Government, Hacking, Malware and Security Intelligence

Purple Lambert, a new malware of CIA-linked Lambert APT group

Security Affairs

APRIL 29, 2021

Cybersecurity firm Kaspersky discovered a new strain of malware that is believed to be part of the arsenal of theUS Central Intelligence Agency (CIA). Cybersecurity firm Kaspersky has discovered a new malware that experts attribute to the US Central Intelligence Agency. We therefore named this malware Purple Lambert.”

Malware

Malware Hacking Government Telecommunications

Microsoft warns TA505 changed tactic in an ongoing malware campaign

Security Affairs

FEBRUARY 2, 2020

In contrast, past Dudear email campaigns carried the malware as attachment or used malicious URLs. pic.twitter.com/mcRyEBUmQH — Microsoft Security Intelligence (@MsftSecIntel) January 30, 2020. TA505 hacking group has been active since 2014 focusing on Retail and banking sectors. based electrical company, a U.S.

Malware

Malware Security Intelligence Banking Phishing

Updated Kmsdx botnet targets IoT devices

Security Affairs

AUGUST 28, 2023

The Akamai Security Intelligence Response Team (SIRT) discovered a new version of the KmsdBot botnet that employed an updated Kmsdx binary targeting Internet of Things (IoT) devices. The malware was employed in cryptocurrency mining campaigns and to launch denial-of-service (DDoS) attacks.

IoT

IoT DDOS Architecture Internet

Russia-linked Nobelium APT targets orgs in the global IT supply chain

Security Affairs

OCTOBER 25, 2021

The NOBELIUM APT ( APT29 , Cozy Bear , and The Dukes) is the threat actor that conducted supply chain attack against SolarWinds, which involved multiple families of implants, including the SUNBURST backdoor , TEARDROP malware , GoldMax malware , Sibot , and GoldFinder backdoors. SecurityAffairs – hacking, cyber security).

Telecommunications

Telecommunications Technology Hacking Malware

CISA alert warns of Emotet attacks on US govt entities

Security Affairs

OCTOBER 6, 2020

The CISA agency is warning of a surge in Emotet attacks targeting multiple state and local governments in the US since August. The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert to warn of a surge of Emotet attacks that have targeted multiple state and local governments in the U.S. since August.

Government

Government Banking Advertising Malware

Russian Cybercrime group is exploiting Zerologon flaw, Microsoft warns

Security Affairs

OCTOBER 10, 2020

TA505 hacking group has been active since 2014 focusing on Retail and banking sectors. — Microsoft Security Intelligence (@MsftSecIntel) October 6, 2020. — Microsoft Security Intelligence (@MsftSecIntel) October 6, 2020. SecurityAffairs – hacking, Zerologon). states Microsoft.

Cybercrime

Cybercrime Security Intelligence Authentication Banking

Emotet operators are running Halloween-themed campaigns

Security Affairs

OCTOBER 31, 2020

Crooks behind Emotet malware attempt to take advantage of the Halloween festivity, a new campaign could invite you to a Halloween party. Threat actors are attempting to take advantage of the Halloween festivities, a recent Emotet malware campaign spotted by BleepingComputer employed spam emails that invite recipients to a Halloween party.

Banking

Banking Malware Security Intelligence Advertising

Russia-linked IRIDIUM APT linked to Prestige ransomware attacks against Ukraine

Security Affairs

NOVEMBER 11, 2022

Get TTPs and protection info: [link] — Microsoft Security Intelligence (@MsftSecIntel) October 14, 2022. In April, Sandworm targeted energy facilities in Ukraine with a new strain of the Industroyer ICS malware (INDUSTROYER2) and a new version of the CaddyWiper wiper. SecurityAffairs – hacking, Prestige ransomware).

Ransomware

Ransomware Telecommunications DNS Hacking

Researchers warn of a surge in cyber attacks against Microsoft Exchange

Security Affairs

MARCH 12, 2021

Most targeted sectors have been Government/Military (17% of all exploit attempts), followed by Manufacturing (14%), and then Banking (11%). This week, the independent security researcher Nguyen Jang published on GitHub a proof-of-concept tool to hack Microsoft Exchange servers. SecurityAffairs – hacking, Microsoft Exchange).

