SecureWorld News

APRIL 21, 2022

Treasury Department warning of a North Korean state-sponsored advanced persistent threat (APT) known as the Lazarus Group targeting cryptocurrency and blockchain companies. The threat actors use social engineering to encourage individuals to download trojanized cryptocurrency applications on Windows or macOS operating systems.

Cryptocurrency 98

Cryptocurrency Computers and Electronics Social Engineering System Administration 98

SecureList

FEBRUARY 5, 2025

It encrypts data with AES-256 in CBC mode before sending and decrypts server responses with AES-128 in CBC mode. The process of sending data to “rust” consists of three stages: Data is encrypted with AES-256 in CBC mode using the same key as in the case of the “http” server.

Malware 144

Malware Encryption Mobile Cryptocurrency 144

eSecurity Planet

DECEMBER 7, 2023

Encryption scrambles data to make it unreadable to those without decryption keys. Proper use of encryption preserves secrecy and radically lowers the potential damage of a successful cybersecurity attack. Encryption algorithm types will provide an overview of the mathematical algorithms used to encrypt data (AES, RSA, etc.),

Encryption 110

Encryption Passwords Authentication Password Management 110

eSecurity Planet

DECEMBER 7, 2023

Encryption uses mathematical algorithms to transform and encode data so that only authorized parties can access it. What Encryption Is and How It Relates to Cryptology The science of cryptography studies codes, how to create them, and how to solve them. How Does Encryption Process Data? How Does Encryption Process Data?

Encryption 115

Encryption Passwords IoT Firewall 115

Krebs on Security

SEPTEMBER 14, 2020

He said he’s invested in over 30 companies, so I would expect to see a document that says, “here’s the various companies we’ve invested in.” The one technology company this author could tie to Mr. Bernard was secureswissdata.com , a Swiss concern that provides encrypted email and data services.

Scams 354

Scams Cryptocurrency Accountability Technology 354

eSecurity Planet

MAY 5, 2025

A notorious hacker group known as Golden Chickens is back in the spotlight after cybersecurity researchers discovered two new digital weapons designed to steal passwords, watch every word you type, and target your cryptocurrency. TerraLogger, by contrast, is a standalone keylogger. exe and mshta.exe. exe and mshta.exe.

Passwords 68

Passwords Malware Cryptocurrency Cybercrime 68

Krebs on Security

APRIL 20, 2023

Mandiant found the compromised 3CX software would download malware that sought out new instructions by consulting encrypted icon files hosted on GitHub. Mandiant , Proofpoint and other experts say Lazarus has long used these bogus LinkedIn profiles to lure targets into opening a malware-laced document that is often disguised as a job offer.

Malware 329

Malware Software Technology Accountability 329

SecureList

APRIL 23, 2025

Finally, the generated private key and the attacker’s public key are scalar-operated to create a shared key, which is then used as the key for the ChaCha20 algorithm to encrypt the data ( T1573.001 ). We disclosed that this tool had been loaded by SIGNBT when we first documented SIGNBT malware. exe c : Programdata intel util.

Malware 144

Malware Software Encryption Internet 144

SecureList

AUGUST 10, 2022

In late August 2020, we published an overview of DeathStalker’s profile and malicious activities, including their Janicab, Evilnum and PowerSing campaigns ( PowerPepper was later documented in 2020). We discovered it in Q2 2020 as part of an update of the Evilnum modus operandi, and attributed it to DeathStalker.

Cryptocurrency 117

Cryptocurrency Encryption Social Engineering Passwords 117

Krebs on Security

JANUARY 30, 2024

authorities arrested a 19-year-old Florida man charged with wire fraud, aggravated identity theft, and conspiring with others to use SIM-swapping to steal cryptocurrency. As documented by Group-IB, the group pivoted from its access to Twilio to attack at least 163 of its customers. 9, 2024, U.S. On July 28 and again on Aug.

Social Engineering 358

Social Engineering Mobile Passwords Cybercrime 358

Krebs on Security

DECEMBER 27, 2019

But two sources who work at the company have now confirmed their employer was hit by Sodinokibi , a potent ransomware strain also known as “rEvil” that encrypts data and demands a cryptocurrency payment in return for a digital key that unlocks access to infected systems. When the site was first set up on Dec.

