Security Affairs

FEBRUARY 23, 2022

Iranian national media corporation, Islamic Republic of Iran Broadcasting (IRIB), was hit by a wiper malware in late January 2022. Researchers from CheckPoint that investigated the attack reported that the attackers used a wiper malware to disrupt the state’s broadcasting networks, damaging both TV and radio networks.

Malware 107

Malware Passwords Backups Hacking 107

Security Affairs

NOVEMBER 2, 2021

The FBI warns of ransomware attacks on businesses involved in “time-sensitive financial events” such as corporate mergers and acquisitions. Ransomware gangs target these companies because there is a high likelihood that they will pay the ransom to avoid the impact of the disclosure of sensitive data during these events.

Ransomware 80

Ransomware Hacking Accountability Cybercrime 80

Security Affairs

DECEMBER 21, 2020

“The malware is secretly implanted onto a server, it receives C2 signals remotely and executes them in the context of the server user.” SecurityAffairs – hacking, SolarWinds). The post SUPERNOVA, a backdoor found while investigating SolarWinds hack appeared first on Security Affairs. Pierluigi Paganini.

Hacking 145

Hacking Software Malware Information Security 145

Security Affairs

JANUARY 5, 2022

Cybersecurity researchers demonstrate how to use electromagnetic field emanations from IoT devices to detect malware. The team of experts presented their technique at the Annual Computer Security Applications Conference ( ACSAC ) that took place in December. ” reads a research paper published by the experts.

IoT 119

IoT Malware Internet Internet 119

Security Affairs

NOVEMBER 11, 2020

Ragnar Locker gangs started hacking into a Facebook advertiser’s account and creating advertisements their hack, this has already happened with the recent attack on the Italian liquor company Campari Group. 3 that its computer systems had been sidelined by a malware attack.” 9, on Facebook. . 9, on Facebook.

Advertising 127

Advertising Hacking Ransomware Accountability 127

Security Affairs

JUNE 20, 2022

The developers behind the BRATA Android malware have implemented additional features to avoid detection. The operators behind the BRATA Android malware have implemented more features to make their attacks stealthy. “TAs are modifying their code in order to tailor their malware on specific banking institutions.

Malware 100

Malware Banking Antivirus Phishing 100

Security Affairs

OCTOBER 31, 2022

Italy was also marginally affected by the attack and the case was dealt with by the Computer Crime Operations Centre of the Postal Police (CNAIPIC ) [link] , which promptly issued an alert [link] on the very day of the event, recommending some useful actions also to prevent further possible propagation. SecurityAffairs – hacking, Wannacry).

Malware 99

Malware Computers and Electronics Encryption Ransomware 99

Security Affairs

FEBRUARY 21, 2024

Upon opening the reports, the infection process starts leading to the deployment of malware on the victim’s system. In the recent campaign, threat actors used a customized PlugX malware that includes a completed backdoor command module, the researchers named it DOPLUGS. ” reads the report published by Trend Micro.

Malware 116

Malware Phishing Government Passwords 116

Security Affairs

AUGUST 29, 2023

On May 30, 2023, the vendor provided a Preliminary Summary of Key Findings related to its investigation that includes a timeline of events, Indicators of Compromise (IOCs), and recommended actions for impacted customers. The company notified via the ESG user interface the customers whose appliances they believe were impacted.

Government 107

Government Hacking Malware Accountability 107

Security Affairs

DECEMBER 31, 2023

INC RANSOM ransomware gang claims to have breached Xerox Corp Spotify music converter TuneFab puts users at risk Cyber attacks hit the Assembly of the Republic of Albania and telecom company One Albania Russia-linked APT28 used new malware in a recent phishing campaign Clash of Clans gamers at risk while using third-party app New Version of Meduza (..)

Artificial Intelligence 104

Artificial Intelligence Cyber Attacks Malware Ransomware 104

Security Affairs

SEPTEMBER 10, 2020

ESET researchers discovered a new piece of malware dubbed CDRThief targets a specific Voice over IP system to steal call data records (CDR). The VoIP platform Linknat VOS2009 and VOS3000 targeted by the malware is used by two China-produced softswitches (software switches). ” reads the analysis published by ESET.

Malware 119

Malware Encryption Advertising Passwords 119

Security Affairs

JANUARY 15, 2024

Balada Injector malware infected more than 7100 WordPress sites using a vulnerable version of the Popup Builder plugin. The Balada injector is a malware family that has been active since 2017. The malware supports multiple attack vectors and persistence mechanisms.

