Security Affairs

FEBRUARY 3, 2023

The former is a VBScript used to download next-stage VBScript from a remote server. Upon opening the.LNK file, it uses the System Binary Proxy Execution technique through the execution of Windows-native binary (designed to execute Microsoft HTML Application (HTA) files (mshta.exe)) to download a file via the URL hxxps://secureurl[.]shop/09.01_otck/quicker[.]rtf.

Malware 88

Malware Spyware DNS Government 88

Security Affairs

JANUARY 8, 2022

Researchers warn of new campaigns distributing a new improved version of the FluBot malware posing as Flash Player. Researchers from F5 security are warning of a new enhanced version of the FluBot Android malware that that spread posed as Flash Player. The victim downloads and opens the malicious app that installs FluBot.

Malware 105

Malware DNS Banking Hacking 105

Security Affairs

SEPTEMBER 21, 2022

Russia-linked APT group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. Russia-linked cyberespionage group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. ” reads the report published by Recorded Future.

Malware 82

Malware Telecommunications DNS Hacking 82

Security Affairs

JANUARY 14, 2021

Security experts from ESET uncovered an ongoing surveillance campaign, dubbed Operation Spalax , against Colombian government institutions and private companies. Malware researchers from ESET uncovered an ongoing surveillance campaign, dubbed Operation Spalax , against Colombian entities exclusively. ” continues the report.

Malware 110

Malware Surveillance Phishing Government 110

Security Affairs

FEBRUARY 12, 2024

Hackers use intercepted data to hijack your current session on a website, giving them access to your private accounts and information. While they can’t directly read your password, they can still download malware or gather enough information to steal your identity.

DNS 124

DNS VPN Encryption Passwords 124

Security Affairs

MARCH 26, 2020

The number of Coronavirus-themed attacks continues to increase, crooks hijack D-Link and Linksys routers to redirect users to sites spreading COVID19-themed malware. Crooks continue to launch Coronavirus-themed attacks , experts observed hackers hijacking D-Link and Linksys routers to redirect users to COVID19-themed sites spreading malware.

Malware 78

Malware DNS Advertising Cryptocurrency 78

Malwarebytes

JANUARY 22, 2024

The group uses social engineering techniques to persuade their targets to open documents or download malware. This backdoor is custom malware, likely developed by or for Coldriver, called Spica. It is mainly in use by security researchers to classify malware. These targets are approached in spear phishing attacks.

Social Engineering 92

Social Engineering Government Media DNS 92

Security Affairs

JULY 15, 2020

Security researchers discovered another malware family delivered through tax software that some businesses operating in China are required to install. Security researchers at Trustwave have discovered another malware family delivered through tax software that Chinese banks require companies operating in the country to install.

Software 83

Software Malware Banking Advertising 83

Security Affairs

APRIL 16, 2020

Linksys has reset passwords for all its customers’ after learning on ongoing DNS hijacking attacks aimed at delivering malware. Crooks continue to launch Coronavirus-themed attacks , in the last weeks, experts observed hackers hijacking D-Link and Linksys routers to redirect users to COVID19-themed sites spreading malware.

Passwords 117

Passwords DNS Malware Advertising 117

Security Affairs

JANUARY 13, 2022

Threat actors are actively exploiting public cloud services from Amazon and Microsoft to spread RATs such as Nanocore , Netwire , and AsyncRAT used to steal sensitive information from compromised systems. The attackers used complex obfuscation techniques in the downloader script. ” reads the analysis published by Talos.

DNS 112

DNS Malware Cybercrime Ransomware 112

Security Affairs

NOVEMBER 5, 2021

Over the past months, other ransomware gangs, including Conti and Lockfile , exploited ProxyShell flaws to deliver their malware. The attack chain starts with a downloader module on a victim’s server in the form of a standalone executable format and a DLL. The DLL downloader is run by the Exchange IIS worker process w3wp.exe.

Ransomware 125

Ransomware Backups Encryption DNS 125

Security Affairs

MAY 18, 2021

We discovered the Simps Botnet binaries downloaded via shell script sample and Remote Code Execution vulnerability exploits by Gafgyt – detailed in our earlier post. . During the first week of May 2021, the Uptycs’ threat research team detected a shell script and Gafgyt malware downloading Simps binaries from the same C2- 23.95.80[.]200.

DDOS 130

DDOS Malware Architecture IoT 130

Security Affairs

DECEMBER 29, 2021

The attackers were observed performing multiple connectivity checks via DNS lookups for a subdomain under dns[.]1433[.]eu[.]org The researchers explained that multiple threat actors utilize publicly accessible DNS logging services like dns[.]1433[.]eu[.]org org , running on the VMware Horizon instance.

