Security Affairs

NOVEMBER 17, 2019

Boardriders and its subsidiarities QuikSilver and Billabong infected with ransomware. Major ASP.NET hosting provider SmarterASP hit by ransomware attack. Buran ransomware-as-a-service continues to improve. Mexican state-owned oil company Pemex hit by ransomware. TA505 Cybercrime targets system integrator companies.

DDOS 51

DDOS Spyware Advertising Ransomware 51

Security Affairs

OCTOBER 27, 2019

TA505 cybercrime group use SDBbot RAT in recent campaigns. German firm Pilz still down a week after getting infected with ransomware. NordVPN, TorGuard, and VikingVPN VPN providers disclose security breaches. Swedish Government grants police the use of spyware against violent crime suspects.

Spyware 41

Spyware Advertising Hacking DDOS 41

SecureList

NOVEMBER 17, 2021

Last year, we foresaw the APT and cybercrime worlds becoming more porous on an operational level. The Israeli Defense Forces (IDF) have claimed that threat actors have been using catfishing to lure Israeli soldiers into installing spyware. Let’s start by looking at the predictions we made for 2021.

Mobile 131

Mobile Surveillance Ransomware Government 131

SecureList

NOVEMBER 1, 2022

On July 7, CISA issued an alert, “ North Korean State-Sponsored Cyber Actors Use Maui Ransomware To Target the Healthcare and Public Health Sector “, based on a Stairwell report about Maui ransomware. The backdoor has been used in a variety of attacks, including ransomware attacks and espionage campaigns.

Malware 141

Malware Ransomware Spyware Encryption 141

Security Affairs

FEBRUARY 11, 2024

Gov imposes visa restrictions on individuals misusing Commercial Spyware HPE is investigating claims of a new security breach Experts warn of a surge of attacks targeting Ivanti SSRF flaw How to hack the Airbus NAVBLUE Flysmart+ Manager Crooks stole $25.5

Spyware 91

Spyware Surveillance Identity Theft DDOS 91

SecureList

NOVEMBER 23, 2021

For instance, we see a new trend emerging in the criminal ecosystem of spyware-based authentication data theft, with each individual attack being directed at a very small number of targets (from single digits to several dozen). Extortion and ransomwaring of those able and willing to pay up. Actions of various attacker categories.

Spyware 105

Spyware Phishing Cybercrime Energy and Utilities 105

Security Affairs

SEPTEMBER 10, 2023

US CISA added critical Apache RocketMQ flaw to its Known Exploited Vulnerabilities catalog Ragnar Locker gang leaks data stolen from the Israel’s Mayanei Hayeshua hospital North Korea-linked threat actors target cybersecurity experts with a zero-day Zero-day in Cisco ASA and FTD is actively exploited in ransomware attacks Nation-state actors (..)

DDOS 103

DDOS VPN Data breaches Cybercrime 103

Security Boulevard

JANUARY 25, 2022

Folks, Who wants to dive deep into some of my latest commercially available research and stay on the top of their OSINT/cybercrime research and threat intelligence gathering game that also includes their team and organization? Dancho Danchev’s “Intell on the Criminal Underground – Who’s Who in Cybercrime for ” Presentation – [PDF].

Cybercrime 96

Cybercrime Hacking Scams Ransomware 96

Security Affairs

DECEMBER 5, 2021

Hundreds of vulnerabilities in common Wi-Fi routers affect millions of users German BSI agency warns of ransomware attacks over Christmas holidays Cuba ransomware gang hacked 49 US critical infrastructure organizations CISA warns of vulnerabilities in Hitachi Energy products NSO Group spyware used to compromise iPhones of 9 US State Dept officials (..)

Spyware 83

Spyware Ransomware Hacking VPN 83

Security Affairs

MARCH 27, 2023

Lower.exe, a sample of “GCleaner” spyware, historically, this piece of malware was initially faking CCleaner to drop additional malware ( link ). Brg.exe, a common RacconStealer with its command and control server hosted by VDSina, a Russian cloud provider. The module also exfiltrates 2FA secrets from Twilio’s Authy local storage.

Malware 82

Malware Social Engineering Encryption Marketing 82

SecureList

OCTOBER 26, 2021

Historically, Lazarus used MATA to attack various industries for cybercrime-like intentions: stealing customer databases and spreading ransomware. In this campaign, a broad spectrum of industries located in South Korea were targeted with custom ransomware. However, here we saw Lazarus using MATA for cyber-espionage purposes.

Malware 142

Malware Government Surveillance Spyware 142

SecureList

NOVEMBER 14, 2022

In 2022, the GReAT team tracked several threat actors leveraging SilentBreak’s toolset as well as a commercial Android spyware we named MagicKarakurt. A recent leak has put it in the hands of cybercrime actors and it is very likely that by the end of the year we will see it involved in APT cases too.

Firmware 108

Firmware Surveillance Mobile Telecommunications 108