Malware 115

Malware Hacking Accountability Information Security 115

Security Affairs

JANUARY 17, 2024

The iOS devices log any reboot event in this file along with multiple environment information. The analysis of the infections also revealed other similarities such as the path associated with malware execution (“/private/var/db/”). The experts noticed some log entry notes related to processes that prevented a normal reboot.

Spyware 126

Spyware Mobile Malware Surveillance 126

Security Affairs

JANUARY 12, 2021

Google Project Zero researchers uncovered a sophisticated hacking campaign that targeted Windows and Android users. And who puts "informational" event logging in their Android downloader malware? SecurityAffairs – hacking, Project Zero). Pierluigi Paganini.

Hacking 110

Hacking Engineering Malware Information Security 110

Security Affairs

SEPTEMBER 3, 2021

Mandiant researchers spotted a new malware family, dubbed PRIVATELOG, that relies on the Common Log File System (CLFS) to evade detection solutions. CLFS can be used for both data logging as well as for event logging. Mandiant provides YARA rules to detect PRIVATELOG and STASHLOG malware as well as possible variants.

Malware 98

Malware Encryption Hacking Cybersecurity 98

Security Affairs

FEBRUARY 19, 2024

The gang also published several pictures of passports and company documents as proof of the hack. The ransomware identifies user accounts by viewing successful logins in Windows Event Viewer, it also uses a modified variant of the open-source PSnmap Tool. Cactus Ransomware has just posted Schneider Electric.

Ransomware 106

Ransomware Digital transformation Retail Antivirus 106

Daniel Miessler

MAY 19, 2021

My Definitions of Event, Alert, and Incident. A definitions reminder: Incident : A security event that compromises the integrity, confidentiality or availability of an information asset. For incidents, the breakdown was: dos (hacking), phishing (social), other, and then ransomware (malware).

Data breaches 192

Data breaches Social Engineering Ransomware Phishing 192

Security Affairs

JUNE 1, 2023

The BlackCat ransomware gang claims to have hacked the Casepoint legal technology platform used US agencies, including SEC and FBI. ” In the event that the security breach is verified, it is reasonable to speculate that the ransomware group might have compromised sensitive and possibly classified information.

Technology 81

Technology Hacking Ransomware Manufacturing 81

Security Affairs

NOVEMBER 7, 2020

On the second day of the Pwn2Own Tokyo 2020 hacking competition, bug bounty hunters hacked a TP-Link router and a Synology NAS. Day 2 of the popular Pwn2Own Tokyo hacking competition is concluded, due to the COVID-19 pandemic the competition has been arranged as a virtual event. Pierluigi Paganini.

Hacking 96

Hacking Information Security Malware 96

Security Affairs

FEBRUARY 29, 2024

The cyberspies used a bait PDF document masqueraded as an invitation letter from the Ambassador of India, inviting diplomats to a wine-tasting event in February 2024. The researchers pointed out that WINELOADER is not injected into the DLLs that contain exported functions used by the malware.

Malware 105

Malware Hacking Information Security 105

Security Affairs

APRIL 21, 2021

REvil ransomware gang is attempting to extort Apple ahead of the Apple Spring Loaded event threatening to sell stolen blueprints belonging to the IT giant that were stolen from Quanta Computer. As proof of the hack, REvil operators leaked some schematics of MacBook components on the leak site. SecurityAffairs – hacking, Quanta).

Computers and Electronics 114

Computers and Electronics Ransomware Hacking Wireless 114

Security Affairs

MARCH 13, 2022

This post provides a timeline of the events related to the Russia invasion of Ukraine from the cyber security perspective. March 11 – Anonymous hacked Roskomnadzor agency revealing Russian disinformation. Threat actors are spreading password-stealing malware disguised as a security tool to target Ukraine’s IT Army.

Hacking 87

Hacking DDOS Phishing Malware 87

Security Affairs

NOVEMBER 6, 2023

Google Calendar RAT is a PoC of Command&Control (C2) over Google Calendar Events, it was developed red teaming activities. “The script creates a ‘Covert Channel’ by exploiting the event descriptions in Google Calendar. “To use GRC, only a Gmail account is required.” ” reads the Google Report.

Accountability 134

Accountability Hacking Information Security Malware 134

Security Affairs

NOVEMBER 3, 2023

The bad news is that, in some cases, threat actors spread malware-laced mods to infect as many devices as possible. The broadcast receiver gets a message like that, it calls the event handler. Then the malware contacts the command-and-control (C2) server and sends information about the compromised device (i.e.