Ransomware 237

Ransomware Media Financial Services Retail 237

SecureList

FEBRUARY 21, 2025

Bait document from spear-phishing email inviting the victim to join a videoconference The content of this document is almost identical to the body of the phishing email. We ended up with the original AU3 file: Restored AU3 script The script is heavily obfuscated, with all strings encrypted. averageorganicfallfaw[.]shop

Phishing 92

Phishing Encryption Banking Malware 92

Krebs on Security

MAY 13, 2024

A search at the breach-tracking service Constella Intelligence on the phone number in Tkaner’s registration records — 7.9521020220 — brings up multiple official Russian government documents listing the number’s owner as Dmitri Yurievich Khoroshev. Another domain registered to that phone number was stairwell[.]ru

Ransomware 310

Ransomware Cybercrime Accountability Malware 310

Security Affairs

JANUARY 12, 2022

The RedLine malware allows operators to steal several information, including credentials, credit card data, cookies, autocomplete information stored in browsers, cryptocurrency wallets, credentials stored in VPN clients and FTP clients. The malicious code can also act as a first-stage malware.

Malware 145

Malware Manufacturing Cryptocurrency Cybercrime 145

SecureList

DECEMBER 27, 2022

We have published technical details of how this notorious group steals cryptocurrency before. The group usually takes advantage of Word documents and uses shortcut files for the initial intrusion. Based on our telemetry, we observed that one victim in the UAE was attacked using a malicious Word document. Remote URL: [link].

Malware 145

Malware Banking Passwords Antivirus 145

SecureList

APRIL 12, 2023

Beginning of tracking DeathNote The notorious threat actor Lazarus has persistently targeted cryptocurrency-related businesses for a long time. In mid-October 2019, we came across a suspicious document uploaded to VirusTotal. Until this discovery, the Lazarus group had primarily targeted the cryptocurrency business.

Malware 145

Malware Cryptocurrency Software Encryption 145

Security Affairs

DECEMBER 15, 2023

Businesses employ MongoDB to organize and store large swaths of document-oriented information, and in GokuMarket’s case, the details of over a million customers and admin users. GokuMarket, a cryptocurrency exchange, was recently acquired by Canada-based crypto exchange ByteX.

Passwords 134

Passwords Cryptocurrency Scams Mobile 134

Security Affairs

MAY 2, 2024

“According to court documents, Yaroslav Vasinskyi, also known as Rabotnik, 24, conducted thousands of ransomware attacks using the ransomware variant known as Sodinokibi/REvil.” Vasinskyi is a REvil ransomware affiliate since at least March 1st, 2019. ” reads the press release published by DoJ.

Ransomware 128

Ransomware Cryptocurrency Cybercrime Encryption 128

The Hacker News

JULY 11, 2023

Big Head was first documented by Fortinet FortiGuard Labs last month, when it discovered multiple variants of the ransomware that are designed to encrypt files on victims' machines in exchange for a cryptocurrency

Ransomware 79

Ransomware Cryptocurrency Encryption 79

Security Affairs

JUNE 15, 2020

the malicious code encrypts files and appends the.DEMON extension to filenames of the encrypted documents. and Italy hosting Android and cryptocurrency mining malware.” Black Kingdom ransomware was first spotted in late February by security researcher GrujaRS. Early this year, the U.S. “It [198.13.49[.]179]

VPN 140

VPN Ransomware Advertising Encryption 140

Security Affairs

SEPTEMBER 28, 2022

North Korea-linked Lazarus APT group is targeting macOS Users searching for jobs in the cryptocurrency industry. Last week, SentinelOne researchers discovered a decoy documents advertising positions for the popular cryptocurrency exchange Crypto.com. The attackers aimed at stealing credentials for the victims’ wallets.

Malware 104

Malware Cryptocurrency Architecture Advertising 104

Security Affairs

APRIL 19, 2021

The new variant also implements new features for data-stealing focused on cryptocurrency apps. The malware also allows attackers to capture screenshots and exfiltrate stolen documents to the attackers’ server. The malware also implements ransomware behavior, it is able to encrypt files and display a ransom note.

Malware 139

Malware Cryptocurrency Architecture Engineering 139

Security Affairs

APRIL 20, 2025

infrastructure International Press Newsletter Cybercrime Pixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks Threat actors misuse Node.js infrastructure International Press Newsletter Cybercrime Pixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks Threat actors misuse Node.js

Data breaches 62

Data breaches Malware Phishing Hacking 62

Security Affairs

JANUARY 14, 2022

The Russian police arrested 14 alleged members of the ransomware gang and raided 25 addresses seizing computer equipment and cryptocurrency wallets. The police operation was conducted by Russian authorities following a request by the United States that shared info about members of the gang. The raids took place in Moscow, St.

Government 123

Government Ransomware Cryptocurrency Banking 123

SecureList

NOVEMBER 29, 2024

The email contains a link in the body of the message that is also contained in the attached file, which appears to be a PDF or Word document. Victims are tricked into clicking the link to retrieve documents related to the lawsuit. These documents are in fact password-protected ZIP or other archives.

