Security Affairs

JULY 8, 2022

In some of the attacks, threat actors used an Excel document named Nuclear.xls, suggesting an alarming lure. Once opened, the document downloads a WinRAR self-extracting archive (SFX) that delivers the AnchorMail backdoor to the victim’s system. Experts also observed attacks dropping IcedID and CobaltStrike. Pierluigi Paganini.

Cybercrime 95

Cybercrime Malware DDOS Ransomware 95

Security Affairs

NOVEMBER 3, 2022

The Sentinel Labs’s analysis revealed that Black Basta ransomware operators develop and maintain their own toolkit, they documented only collaboration with a limited and trusted set of affiliates. The post Experts link the Black Basta ransomware operation to FIN7 cybercrime gang appeared first on Security Affairs.

Cybercrime 98

Cybercrime Ransomware Antivirus Malware 98

Security Affairs

JUNE 17, 2021

UNC2465 cybercrime group that is affiliated with the Darkside ransomware gang has infected with malware the website of a CCTV camera vendor. In the documented attack, once the backdoor is deployed, UNC2465 interactively established an NGROK tunnel and performed lateral movements in less than 24 hours. Pierluigi Paganini.

Cybercrime 106

Cybercrime Ransomware Antivirus Software 106

Security Affairs

MAY 6, 2024

The threat actor, going by the alias ‘CiberinteligenciaSV,’ posted the 144 GB data dump to Breach Forums, writing that the leak included 5,129,518 high-definition photos, each labeled with the corresponding Salvadorian’s document identification (DUI) number.

Identity Theft 110

Identity Theft Data breaches Cybercrime Government 110

Krebs on Security

NOVEMBER 16, 2023

In a 2,200-page report, Finnish authorities laid out how they connected the extortion spree to Kivimäki, a notorious hacker who was convicted in 2015 of perpetrating tens of thousands of cybercrimes, including data breaches, payment fraud, operating a botnet and calling in bomb threats.

Cybercrime 207

Cybercrime Hacking Data breaches Banking 207

Krebs on Security

APRIL 27, 2023

This misconfigured Salesforce Community site from the state of Vermont was leaking pandemic assistance loan application data, including names, SSNs, email address and bank account information. But after being presented with a document including the Social Security number of a health professional in D.C. Washington, D.C.

Banking 288

Banking Government Information Security Authentication 288

Security Affairs

FEBRUARY 27, 2023

Data allegedly stolen from the American gaming giant Activision in December security breach were leaked on a cybercrime forum. They exfiltrated sensitive work place documents as well as scheduled to be released content dating to November 17th, 2023. Activision was breached December 4th, 2022.

Hacking 88

Hacking Cybercrime Social Engineering Data breaches 88

Security Affairs

MAY 11, 2024

“After an extensive forensic investigation and our manual document review, we learned on April 5, 2024 that certain files containing your personal information was subject to unauthorized access.” The incident did not impact the gaming network,” reads the notice of data breach sent to the impacted individuals.

Data breaches 67

Data breaches Identity Theft Cybercrime Cyber Attacks 67

Security Affairs

MARCH 13, 2024

In our commitment to full transparency, we wish to inform you of a recent security incident involving a third-party vendor managing employee attendance data. The threat actor announced the hack on a popular cybercrime forum, he claimed the theft of about 2869 files.

Data breaches 113

Data breaches Computers and Electronics Hacking Cybercrime 113

Krebs on Security

JUNE 18, 2021

NYSE:FAF ] was leaking more than 800 million documents — many containing sensitive financial data — related to real estate transactions dating back 16 years. Securities and Exchange Commission settled its investigation into the matter after the Fortune 500 company agreed to pay a paltry penalty of less than $500,000.

Insurance 274

Insurance Risk Financial Services CISO 274

Security Affairs

NOVEMBER 12, 2019

The analysis of a malicious email revealed a possible raising interest of the TA505 cybercrime gang in system integrator companies. Attached to the email a suspicious word document was waiting to be opened from the victim. By opening the word document the victim displays the following text (Image1). Introduction.

Cybercrime 42

Cybercrime Computers and Electronics Penetration Testing Malware 42

Security Affairs

APRIL 18, 2024

FIN7 is a Russian criminal group (aka Carbanak ) that has been active since mid-2015, it focuses on restaurants, gambling, and hospitality industries in the US to harvest financial information that was used in attacks or sold in cybercrime marketplaces. com” masquerading as the legitimate website “advanced-ip-scanner[.]com”,

Phishing 108

Phishing Cybercrime Manufacturing Hacking 108

Security Affairs

OCTOBER 16, 2023

The researchers speculate the originating accounts of the instant messaging applications were compromised through the leaked credentials available on cybercrime forums. The format is used to to trick the user into believing the file is a.PDF document instead of a VBA script ( www.skype[.]vbs).

