solution) structure, a VBS launcher, a PowerShell Payload and a covert channel over DNS engine. According to Duo, “ OilRig delivered Trojans that use DNS tunneling for command and control in attacks since at least May 2016. It is not a TXT request.

DNS 90
article thumbnail

Top Cybersecurity Accounts to Follow on Twitter

eSecurity Planet

Brian Krebs is an independent investigative reporter known for his coverage of technology, malware , data breaches , and cybercrime developments. Russian software engineer Eugene Kaspersky’s frustration with the malware of the 80s and 90s led to the founding of antivirus and cybersecurity vendor Kaspersky Lab.

article thumbnail

Iran-linked APT34: Analyzing the webmask project

Security Affairs

Security expert Marco Ramilli published the findings of a quick analysis of the webmask project standing behind the DNS attacks implemented by APT34 (aka OilRig and HelixKitten ). According to Duo, “ OilRig delivered Trojans that use DNS tunneling for command and control in attacks since at least May 2016. Leaked Source code.

DNS 80
article thumbnail

The ‘MartyMcFly’ investigation: Italian naval industry under attack

Security Affairs

Experts at Yoroi’s Cyber Security Defence Center along with Fincantieri’s security team investigated the recently discovered Martymcfly malware attacks. command and control services of info stealers malware). DNS requests intercepted. I am a computer security scientist with an intensive hacking background. Background.