Security Affairs

FEBRUARY 23, 2020

Cisco Talos researchers discovered a new malware, tracked as ObliqueRAT, that was employed targeted attacks against organizations in Southeast Asia. Experts from Cisco Talos discovered a new malware, tracked as ObliqueRAT, that appears a custom malware developed by a threat actor focused on government and diplomatic targets. .

Government 120

Government Malware Advertising Passwords 120

Security Affairs

SEPTEMBER 10, 2020

ESET researchers discovered a new piece of malware dubbed CDRThief targets a specific Voice over IP system to steal call data records (CDR). The VoIP platform Linknat VOS2009 and VOS3000 targeted by the malware is used by two China-produced softswitches (software switches). ” reads the analysis published by ESET.

Malware 122

Malware Encryption Advertising Passwords 122

Security Affairs

JUNE 11, 2021

Experts spotted a new mysterious malware that was used to collect a huge amount of data, including sensitive files, credentials, and cookies. Threat actors used custom malware to steal data from 3.2 NordLocker experts speculate the malware campaign leveraged tainted Adobe Photoshop versions, pirated games, and Windows cracking tools.

Malware 116

Malware Computers and Electronics Software Financial Services 116

Security Affairs

JANUARY 16, 2023

Security firm Avast has released a free decryptor for the BianLian ransomware to allow victims of the malware to recover locked files. The BianLian ransomware emerged in August 2022, the malware was employed in attacks against organizations in various industries, including manufactoring, media and entertainment, and healthcare.

Ransomware 95

Ransomware Malware Antivirus Encryption 95

Security Affairs

MAY 13, 2024

Subject lines included “your document” and “photo of you???”. ” To defend against ransomware campaign like this one, NJCCIC provided the following recommendations: Security Awareness Training : Engage in security awareness training to enhance defense mechanisms and recognize potential signs of malicious communications. .”

Phishing 115

Phishing Ransomware Security Awareness Authentication 115

Security Affairs

AUGUST 4, 2022

The attackers were delivering the malware using archive files and Microsoft Office documents exploiting the Follina Windows flaw ( CVE-2022-30190 ). “The earliest versions of this Rat was typically archived into a zip file pretending to be a document specific to a Russian group.

Malware 99

Malware Information Security Encryption Phishing 99

Malwarebytes

AUGUST 3, 2022

This advanced custom Rat is mainly the work of a threat actor that targets Russian entities by using lures in archive file format and more recently Office documents leveraging the Follina vulnerability. The earliest versions of this Rat was typically archived into a zip file pretending to be a document specific to a Russian group.

Malware 109

Malware Encryption Antivirus Architecture 109

Security Affairs

FEBRUARY 10, 2024

The malware impersonates a Visual Studio update and was designed to support Intel and Arm architectures. The malware has been active since at least November 2023, but it was fist spotted on February 2 nd 2024. RustDoor is written in Rust language and supports multiple features.

Ransomware 124

Ransomware Architecture Malware Passwords 124

Security Affairs

FEBRUARY 12, 2024

The seizure is the result of an international law enforcement operation, federal authorities in Atlanta and Boston charged individuals in Malta and Nigeria, for their involvement in selling the malware. According to court documents, the FBI covertly purchased and analyzed the Warzone RAT. ” concludes DoJ.

Malware 105

Malware Hacking Cybercrime Advertising 105

Security Affairs

JANUARY 21, 2021

With a simple Google search, anyone could have found the password to one of the compromised, stolen email addresses: a gift to every opportunistic attacker.” Once the victim double-clicked the HTML file, a blurred image with a preconfigured email within the document is opened in the browser. ” continues the post.

Phishing 127

Phishing Passwords Manufacturing Healthcare 127

Security Affairs

AUGUST 26, 2021

Cybersecurity and Infrastructure Security Agency (CISA) released five malware analysis reports (MARs) related to samples found on compromised Pulse Secure devices. CISA published five malware analysis reports (MARs) related to samples found on compromised Pulse Secure devices. ” reads CISA’s advisory.

Malware 129

Malware VPN Authentication Hacking 129

Security Affairs

APRIL 16, 2024

LightSpy can steal files from multiple popular applications like Telegram, QQ, and WeChat, as well as personal documents and media stored on the device. First documented in 2020 by Trend Micro and Kaspersky, LightSpy refers to an advanced iOS backdoor that’s distributed via watering hole attacks through compromised news sites.

