Krebs on Security

FEBRUARY 16, 2022

. “This vulnerability allows malicious cyber actors to place web shells and conduct post-exploitation activities such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files. This in turn allowed them to access the data, despite this data being encrypted.”

Hacking 229

Hacking Ransomware Media Accountability 229

Security Boulevard

JANUARY 30, 2024

Despite the name, BOFHound is written in Python and is designed to parse raw LDAP search results out of command and control (C2) logfiles (originally from Cobalt Strike logs and the ldapsearch beacon object file [BOF]) into BloodHound compatible JSON.

DNS 61

DNS Data collection Accountability 61

Security Affairs

MAY 15, 2023

The Merdoor dropper spread as a self-extracting RAR (SFX) that contains three files, a legitimate and signed binary vulnerable to DLL search-order hijacking, a malicious loader (Merdoor loader), and an encrypted file (.pak) Reg.exe was used to dump the SAM and SYSTEM registry hives. pak) containing final payload (Merdoor backdoor).

Encryption 92

Encryption DNS Phishing Malware 92

Security Affairs

JUNE 16, 2022

In addition, at least two known affiliates are now adopting BlackCat: DEV-0237 (known for previously deploying Ryuk, Conti, and Hive) and DEV-0504 (previously deployed Ryuk, REvil, BlackMatter, and Conti).” ” reads the post published by Microsoft 365 Defender Threat Intelligence Team.

Ransomware 109

Ransomware Cybercrime Malware Advertising 109

CyberSecurity Insiders

MARCH 23, 2023

For email applications, the malware queries specific Outlook registry keys under the CURRENT_USER hive to extract user, password and server information. For example, for NordVPN, the malware will search the application’s folder and if found, it parses all user.config files to extract the users and passwords. Figure 7) Figure 7.

Malware 121

Malware Cryptocurrency Passwords VPN 121

Approachable Cyber Threats

JULY 3, 2023

open your own browser window and navigate to the website or service using a typed or searched for URL you know is legitimate) to prevent becoming a hacker or scammer's next victim. Our team of cybersecurity experts at Hive Systems is always here to provide support, advice, and products to help make cybersecurity approachable.

Internet 96

Internet Internet Encryption Cybersecurity 96

CyberSecurity Insiders

MAY 19, 2023

By Aaron Sandeen, CEO and co-founder at Securin Since June 2021, Hive Ransomware has been dominating the ransomware scene. Their reach has affected more than 1,500 organizations resulting in Hive receiving ransom payments totaling $100 million. Since June 2021, Hive has targeted an average of three companies per day.

Ransomware 124

Ransomware Encryption Healthcare Education 124

Security Boulevard

OCTOBER 27, 2022

1) In late October, Hive ransomware claimed the attack and began leaking data stolen from Tata Power on its website. (16) Deadbolt ransomware, first seen in early 2021, is part of a small subset of malware which specifically searches for and targets vulnerable network-attached storage (NAS) devices inside a network. (

Cyber Risk 52

Cyber Risk Risk Cryptocurrency Backups 52

Approachable Cyber Threats

JULY 3, 2023

open your own browser window and navigate to the website or service using a typed or searched for URL you know is legitimate) to prevent becoming a hacker or scammer's next victim. Our team of cybersecurity experts at Hive Systems is always here to provide support, advice, and products to help make cybersecurity approachable.

Internet 52

Internet Internet Encryption Cybersecurity 52

SecureList

APRIL 11, 2023

Searching for “Windows Common Log File System Driver Elevation Of Privilege Vulnerability” shows that there have been at least thirty-two such vulnerabilities (not counting CVE-2023-28252) discovered since 2018, where three of them were detected in the wild as zero-days (CVE-2022-24521, CVE-2022-37969, CVE-2023-23376).

Ransomware 124

Ransomware Malware Engineering Technology 124

Approachable Cyber Threats

JANUARY 5, 2022

In our Hive Live episode Risk Assessment on the Shoulders of Scientists , Corey walked us through what the research says about expert estimates and how we can use that knowledge to improve cybersecurity decision-making. We’ll keep searching and keep you informed! Category Risk Modeling, Quantitative Risk Risk Level.

Risk 52

Risk Cybersecurity Ransomware Accountability 52

CyberSecurity Insiders

AUGUST 13, 2022

We generate data each time we search online or send an email, and organizations and businesses generate mass data of their own. There’s no doubt that handling huge amounts of data can be unwieldy and somewhat daunting, however, there are systems that can help, for example, it’s worth looking into apache hive vs spark for more information.

