Remove DNS Remove Hacking Remove Technology Remove Telecommunications
article thumbnail

Russian Sandworm APT impersonates Ukrainian telcos to deliver malware

Security Affairs

Russia-linked APT group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. Russia-linked cyberespionage group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. ” reads the report published by Recorded Future.

Malware 84
article thumbnail

Russia-linked IRIDIUM APT linked to Prestige ransomware attacks against Ukraine

Security Affairs

Sandworm (aka BlackEnergy and TeleBots ) has been active since 2000, it operates under the control of Unit 74455 of the Russian GRU’s Main Center for Special Technologies (GTsST). The researchers observed C2 infrastructure relying on dynamic DNS domains masquerading as Ukrainian telecommunication service providers.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Lyceum APT made the headlines with attacks in Middle East

Security Affairs

reported that Hexane is targeting organizations in the oil and gas industry and telecommunication providers. A superficial analysis of the document content might conclude that this document was intended for individuals working with industrial control systems (ICS) or operational technology (OT).” Security experts at Dragos Inc.

DNS 82
article thumbnail

Canadian Police Raid ‘Orcus RAT’ Author

Krebs on Security

As first detailed by KrebsOnSecurity in July 2016 , Orcus is the brainchild of John “Armada” Rezvesz , a Toronto resident who until recently maintained and sold the RAT under the company name Orcus Technologies. In an “official press release” posted to pastebin.com on Mar.

article thumbnail

Operation Lyrebird: Group-IB assists INTERPOL in identifying suspect behind numerous cybercrimes worldwide

Security Affairs

According to the DNS data analysis, this name was used to register at least two domains, which were created using the email from the phishing kit. SecurityAffairs – hacking, Operation Lyrebird). ” said Dmitry Volkov Group-IB CTO and Head of Threat Hunting Intelligence. Original post at [link]. Pierluigi Paganini.

article thumbnail

OilRig APT group: the evolution of attack techniques over time

Security Affairs

The group has targeted a variety of industries, including financial, government, energy, chemical, and telecommunications, and has largely focused its operations within the Middle East. T1094) mainly developed using DNS resolutions (which is actually one of the main characteristic of the attacker group).

article thumbnail

ICANN warns of large-scale attacks on Internet infrastructure

Security Affairs

. “The Internet Corporation for Assigned Names and Numbers ( ICANN ) believes that there is an ongoing and significant risk to key parts of the Domain Name System ( DNS ) infrastructure. “They are going after the internet infrastructure itself,” ICANN chief technology officer David Conrad told AFP. Pierluigi Paganini.