article thumbnail

Lyceum APT made the headlines with attacks in Middle East

Security Affairs

reported that Hexane is targeting organizations in the oil and gas industry and telecommunication providers. The malware uses DNS and HTTP-based communication mechanisms. The group also used the ‘Decrypt-RDCMan.ps1,’ that is a password decryption tool included in the PoshC2 framework for penetration testing.

DNS 80
article thumbnail

What is a Managed Security Service Provider? MSSPs Explained

eSecurity Planet

History of MSSPs As internet service providers (ISPs) and telecommunications companies (telecoms) began offering commercial access to the internet in the late 1990s, they began to also offer firewall appliances and associated managed services. assets (endpoints, servers, IoT, routers, etc.), Outsourcing U.S. companies may trust U.S.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

OilRig APT group: the evolution of attack techniques over time

Security Affairs

The group has targeted a variety of industries, including financial, government, energy, chemical, and telecommunications, and has largely focused its operations within the Middle East. T1094) mainly developed using DNS resolutions (which is actually one of the main characteristic of the attacker group).

article thumbnail

Guarding Against Solorigate TTPs

eSecurity Planet

The National Telecommunications and Information Administration (NTIA) offers the concept of a Software Bill of Materials (SBOM) to address this problem. Attackers can steal source code , detection tools, and penetration testing technologies built to fend off the best malicious threats in the world. Mail DNS controls.

article thumbnail

APT34: Glimpse project

Security Affairs

Indeed we might observe a File-based command and control (a quite unusual solution) structure, a VBS launcher, a PowerShell Payload and a covert channel over DNS engine. The group conducts operations primarily in the Middle East, targeting financial, government, energy, chemical, telecommunications and other industries.

DNS 81
article thumbnail

Iran-linked APT34: Analyzing the webmask project

Security Affairs

Security expert Marco Ramilli published the findings of a quick analysis of the webmask project standing behind the DNS attacks implemented by APT34 (aka OilRig and HelixKitten ). The group conducts operations primarily in the Middle East, targeting financial, government, energy, chemical, telecommunications and other industries.

DNS 71
article thumbnail

Iranian Threat Actors: Preliminary Analysis

Security Affairs

If so we are facing a state-sponsored group with high capabilities in developing persistence and hidden communication channels (for example over DNS) but without a deep interest in exploiting services. The group’s victims are mainly in the telecommunications, government (IT services), and oil sectors.”