Energy and Utilities 106

Energy and Utilities Ransomware Malware Government 106

Security Affairs

OCTOBER 23, 2018

A new version of the Azorult info-stealer appeared in the wild, it is able to steal more data, including other types of cryptocurrencies. A new version of the Azorult info-stealer appeared in the wild, it is able to steal more data, including other types of cryptocurrencies, and implements new features.

Marketing 105

Marketing Cybercrime Cryptocurrency Advertising 105

Security Affairs

FEBRUARY 5, 2021

At the end of January, the group has improved its Linux cryptocurrency miner by implementing open-source detection evasion capabilities. The malware deploys the XMRig mining tool to mine Monero cryptocurrency. It also hides malicious processes using library injection and encrypts the malicious payload. aws/credentials and ~/.aws/config

Malware 121

Malware DNS Cryptocurrency Internet 121

Malwarebytes

JULY 25, 2022

Last week on Malwarebytes Labs: Extortionists target restaurants, demand money to take down bad reviews The FTC will go after companies misusing location, health, and other sensitive data Roblox breached: Internal documents posted online by unknown attackers Warning for WordPress admins: Uninstall the Modern WPBakery plugin immediately!

Cryptocurrency 84

Cryptocurrency Media Encryption Phishing 84

CyberSecurity Insiders

JULY 20, 2022

Black Basta claims to have compromised 70% of the database belonging to Knauf and reportedly siphoned sensitive documents pertaining to employee’s health insurance, credentials, contact details of employees and products related docs and ID scans.

Ransomware 114

Ransomware Insurance Cryptocurrency Cyber Attacks 114

Security Affairs

FEBRUARY 25, 2021

“Once the malicious document is opened, the malware is dropped and proceeds to the next stage of the deployment process. The ThreatNeedle malware used in this campaign belongs to a malware family known as Manuscrypt, which belongs to the Lazarus group and has previously been seen attacking cryptocurrency businesses.”

Malware 130

Malware Cryptocurrency Password Management Encryption 130

Security Affairs

OCTOBER 20, 2021

Once hijacked the channel, attackers either sell it to the highest bidder or employ it in cryptocurrency scam scheme. The malware landing page is disguised as a software download URL that was sent via email or a PDF on Google Drive, or via Google documents containing the phishing links.

Accountability 145

Accountability Malware Phishing Social Engineering 145

Security Affairs

JUNE 13, 2021

The document revealed that phishing maintained record levels in the first quarter of 2021, the number of phishing websites peaked in January 2021 with an all-time high of 245,771. of all TLS certificates used in phishing attacks were “Domain Valid” or “DV” certificates which are granted for free by providers such as Let’s Encrypt and cPanel.

Phishing 127

Phishing Advertising Cryptocurrency Encryption 127

Google Security

MARCH 9, 2021

A few recent examples of this include dependency confusion attack and malicious RubyGems package to steal cryptocurrency. You can think of it like Let’s Encrypt for Code Signing. We talked about the importance of this in our recent Know, Prevent, Fix post. Sigstore is in its early days, but we're really excited about its future.

Software 142

Software Encryption Cryptocurrency Engineering 142

IT Security Guru

SEPTEMBER 28, 2023

Ransomware attacks are strategically designed to either encrypt or delete critical data and system files, compelling organisations to meet the attackers’ financial demands. By keeping the encryption key on the infected device, ransomware may gradually encrypt files. How are victims of Ransomware exploited?

Ransomware 134

Ransomware Encryption Backups Social Engineering 134

Security Affairs

APRIL 24, 2020

The crew has published images of the data they claim to have stolen before encrypting the systems at the company. Now Sodinokibi ransomware operators posted images of SeaChange’s data on the leak site, they have created a page to the company containing images of allegedly stolen documents. – The company is traded on NASDAQ.

Software 135

Software Ransomware VPN Advertising 135

Malwarebytes

JULY 20, 2022

The Justice Department today announced a complaint filed in the District of Kansas to forfeit cryptocurrency paid as ransom to North Korean hackers or otherwise used to launder such ransom payments. The seized funds amounting to half a million US dollars, include ransoms paid by health care providers in Kansas and Colorado. Maui ransomware.

Ransomware 98

Ransomware Cryptocurrency Healthcare Firmware 98

Security Affairs

AUGUST 15, 2020

The malware also allows attackers to capture screenshots and exfiltrate stolen documents to the attackers’ server. The malware also implements ransomware behavior, it is able to encrypt files and display a ransom note. Trend Micro discovered two Xcode projects injected with the XCSSET Mac Malware, one on July 13 and one on July 31.

Spyware 144

Spyware Malware Advertising Cryptocurrency 144