Spyware 108

Spyware Mobile Malware Encryption 108

Security Affairs

SEPTEMBER 7, 2023

In April Cyble Research and Intelligence Labs (CRIL) discovered a Telegram channel advertising a new information-stealing malware, named Atomic macOS Stealer (AMOS). The malware targets macOS, it was designed to steal sensitive information from the infected systems.

Malware 110

Malware Passwords Engineering Software 110

Security Affairs

MARCH 27, 2023

Upon opening the reports, the infection process starts leading to the deployment of malware on the victim’s system. A deep investigation into the campaign revealed several undisclosed malware and interesting data exfiltration tools used by the group. The report details the execution flow for each of the above malware.

Malware 89

Malware Phishing Passwords Government 89

Security Affairs

APRIL 29, 2023

Atomic macOS Stealer is a new information stealer targeting macOS that is advertised on Telegram for $1,000 per month. Cyble Research and Intelligence Labs (CRIL) recently discovered a Telegram channel advertising a new information-stealing malware, named Atomic macOS Stealer (AMOS). ” concludes the report.

Advertising 87

Advertising Passwords Malware Password Management 87

Security Affairs

SEPTEMBER 24, 2020

jp) email addresses that have been infected with the infamous malware and that can be employed in further spam campaigns. The recent Emotet campaign uses spam messages with password-protected attachments, experts noticed a decline in infections over the weekend, a behavior already observed in the past.

Malware 129

Malware Passwords Advertising Cybercrime 129

Security Affairs

DECEMBER 25, 2021

. “This letter is to inform you that you have been exposed to a coworker who tested positive for OMICRON variant of COVID-19 sometime between December 18th and 20th,” reads a phishing message shared by Bleeping Computer. “Please take a look at the details in the attached document.”

Phishing 131

Phishing Passwords Banking Malware 131

Security Affairs

SEPTEMBER 10, 2020

ESET researchers discovered a new piece of malware dubbed CDRThief targets a specific Voice over IP system to steal call data records (CDR). The VoIP platform Linknat VOS2009 and VOS3000 targeted by the malware is used by two China-produced softswitches (software switches). ” reads the analysis published by ESET.

Malware 70

Malware Encryption Advertising Passwords 70

Security Affairs

FEBRUARY 12, 2024

Public Wi-Fi users are prime targets for MITM attacks because the information they send is often not encrypted, meaning it’s easy for hackers to access your data. Once they’re in, they can grab your emails, usernames, passwords, and more. They might even lock you out of your own accounts by resetting your passwords.

DNS 128

DNS VPN Encryption Passwords 128

Malwarebytes

AUGUST 3, 2022

This advanced custom Rat is mainly the work of a threat actor that targets Russian entities by using lures in archive file format and more recently Office documents leveraging the Follina vulnerability. The earliest versions of this Rat was typically archived into a zip file pretending to be a document specific to a Russian group.

Malware 63

Malware Encryption Antivirus Architecture 63

Krebs on Security

OCTOBER 28, 2020

In August, Gunnebo said it had successfully thwarted a ransomware attack, but this week it emerged that the intruders stole and published online tens of thousands of sensitive documents — including schematics of client bank vaults and surveillance systems. What’s more, Syrén seemed to downplay the severity of the exposure.

Hacking 343

Hacking Ransomware Banking Accountability 343

Security Affairs

MARCH 20, 2023

The infamous Emotet malware is back after a short hiatus, threat actors are spreading it via Microsoft OneNote email attachments. The Emotet malware returns after a three-month hiatus and threat actors are distributing it via Microsoft OneNote email attachments to avoid detection. ” reads the post published by MalwareBytes.

Malware 91

Malware Banking Engineering Passwords 91

Security Affairs

DECEMBER 31, 2020

An Emotet campaign hit Lithuania, the malware has infected systems at the National Center for Public Health (NVSC) and several municipalities. A large-scale Emotet campaign hit Lithuania, the malware has infected the networks of Lithuania’s National Center for Public Health (NVSC) and several municipalities. since August.

Passwords 104

Passwords Malware Telecommunications Banking 104

Security Affairs

SEPTEMBER 20, 2019

Agent Tesla is a fully customizable password info-stealer offered as malware-as-a-service , many cyber criminals are choosing it as their preferred recognition tool. . Nowadays the Malware-As-A-Service is one of the criminal favorite ways to breach security perimeter. Agent Tesla is one of these “ commodity malware ”.

Malware 82

Malware Advertising Accountability Passwords 82

Security Affairs

APRIL 6, 2023

The credentials provided by the recipient are sent to an attacker-controlled URL, however, after the recipient enters their password, the phishing page redirects to a benign document that contains the interview questions, or an RFI that includes information of interest for the victims.