Malware 110

Malware Cryptocurrency Accountability Cybercrime 110

Security Affairs

MAY 2, 2024

“According to court documents, Yaroslav Vasinskyi, also known as Rabotnik, 24, conducted thousands of ransomware attacks using the ransomware variant known as Sodinokibi/REvil.” victims, and we are disrupting the broader cybercrime ecosystem.” Vasinskyi was extradited to the U.S. in March 2022.

Ransomware 92

Ransomware Cryptocurrency Cybercrime Encryption 92

Security Affairs

SEPTEMBER 4, 2021

FIN7 cybercrime gang used weaponized Windows 11 Alpha-themed Word documents to drop malicious payloads, including a JavaScript backdoor. The attack chain began with a Microsoft Word document (.doc) Anomali Threat Research experts have monitored recent spear-phishing attacks conducted by financially motivated threat actor FIN7.

Cybercrime 120

Cybercrime Retail Phishing Hacking 120

Security Affairs

MAY 26, 2021

Last week, French authorities have seized the dark web marketplace Le Monde Parallèle, it is another success of national police in the fight against cybercrime. French authorities seized the dark web marketplace Le Monde Parallèle, the operation is another success of national police in the fight against cybercrime activity in the dark web.

Cybercrime 143

Cybercrime Cryptocurrency Banking Mobile 143

Security Affairs

JANUARY 8, 2023

Trend Micro experts discovered a new variant of the Dridex banking malware that targets the MacOS platform and that used a new technique to deliver documents embedded with malicious macros. The banking malware is believed to be operated by the cybercrime gang known as Evil Corp. ” reads the analysis published by Trend Micro.

Banking 96

Banking Malware Social Engineering Cybercrime 96

Security Affairs

JULY 30, 2021

The hacker exploited a vulnerability in a photo transfer service vulnerability to download ID scans from the Identity Documents Database (KMAIS). ” A joint operation conducted by the cybercrime Bureau of the National Criminal Police and RIA led to the identification of the Tallin resident. or take a new document photo. .

Government 125

Government Cybercrime Mobile Banking 125

Security Affairs

MARCH 14, 2023

Microsoft warns of large-scale phishing attacks orchestrated with an open-source adversary-in-the-middle (AiTM) phishing kit available in the cybercrime ecosystem Adversary-in-the-middle (AiTM) phishing kits are becoming an essential technology in the cybercrime ecosystem that is used by multiple threat actors to launch phishing attacks.

Phishing 79

Phishing Cybercrime Authentication Mobile 79

Security Affairs

OCTOBER 23, 2023

The leaders of the criminal organization used false documentation and spoofing techniques to hide their identity and invested their profits in crypto assets to launder the proceeds. The crooks impersonated delivery firms and electricity suppliers to scam the victims.

Computers and Electronics 89

Computers and Electronics Scams Cybercrime Phishing 89

Security Affairs

MARCH 7, 2023

The threat actor announced the hack on a popular cybercrime forum, he claims to have stolen about 2869 files. The stolen files include confidential product model documentation, binaries, backend infrastructure, BIOS information, and other sensitive data.

Data breaches 95

Data breaches Hacking Cybercrime Cryptocurrency 95

Security Affairs

FEBRUARY 12, 2024

According to court documents, the FBI covertly purchased and analyzed the Warzone RAT. He is accused of conspiracy to commit various cybercrimes, such as gaining authorized access to protected computers and causing unauthorized damage to protected computers. “Federal authorities in Boston seized www.warzone.ws

Malware 103

Malware Hacking Cybercrime Advertising 103

Security Affairs

FEBRUARY 22, 2024

Will you make sure to help me out of my unfortunate situation, receive the money and send me some to purchase my travel documents and start a new life? He is also the author of the book “La Gestione della Cyber Security nella Pubblica Amministrazione”. Source: www.computersecuritynews.it/beyond-the-border-scam-attenzione-allistanza-della-nuova-truffa-alla-nigeriana

Scams 109

Scams Banking Computers and Electronics Accountability 109

Security Affairs

OCTOBER 18, 2023

The researchers reported that several cybercrime groups began exploiting the flaw in early 2023, when the bug was still a zero-day. The vulnerability has been patched, but but manyhave yet to update their installs. ” reported Google TAG.

