article thumbnail

Analyzing the APT34’s Jason project

Security Affairs

Distributed in a ZIP container (a copy is available here ) the interface is quite intuitive: the Microsoft exchange address and its version shall be provided (even if in the code a DNS-domain discovery mode function is available). I am a computer security scientist with an intensive hacking background.

article thumbnail

OilRig APT group: the evolution of attack techniques over time

Security Affairs

T1094) mainly developed using DNS resolutions (which is actually one of the main characteristic of the attacker group). They begun development by introducing crafted communication protocol over DNS and later they added, to such a layer, encoding and encryption self build protocols. About the author: Marco Ramilli, Founder of Yoroi.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

TA505 Cybercrime targets system integrator companies

Security Affairs

Building a re-directors or proxy chains is quite useful for attackers in order to evade Intrusion Prevention Systems and/or protections infrastructures based upon IPs or DNS blocks. I am a computer security scientist with an intensive hacking background. Image3: Redirecting script. net http[://com-mk84.net.

article thumbnail

APT34: Glimpse project

Security Affairs

Indeed we might observe a File-based command and control (a quite unusual solution) structure, a VBS launcher, a PowerShell Payload and a covert channel over DNS engine. According to Duo, “ OilRig delivered Trojans that use DNS tunneling for command and control in attacks since at least May 2016. It is not a TXT request.

DNS 92
article thumbnail

Top Cybersecurity Accounts to Follow on Twitter

eSecurity Planet

Galperin is the current Director of Cybersecurity at the Electronic Frontier Foundation (EFF) and noted free speech advocate. Through tenures at Citrix, HP, and Bugcrowd, Jason Haddix offers his expertise in the areas of penetration testing , web application testing, static analysis, and more. Graham Cluley | @gcluley.

article thumbnail

Iran-linked APT34: Analyzing the webmask project

Security Affairs

Security expert Marco Ramilli published the findings of a quick analysis of the webmask project standing behind the DNS attacks implemented by APT34 (aka OilRig and HelixKitten ). According to Duo, “ OilRig delivered Trojans that use DNS tunneling for command and control in attacks since at least May 2016. Leaked Source code.

DNS 82
article thumbnail

The ‘MartyMcFly’ investigation: Italian naval industry under attack

Security Affairs

DNS requests intercepted. I am a computer security scientist with an intensive hacking background. I do have a MD in computer engineering and a PhD on computer security from University of Bologna. I’ve also been encharged of testing uVote voting system from the Italian Minister of homeland security.