Phishing 86

Phishing Media Passwords Malware 86

Security Affairs

MAY 20, 2021

Microsoft warns of a malware campaign that is spreading a RAT dubbed named STRRAT masquerading as ransomware. Microsoft Security Intelligence researchers uncovered a malware campaign that is spreading a remote access trojan (RAT) tracked as STRRAT. The latest version of the Java-based STRRAT malware (1.5)

Ransomware 129

Ransomware Malware Encryption Security Intelligence 129

Security Affairs

OCTOBER 1, 2020

Emotet is a malware infection that spreads through spam emails containing malicious Word or Excel documents. The recent Emotet campaign uses spam messages with password-protected attachments. In the middle-August, the malware was employed in fresh COVID19-themed spam campaign. SecurityAffairs – hacking, malware).

Malware 138

Malware Advertising Banking Passwords 138

Security Affairs

JULY 8, 2023

Iran-linked APT group tracked TA453 has been linked to a new malware campaign targeting both Windows and macOS systems. The Iran-linked threat actor TA453 has been linked to a malware campaign that targets both Windows and macOS. TA453 in May 2023 started using LNK infection chains instead of Microsoft Word documents with macros.

Malware 96

Malware VPN Media Encryption 96

Security Affairs

JUNE 21, 2021

The group published the link to 13 password-protected archives, allegedly containing sensitive data stolen from the chipmaker. Attention Password for the Archives: XXXXXXXXXXX#1JLDiw8″ reads the post published by the group on its leak site. !!Inside Install and regularly update anti-virus or anti-malware software on all hosts.

Ransomware 138

Ransomware Passwords VPN Authentication 138

Security Affairs

JUNE 8, 2023

The campaign has the objective of stealing Google and subscription credentials of a reputable news and analysis service focusing on North Korea, as well as delivering reconnaissance malware. At the end of October 2020, the US-CERT published a report on Kimusky’s recent activities that provided information on their TTPs and infrastructure.

Social Engineering 76

Social Engineering Engineering Malware Risk 76

Security Affairs

MAY 11, 2021

Court documents revealed that the infamous XcodeGhost malware, which has been active since 2015, infected 128 million iOS users. Documents provided in a court case that sees Epic Games v. revealed that the XcodeGhost malware impacted 128 million iOS users. ” reported Arstechnica.

Malware 111

Malware Hacking Mobile Passwords 111

Security Affairs

JULY 11, 2022

BlackCat (aka ALPHV) Ransomware gang introduced an advanced search by stolen victim’s passwords, and confidential documents. They introduced an advanced search by stolen victim’s passwords, and confidential documents leaked in the TOR network. ALPHV seems to be significantly competing with Lockbit 3.0

Ransomware 89

Ransomware Passwords Data breaches Technology 89

Security Affairs

JANUARY 27, 2021

In the middle-August, the malware was employed in fresh COVID19-themed spam campaign. Recent spam campaigns used messages with malicious Word documents, or links to them, pretending to be an invoice, shipping information, COVID-19 information , resumes, financial documents, or scanned documents.

Banking 115

Banking Malware Passwords Hacking 115

Security Affairs

FEBRUARY 26, 2021

“Through the use of scheduled tasks, the malware propagates itself – machine to machine – within the Windows domain. “The Ryuk variant analyzed in this document does have self-replication capabilities. “The content of this scheduled task is described in the analysis present in this document.

Ransomware 130

Ransomware Passwords Accountability Encryption 130

Security Affairs

MAY 22, 2021

. “The main goal of the hackers was to completely compromise the IT infrastructure and steal confidential information, including documents from closed segments and mail correspondence of key federal executive authorities.” The threat actors employed two previosuly undetected piece of malware dubbed Mail-O and Webdav-O.

Computers and Electronics 118

Computers and Electronics Malware Antivirus Government 118

Security Affairs

OCTOBER 6, 2020

In the middle-August, the malware was employed in fresh COVID19-themed spam campaign. Recent spam campaigns used messages with malicious Word documents, or links to them, pretending to be an invoice, shipping information, COVID-19 information , resumes, financial documents, or scanned documents.

Government 134

Government Banking Advertising Malware 134

Security Affairs

MARCH 17, 2020

Malware researchers from Cybaze-Yoroi ZLab have uncovered a new Ursnif campaign that is targeting Italy with a new infection chain. Sample information. Once the Microsoft Word document is opened, it will ask for a password to enable the opening of the document: Figure 2: Request of the password inside the document.

Passwords 131

Passwords Malware Advertising Engineering 131