Cybercrime 125

Cybercrime Malware Software Hacking 125

Security Affairs

JUNE 6, 2022

Mandiant is investigating the claims of the ransomware gang, the cybercrime group declared to have stolen 356841 files from the company and plans to leak them online. The alleged stolen documents appear to have been included in an archive named ‘mandiantyellowpress.com.7z.’ com redirects users to the site ninjaflex[.]com

Hacking 132

Hacking Ransomware Cybersecurity Cybercrime 132

Security Affairs

JANUARY 8, 2024

Documents belonging to the Swiss Air Force were leaked on the dark web as a result of cyberattack on a US security provider. Documents belonging to the Swiss Air Force were leaked on the dark web after the US security company Ultra Intelligence & Communications suffered a data breach.

Hacking 114

Hacking Data breaches Ransomware Manufacturing 114

Security Affairs

DECEMBER 26, 2020

Emotet is back on Christmas Eve, cybercrime operators are sending out spam messages to deliver the infamous Trickbot Trojan. Emotet is back on Christmas Eve, after two months of silence, cybercrime operators are sending out spam messages to deliver the infamous Trickbot Trojan.

Cybercrime 130

Cybercrime Malware Banking Ransomware 130

Security Affairs

DECEMBER 30, 2023

Xerox Corp provides document management solutions worldwide. The ransomware group published the images of eight documents, including emails and an invoice, as proof of the hack. The INC RANSOM ransomware group claims to have hacked the American multinational corporation Xerox Corp.

Ransomware 126

Ransomware InfoSec Data breaches Hacking 126

Security Affairs

NOVEMBER 28, 2023

The ransomware gang claims the theft of board meeting minutes, internal project documentation, personnel details, audit reports, and more. In October 2022, CISA, the FBI, and the Department of Health and Human Services (HHS) warned that the Daixin Team cybercrime group is actively targeting U.S.

Hacking 122

Hacking VPN Ransomware Cybercrime 122

Security Affairs

JULY 12, 2023

The issue, tracked as CVE-2023-36884 , was exploited by nation-state actors and cybercriminals to gain remote code execution via malicious Office documents. The company revealed that it is aware of high-targeted attacks that attempt to exploit these issues through specially-crafted Office documents. ” reads the post.

Phishing 90

Phishing Cybercrime Hacking Government 90

Security Affairs

OCTOBER 20, 2019

TA505 cybercrime group that operated the Dridex Trojan and Locky ransomware, has been using a new RAT dubbed SDBbot in recent attacks. Security experts at Proofpoint observed the notorious TA505 cybercrime group that has been using a new RAT dubbed SDBbot in recent attacks. Pierluigi Paganini.

Cybercrime 43

Cybercrime Advertising Retail Banking 43

Security Affairs

MARCH 8, 2024

The data exfiltrated by the gang included classified information and sensitive personal data from the Federal Administration. million files, and 65,000 documents were classified by NCSC as data relevant to the Federal Administration. Threat actors stole and leaked roughly 1.3 ” continues the report. ” continues the report.

Ransomware 121

Ransomware Data breaches Unstructured Data Architecture 121

Security Affairs

MAY 30, 2022

The suspects, aged between 31 and 38, the police found them in possession of fake documents, including fraudulent invoices and forged official letters. Security Affairs is one of the finalists for the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS. SecurityAffairs – hacking, cybercrime).

Cybercrime 128

Cybercrime Malware Hacking Cybersecurity 128

Security Affairs

APRIL 23, 2022

The Computer Emergency Response Team of Ukraine (CERT-UA) warns of phishing attacks aimed at organizations in the country using the topic “Azovstal” The phishing message use the subject “Azovstal” and a weaponized office document. Upon opening the attachment and enabling the macro, it will start the infection process.

Phishing 89

Phishing Cybercrime Ransomware Encryption 89

Security Affairs

OCTOBER 27, 2021

The NRA was added to the list of compromised organizations on the leak site of the group, that gang also published a set of documents as proof of the hack. The Evil Corp cybercrime group (aka the Dridex gang Indrik Spider , the Dridex gang, and TA505 ) has been active in cybercrime activities since 2007.

Ransomware 122

Ransomware Banking Cybercrime Hacking 122

Security Affairs

OCTOBER 16, 2021

TrickBot operators are back and expand the distribution channels with partnership with cybercrime affiliates. The gang support other cybercrime groups such as known Hive0105, Hive0106 (aka TA551 or Shathak), and Hive0107, supporting them in expanding their malware campaigns. ” reads the post published by IBM X-Force.

Malware 107

Malware Cybercrime DDOS Social Engineering 107

Security Affairs

MARCH 27, 2024

The cybercrime group claims to have stolen three terabytes of data and is threatening to leak them. The group published the images of medical documents as proof of the hack and will publish the stolen data if the NHS does not pay the ransom. ” reads the announcement published by the INC Ransom group.

Healthcare 105

Healthcare Government Hacking Cybercrime 105