SecureList

NOVEMBER 26, 2021

The attackers obtain initial access to a system by sending a spear-phishing email to the victim containing a Dropbox download link. If the victim opens the document, Microsoft Office downloads the script and runs it using the MSHTML engine. After this, they were tricked into downloading previously unknown malware.

Malware 101

Malware Banking Energy and Utilities Accountability 101

Security Affairs

JANUARY 21, 2022

At the end of 2021, researchers discovered a UEFI firmware-level compromise by analyzing logs from its Firmware Scanner. Threat actors compromised a single component within the firmware image to intercept the original execution flow of the machine’s boot sequence and inject the sophisticated implant. Pierluigi Paganini.

Firmware 131

Firmware Malware Spyware Surveillance 131

SecureList

APRIL 27, 2022

We have previously seen DustSquad use third-party post-exploitation tools, such as the password dumping utility fgdump; but we have now observed new custom C modules, a first for DustSquad, and Delphi downloaders acting as post-exploitation facilitators, able to gather documents of interest for the actor. Other interesting discoveries.

Malware 137

Malware Firmware Government Phishing 137

SecureList

NOVEMBER 30, 2021

Based on forensic analysis of numerous mobile devices, Amnesty International’s Security Lab found that the software was repeatedly used in an abusive manner for surveillance. As part of the infection chain, Lazarus used a downloader named Racket, which they signed using a stolen certificate. Firmware vulnerabilities.

Malware 117

Malware Mobile Spyware Surveillance 117

eSecurity Planet

OCTOBER 21, 2022

Adware is often smuggled onto a device, either by users who don’t know what they’re downloading or by hiding it in an otherwise innocuous piece of software like a search engine toolbar plugin for your browser. Firmware rootkits are also known as “hardware rootkits.”.

Malware 75

Malware Adware Spyware Antivirus 75

SecureList

OCTOBER 26, 2021

Following this, they were tricked into downloading previously unknown malware. On June 3, Check Point published a report about an ongoing surveillance operation targeting a Southeast Asian government, and attributed the malicious activities to a Chinese-speaking threat actor named SharpPanda. The C2 domain code.microsoft[.]com

Malware 144

Malware Government Surveillance Spyware 144

CyberSecurity Insiders

SEPTEMBER 24, 2021

China-based video surveillance related product offering company Hikvision has issued a security advisory saying that all those using their security cameras and NVRs must know a critical vulnerability on its devices that could allow hackers to take control of the cameras and use them as bots to launch DDoS or other related attacks.

Surveillance 96

Surveillance Firmware DDOS IoT 96