article thumbnail

Operation Lyrebird: Group-IB assists INTERPOL in identifying suspect behind numerous cybercrimes worldwide

Security Affairs

The alleged perpetrator, who turned out to be a citizen of Morocco, was arrested in May by the Moroccan police based on the data about his cybercrimes that was provided by Group-IB. According to the DNS data analysis, this name was used to register at least two domains, which were created using the email from the phishing kit.

article thumbnail

US Harbors Prolific Malicious Link Shortening Service

Krebs on Security

is overseen by the National Telecommunications and Information Administration (NTIA), an executive branch agency of the U.S. “We’re always looking at the end malware or phishing page, but what we’re finding here is that there’s this middle layer of DNS threat actors persisting for years without notice.”

Phishing 270
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Pro-Russia group NoName057(16) targets Ukraine and NATO countries

Security Affairs

A Pro-Russian cybercrime group named NoName057 (16) (aka 05716nnm or Nnm05716) is behind a wave of DDoS attacks against organizations in Ukraine and NATO countries, SentinelOne researchers reported. The C2 infrastructure used by the group was primarily hosted on the Bulgarian telecommunications company Neterra.

DDOS 68
article thumbnail

Canadian Police Raid ‘Orcus RAT’ Author

Krebs on Security

31, 2019, Rezvesz said his company recently was the subject of an international search warrant executed jointly by the Royal Canadian Mounted Police (RCMP) and the Canadian Radio-television and Telecommunications Commission (CRTC). “In In an “official press release” posted to pastebin.com on Mar.

article thumbnail

WinDealer dealing on the side

SecureList

It primarily goes after targets located in China, such as foreign diplomatic organizations established in the country, members of the academic community, or companies from the defense, logistics and telecommunications sectors. Full control over the DNS, meaning they can provide responses for non-existent domains.

Malware 115
article thumbnail

Group-IB presents its annual report on global threats to stability in cyberspace

Security Affairs

The past months have shown that the most dangerous hacks involved DNS hijacking, which helped attackers manipulate DNS records for MITM attacks. The most common objective of such attacks is cyberespionage and disruption of major telecommunications companies’ work. The telecommunications sector: Are providers ready for 5G?

Banking 85
article thumbnail

DDoS attacks in Q4 2020

SecureList

The DTLS (Datagram Transport Layer Security) protocol is used to establish secure connections over UDP, through which most DNS queries, as well as audio and video traffic, are sent. In October, telecommunications firm Telenor Norway was another to fall victim. Extortionists’ activity regularly made the news throughout 2020.

DDOS 132