Cyber Attacks

Cyber Attacks Cybercrime Authentication Hacking

Microsoft partnered with other security firms to takedown TrickBot botnet

Security Affairs

OCTOBER 12, 2020

The security firms have collected more than 125,000 TrickBot malware samples and mapped the command and control infrastructure. The TrickBot botnet was considered by security experts one of the biggest botnets. Microsoft took action against the Trickbot botnet, disrupting one of the world’s most persistent malware operations.

Banking

Banking Malware Advertising Financial Services

A week in security (June 28 – June 4)

Malwarebytes

JULY 5, 2021

Other cybersecurity news.

Cyber Insurance

Cyber Insurance Social Engineering Scams Insurance

Vietnam-linked Bismuth APT leverages coin miners to stay under the radar

Security Affairs

DECEMBER 1, 2020

Learn how the group tried to stay under the radar using threats perceived to be less alarming: [link] — Microsoft Security Intelligence (@MsftSecIntel) November 30, 2020. The hackers targeted organizations across multiple industries and have also hit foreign governments, dissidents, and journalists. ” Microsoft said.

Cryptocurrency

Cryptocurrency Antivirus Manufacturing Government

Apple Unveils 'Lockdown Mode' to Defend Against Spyware

SecureWorld News

JULY 8, 2022

Christopher Hebeisen, Director of Security Intelligence Research at Lookout, discusses: "While these measures certainly strengthen device security, it is important to keep in mind that Lockdown Mode does not reduce the attack surface of third-party apps installed on the device unless those apps also implement separate lockdown measures.

Spyware

Spyware Mobile Surveillance Government

AI/ML and Digital Security

Thales Cloud Protection & Licensing

FEBRUARY 21, 2018

Sixty-four percent of the more than 1,200 senior security executives from around the world, whom we surveyed for the 2018 Thales Data Threat Report (DTR), believe artificial intelligence (AI) “increases data security by recognizing and alerting on attacks,” while 43% believe AI “results in increased threats due to use as a hacking tool.”.

Artificial Intelligence

Artificial Intelligence Big data Government Technology

Australian Govt agency ACSC warns of Emotet and BlueKeep attacks

Security Affairs

NOVEMBER 11, 2019

“The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), with its state and territory partners, is continuing to respond to the widespread malware campaign known as Emotet while responding to reports that hackers are exploiting the BlueKeep vulnerability to mine cryptocurrency.”

Small Business

Small Business Malware Cryptocurrency Advertising

Cyber Security Awareness and Risk Management

Spinone

DECEMBER 26, 2018

The IT landscape’s complexity requires the deployment of Privileged Identity Management technologies, given the increasing sophistication of modern attacks via malware and ungated entries. What are the benefits of cyber security awareness trainings?

Security Awareness

Security Awareness Risk Cyber threats Cyber Risk

Iran-linked Phosphorous APT hacked emails of security conference attendees

Security Affairs

OCTOBER 29, 2020

Iran-linked APT group Phosphorus successfully hacked into the email accounts of multiple high-profile individuals and security conference attendees. “Phosphorus, an Iranian actor, has targeted with this scheme potential attendees of the upcoming Munich Security Conference and the Think 20 (T20) Summit in Saudi Arabia.”

Hacking

Hacking Security Intelligence Accountability Advertising

Microsoft blocked Polonium attacks against Israeli organizations

Security Affairs

JUNE 3, 2022

Microsoft blocked an attack activity aimed at Israeli organizations attributed to a previously unknown Lebanon-based hacking group tracked as POLONIUM. Microsoft announced to have blocked a series of attacks targeting Israeli organizations that have been conducted by a previously unknown Lebanon-based hacking group tracked as POLONIUM.

Security Intelligence

Security Intelligence Antivirus Hacking Authentication

Iran-linked APT groups continue to evolve

Security Affairs

NOVEMBER 17, 2021

Over the past year, Microsoft Threat Intelligence Center (MSTIC) has observed an evolution of the tools, techniques, and procedures employed by Iranian nation-state actors. Learn more from this blog summarizing these trends, as presented at #CyberWarCon : [link] — Microsoft Security Intelligence (@MsftSecIntel) November 16, 2021.