Spyware 109

Spyware Malware Mobile Advertising 109

Security Affairs

FEBRUARY 16, 2024

The malware uses Windows events for synchronization, with the first primary malware thread initiated in the DLL’s ServiceMain function. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, Turla) The report includes indicators of compromise (IoCs).

Password Management 108

Password Management Malware Passwords Hacking 108

Security Affairs

SEPTEMBER 10, 2020

ESET researchers discovered a new piece of malware dubbed CDRThief targets a specific Voice over IP system to steal call data records (CDR). The VoIP platform Linknat VOS2009 and VOS3000 targeted by the malware is used by two China-produced softswitches (software switches). ” reads the analysis published by ESET.

Malware 68

Malware Encryption Advertising Passwords 68

Security Affairs

MAY 1, 2024

Attackers used “super-aged” domains, usually registered before the year 2000, to avoid DNS blocklists and blending in with old malware at the same time The attackers manipulate MX (Mail Exchange) records by injecting fake responses through China’s Great Firewall. ” concludes the report.

DNS 123

DNS Firewall DDOS Hacking 123

Security Affairs

MAY 4, 2020

Hackers are conducting a mass-scanning the Internet for vulnerable Salt installs that could allow them to hack the organizations, the last victim is the Ghost blogging platform. Salt (aka SaltStack) is Python-based, open-source software for event-driven IT automation, remote task execution, and configuration management.

Internet 114

Internet Internet Hacking Advertising 114

Security Affairs

MAY 17, 2024

These files contained law enforcement incident and traffic information, which include names, Social Security numbers, driver’s license or state identification card numbers, and payment card information.” ” reads the Notice of Data Event updated on May 14, 2024.

Data breaches 93

Data breaches Ransomware Hacking Cybercrime 93

Security Affairs

NOVEMBER 28, 2021

North Korea-linked threat actors posed as Samsung recruiters in a spear-phishing campaign aimed at employees at South Korean security firms. North Korea-linked APT group posed as Samsung recruiters is a spear-phishing campaign that targeted South Korean security companies that sell anti-malware solutions, Google TAG researchers reported.

Malware 127

Malware Phishing Antivirus Hacking 127

Security Affairs

APRIL 18, 2022

This post provides a timeline of the events related to the Russian invasion of Ukraine from the cyber security perspective. Below is the timeline of the events related to the ongoing invasion that occurred in the previous weeks: April 16 – The unceasing action of Anonymous against Russia. To nominate, please visit:?

Hacking 93

Hacking Ransomware Government Malware 93

Security Affairs

NOVEMBER 11, 2021

The hacked server was used by the company to manage customer information for the Queensland water supplier. The security breach took place between August 2020 and May 2021, the intrusion has been attributed to a financially motivated attacker that deployed a custom implant to redirect visitor traffic to an online video platform.

Hacking 89

Hacking Passwords Government Security Awareness 89

Security Affairs

SEPTEMBER 11, 2022

SecurityAffairs – hacking, newsletter). The post Security Affairs newsletter Round 383 appeared first on Security Affairs. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

Data breaches 96

Data breaches Ransomware Phishing Malware 96

Security Affairs

AUGUST 20, 2019

Your IP address represents your digital identity online, hacking it not only allows attackers to access your device or your accounts, but it may cause even bigger damage. Cybercriminals are interested in hacking your IP address for various reasons. The hacked and stolen IPs are often used for carrying out illegal activities.

Hacking 91

Hacking VPN Internet Internet 91

Security Affairs

SEPTEMBER 27, 2023

US and Japanese authorities warn that a China-linked APT BlackTech planted backdoor in Cisco router firmware to hack the businesses in both countries. The nation-state actors employed multiple custom malware families targeting Windows, Linux, and FreeBSD operating systems.

Firmware 114

Firmware Telecommunications System Administration Malware 114

Security Affairs

JUNE 18, 2022

Malibot is a new Android malware targeting online banking and cryptocurrency wallet customers in Spain and Italy. F5 Labs researchers spotted a new strain of Android malware, named Malibot, that is targeting online banking and cryptocurrency wallet customers in Spain and Italy. ” reads the advisory published by F5 Labs.

Banking 117

Banking Cryptocurrency Malware Mobile 117

Security Affairs

FEBRUARY 21, 2022

Researchers speculate that the two malware could have been developed by the same actor, or at least by someone familiar with the codebase of the Alien banking Trojan. Alien operation was providing a Malware-as-a-Service (MaaS) an it was advertised on several underground hacking forums. SecurityAffairs – hacking, Xenomorph).

Banking 125

Banking Malware Marketing Cryptocurrency 125