DNS 88

DNS Hacking Malware Information Security 88

Security Affairs

JULY 17, 2019

Threat actors used the Extembro DNS- changer Trojan in an adware campaign to prevent users from accessing security-related websites. Security experts at Malwarebytes observed an adware campaign that involved the Extembro DNS- changer Trojan to prevent users from accessing websites of security vendors.

Adware 59

Adware DNS Malware Advertising 59

Security Affairs

JANUARY 25, 2021

Zscaler’s research team recently spotted a Linux-based malware family, tracked as DreamBus botnet, targeting Linux servers. Researchers at Zscaler’s ThreatLabZ research team recently analyzed a Linux-based malware family, tracked as DreamBus Botnet, which is a variant of SystemdMiner. ” reads the post published by Zscaler.

Cryptocurrency 141

Cryptocurrency Malware DNS Passwords 141

Security Affairs

DECEMBER 20, 2022

Palo Alto Networks Unit 42 researchers discovered more than 500 new domains and 200 malware samples attributed to Gamaredon APT since the beginning of the invasion. Infrastructure using fast flux DNS rotates through many IPs daily and each IP was used for a short time. Gamaredon’s phishing attacks used a .html

DNS 82

DNS Phishing Hacking Government 82

Security Affairs

MAY 6, 2023

Twitter confirmed that a security incident publicly exposed Circle tweets FBI seized other domains used by the shadow eBook library Z-Library WordPress Advanced Custom Fields plugin XSS exposes +2M sites to attacks Fortinet fixed two severe issues in FortiADC and FortiOS Pro-Russia group NoName took down multiple France sites, including the French (..)

Data breaches 93

Data breaches Malware Mobile Spyware 93

Security Affairs

NOVEMBER 4, 2020

150 PAGESLOADED WITH EXCELLENT CONTENT Learn from the experts, cybersecurity best practices Find out about upcoming information security related conferences, expos and trade shows. You can download a PDF version once you open the page flipping version) Do you like Yumpu, an alternative online flipbook version?

InfoSec 121

InfoSec DNS Advertising Marketing 121

Security Affairs

DECEMBER 19, 2022

Botnet operators use to spread the malware via cracked or pirated software and pay-per-install (PPI) schemes. Nozomi analyzed the entire blockchain to discover the C2 domains used by the botnet, the researchers also downloaded over 1500 Glupteba samples from VirusTotal to track the wallet addresses used by the operators.

DNS 98

DNS Antivirus Cryptocurrency Software 98

Security Affairs

MARCH 21, 2022

Upon opening the LNK file, an HTA file will be downloaded and executed on the victim’s computer. The HTA file contains a VBScript code that fetches and decodes the bait file and the malicious program LoadEdge backdoor. The LoadEdge backdoor maintains persistence through the Windows registry.

Spyware 84

Spyware DNS Phishing Government 84

Security Affairs

APRIL 26, 2022

North Korea-linked APT37 group is targeting journalists that focus on DPRK with a new piece of malware. North Korea-linked APT37 group (aka Ricochet Chollima) has been spotted targeting journalists focusing on DPRK with a new piece of malware. When manually downloaded during analysis, this payload was named Fantasy.”

Malware 72

Malware DNS Phishing Authentication 72

Security Affairs

FEBRUARY 2, 2021

108 PAGESLOADED WITH EXCELLENT CONTENT Learn from the experts, cybersecurity best practices Find out about upcoming information security related conferences, expos and trade shows. You can download a PDF version once you open the page flipping version) Do you like Yumpu, an alternative online flipbook version?

InfoSec 104

InfoSec DNS Media Marketing 104

Security Affairs

NOVEMBER 21, 2021

This technique tricks the target’s package manager into downloading and installing the malicious module. The “ipboards” and “pptest” packages were discovered using DNS tunneling for data exfiltration, this is the first time that this technique has been used by malicious pac in malware uploaded to PyPI.

DNS 140

DNS Passwords Malware Hacking 140

Security Affairs

JUNE 18, 2020

They use DNS tunneling for stealthier C&C communications, and place execution guardrails on the malicious components to hide the malware from security researchers.” The attack chain begins with the deployment of a TCP downloader that fetches the next stage payload.