VPN

VPN Social Engineering Accountability Media

Lebanese APT group with suspected links to Hezbollah breached 250 servers worldwide

SC Magazine

JANUARY 29, 2021

Many more companies and organizations have been hacked and that valuable information was stolen over periods of months and years, ClearSky researchers wrote in a blog posted. The group has used a custom-written malware called “Explosive,” an info-stealing Trojan that the group has used since 2015, he said.

Antivirus

Antivirus Malware Cyber threats Media

Iran-linked APT is exploiting the Zerologon flaw in attacks

Security Affairs

OCTOBER 6, 2020

Microsoft 365 Defender customers can also refer to these detections: [link] — Microsoft Security Intelligence (@MsftSecIntel) October 5, 2020. SecurityAffairs – hacking, Zerologon). The post Iran-linked APT is exploiting the Zerologon flaw in attacks appeared first on Security Affairs. Pierluigi Paganini.

Authentication

Authentication Advertising Architecture Security Intelligence

NSO Group Placed on U.S. Blacklist

SecureWorld News

NOVEMBER 4, 2021

The infamous Israel-based NSO Group, known for its hacking spyware Pegasus, was placed on the United States Government's Entity List for engaging in malicious cyber activities, along with three other foreign companies, Candiru, Computer Security Initiative Consultancy PTE (COSEINC), and Positive Technologies.

Spyware

Spyware Government Malware Mobile

Does SolarWinds change the rules in offensive cyber? Experts say no, but offer alternatives

SC Magazine

JANUARY 29, 2021

The sprawling reach of the SolarWinds malware attack that hit government agencies and businesses in December inspires new questions about appropriate response from private sector organizations to cyberattacks from nation states. But intent factors into even government’s options.

Technology

Technology Government Manufacturing Hacking

Cybersecurity Checklist for Political Campaigns

Lenny Zeltser

MAY 3, 2019

Modern applications support features that attackers can abuse to install malware on your system. Enable as many OS and app security features as practical. Use modern, reputable anti-malware software. government. Wondering what tactics attackers used against political campaigns and how you can resist them?

Cybersecurity

Cybersecurity Social Engineering Authentication Software

Recorded Future to Provide Free Access to Elite Intelligence Through New Browser Extension

Security Affairs

MAY 5, 2020

Level up Your Security Program With the Same Security Intelligence Used by the World’s Largest Governments and Many of the Fortune 1000. With this release, Recorded Future is the only intelligence company to openly offer access to its data. Verdict IOCs In 1 View: Enhance Malware Analysis.

Security Intelligence

Security Intelligence Risk Advertising Malware

Cyber Security Informer

Purple Lambert, a new malware of CIA-linked Lambert APT group

Microsoft warns TA505 changed tactic in an ongoing malware campaign

Trending Sources

Updated Kmsdx botnet targets IoT devices

Russia-linked Nobelium APT targets orgs in the global IT supply chain

CISA alert warns of Emotet attacks on US govt entities

Russian Cybercrime group is exploiting Zerologon flaw, Microsoft warns

Emotet operators are running Halloween-themed campaigns

Russia-linked IRIDIUM APT linked to Prestige ransomware attacks against Ukraine

Researchers warn of a surge in cyber attacks against Microsoft Exchange

Microsoft partnered with other security firms to takedown TrickBot botnet

A week in security (June 28 – June 4)

Vietnam-linked Bismuth APT leverages coin miners to stay under the radar

Apple Unveils 'Lockdown Mode' to Defend Against Spyware

AI/ML and Digital Security

Australian Govt agency ACSC warns of Emotet and BlueKeep attacks

Cyber Security Awareness and Risk Management

Iran-linked Phosphorous APT hacked emails of security conference attendees

Microsoft blocked Polonium attacks against Israeli organizations

Iran-linked APT groups continue to evolve

Lebanese APT group with suspected links to Hezbollah breached 250 servers worldwide

Iran-linked APT is exploiting the Zerologon flaw in attacks

NSO Group Placed on U.S. Blacklist

Does SolarWinds change the rules in offensive cyber? Experts say no, but offer alternatives

Cybersecurity Checklist for Political Campaigns

Recorded Future to Provide Free Access to Elite Intelligence Through New Browser Extension

Stay Connected