DNS 81

DNS Advertising Spyware Software 81

Security Affairs

MARCH 5, 2020

Security researchers demonstrated that hundreds of sub-domains belonging to Microsoft could potentially be hijacked and abused to deliver malware and for phishing attacks. Let’s consider mybrowser.microsoft.com, it might have resolved by the DNS to something like webserver9000.azurewebsites.net. azurewebsites.net.

DNS 96

DNS Phishing Advertising Malware 96

Security Affairs

JUNE 27, 2021

Researchers have discovered a strain of cryptocurrency-mining malware, tracked as Crackonosh, that abuses Windows Safe mode to avoid detection. . The researchers started investigating the threat after they became aware that the malware was disabling and uninstalling its antivirus from infected devices. ” continues the report.

Antivirus 110

Antivirus Cryptocurrency Malware Software 110

Security Affairs

JANUARY 19, 2021

. “In all the attacks involving these CVEs, the attacker’s first move is to try running different syntaxes of OS commands to download and execute a Python script named “out.py”.” “After the script is downloaded and given permissions (using the “chmod” command), the attacker tries to run it using Python 2.

DDOS 140

DDOS DNS Malware Internet 140

Security Affairs

SEPTEMBER 18, 2021

The group is suspected to have been running successful malware campaigns for more than five years. The attackers have used off-the-shelf malware since the beginning of their operations and have never developed their own malware. SecurityAffairs – hacking, malware). ” reads the analysis published by Cisco Talos.

Malware 98

Malware Phishing DNS Cybercrime 98

Security Affairs

OCTOBER 22, 2021

The FiveSys rootkit uses the same technique to remain under the radar, it is very similar to the Undead malware and likely originate from China where is used to target domestic games. Up.sys downloads an executable and starts it using an embedded dll which it injects from kernel mode. SecurityAffairs – hacking, cyber security).

Malware 110

Malware DNS Internet Internet 110

Security Affairs

JANUARY 28, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. Upon executing the bash script, it will execute multiple tasks to: Modify the network DNS configuration. Download the latest IRC bot configuration. SecurityAffairs – hacking, malware).

Cryptocurrency 121

Cryptocurrency Cybercrime DNS Malware 121

Security Affairs

MAY 11, 2023

. “Successful exploits could allow attackers to monitor users’ internet activity, highjack internet connections and redirect traffic to malicious websites or inject malware into network traffic. “NETGEAR strongly recommends that you download the latest firmware as soon as possible.” for the RAX30 router family.

Hacking 95

Hacking Firmware Authentication DNS 95

Security Affairs

NOVEMBER 1, 2021

Pink also adopts the DNS-Over-HTTPS ( DoH ) for the distribution of configuration information that’s done either via a project hidden on GITHUB or Baidu Tieba, or via a built-in domain name hard-coded into some of the samples.

Architecture 123

Architecture DDOS Advertising Firmware 123

Security Affairs

JULY 23, 2019

The attackers demonstrated an increasing level of sophistication across the years, they used custom-malware and various exploits in their attacks. “Second, we identified a previously undocumented malware family with strong links to the Ke3chang group – a backdoor we named Okrum. ” reads the report published by ESET. .”

DNS 86

DNS Malware Advertising Manufacturing 86

Security Affairs

JANUARY 18, 2022

“The user eventually downloads an archive file containing either a malicious LNK file or an executable — eventually leading to a Cobalt Strike loader.” ” The threat actors were observed deploying Cobalt Strike in the infected networks, along with a set of additional malware and web shells.

Cryptocurrency 112

Cryptocurrency Social Engineering Media Phishing 112

Security Affairs

MAY 27, 2020

“Recently, our DNS data based threat monitoning system DNSmon flagged a suspicious domain pro.csocools.com. “We traced its family back to the ShuangQiang (double gun) campaign, in the past, this campaign has been exposed by multiple security vendors, but it has rvivied and come back with new methods and great force.”

Advertising 100

Advertising DNS Software Malware 100

Security Affairs

OCTOBER 21, 2019

Security experts have a new malware, dubbed skip-2.0 Security experts at ESET have discovered a new malware, dubbed skip-2.0, malware was used by threat actors to establish a backdoor in MSSQL Server 11 and 12 servers, allowing them to access to any account on the server using a “magic password.”

Malware 45

Malware Passwords Advertising DNS 45

Security Affairs

MARCH 3, 2021

110 PAGESLOADED WITH EXCELLENT CONTENT Learn from the experts, cybersecurity best practices Find out about upcoming information security related conferences, expos and trade shows. You can download a PDF version once you open the page flipping version) Do you like Yumpu, an alternative online flipbook version?

InfoSec 65

InfoSec DNS Media Marketing 65