Marketing 114

Marketing eCommerce Risk Financial Services 114

Fox IT

NOVEMBER 8, 2021

The task is normally used to regularly backup the registry hives. On several occasions the threat actor tried to maintain its foothold by hijacking a scheduled tasks named RegIdleBackup and abusing the COM handler associated with it to execute malicious code, leading to FlawedGrace RAT.

Software 72

Software Ransomware Internet Internet 72

Approachable Cyber Threats

DECEMBER 6, 2023

We looked at five sources of data - The New York Times , The Guardian , Google Trends , Google Search , and scite.ai - to compare how frequently their cybersecurity breach and incident coverage fell into each one of the DBIR’s classification patterns. ? This time around we used Google’s search feature to search the non-Google sources.

Cybersecurity 106

Cybersecurity Social Engineering Data breaches Engineering 106

Security Boulevard

SEPTEMBER 21, 2022

Given the following hashing algorithm, the second-stage searches for the process ID (pid) of the process for which the hash of its name corresponds to 0xDCF164CD (explorer.exe) or 0x561F1820 (svchost.exe). First, the code tries to retrieve the configuration that the first stage stored in the registry hive. diskshadow.exe /s./pghdn.txt.

Ransomware 52

Ransomware Encryption Malware 52

Approachable Cyber Threats

DECEMBER 13, 2022

We looked at five sources of data -- New York Times, The Guardian, Google Trends, Google Search, scite.ai -- to compare how frequently their cybersecurity breach coverage fell into each one of the DBIR’s classification patterns. We searched for those terms across Google Trends , Google Search , New York Times , The Guardian , and Scite.ai

Data breaches 106

Data breaches Social Engineering Engineering Phishing 106

Approachable Cyber Threats

DECEMBER 7, 2023

We looked at five sources of data - The New York Times , The Guardian , Google Trends , Google Search , and scite.ai - to compare how frequently their cybersecurity breach and incident coverage fell into each one of the DBIR’s classification patterns. ? This time around we used Google’s search feature to search the non-Google sources.

Cybersecurity 52

Cybersecurity Social Engineering Data breaches Engineering 52

Approachable Cyber Threats

SEPTEMBER 14, 2021

We looked at five sources of data -- New York Times, The Guardian, Google Trends, Google Search, and scite.ai -- to compare how frequently their cybersecurity incident and breach coverage from 2020 fell into each one of DBIR’s classification patterns. New York Times and The Guardian coverage mostly agreed with what people were searching for.

Data breaches 98

Data breaches Social Engineering Engineering Phishing 98

Approachable Cyber Threats

DECEMBER 13, 2022

We looked at five sources of data -- New York Times, The Guardian, Google Trends, Google Search, scite.ai -- to compare how frequently their cybersecurity breach coverage fell into each one of the DBIR’s classification patterns. We searched for those terms across Google Trends , Google Search , New York Times , The Guardian , and Scite.ai

Data breaches 52

Data breaches Social Engineering Engineering Phishing 52

SecureList

OCTOBER 19, 2021

The table below contains the list of modules, and simplifies module description searches. The new Trickbot module ADLL dumps Active Directory database files (ntds.dit and ntds.jfm) and registry hives using the ntdsutil and reg tools. These commands will dump the Active Directory database as well as the SAM, SECURITY, and SYSTEM hives.

Banking 136

Banking Passwords VPN Internet 136

Approachable Cyber Threats

APRIL 18, 2023

The 2023 update to the Hive Systems Password Table that’s been shared across the internet, the news, universities, and by thousands of organizations worldwide. Download now Looking at Passwords in 2023 Since 2020, we’ve conducted a lot of research to develop and present the Hive Systems Password Table. Keep reading below! Not a reader?

Passwords 52

Passwords Software Manufacturing Data breaches 52

NopSec

MARCH 6, 2020

When a client authenticates to an SMB resource, the domain specified in the request instructs if the credentials are to be compared against a local SAM hive or passed to a domain controller for verification and validation. For our purposes, SMBMap only leverages NTLM authentication.

Authentication 52

Authentication Penetration Testing Passwords Accountability 52

McAfee

SEPTEMBER 22, 2021

Below is one instance of the malware using CredEnumerateW API to retrieve credentials and then search for terminal services passwords which It would use to pivot to other systems. Malware also tends to use multiple variants of credential enumeration APIs available within Windows. Figure 8 – Extracting credentials using Windows API.

Authentication 104

Authentication Accountability Encryption Passwords 104

Fox IT

JANUARY 12, 2021

Besides using the Cobalt Strike beacon, the adversary also searches for VPN and firewall configs, possibly to function as a backup access into the network. They also create a copy of the NTDS.dit and SYSTEM-registry hive file for new credentials to crack. Discovery (TA0007). The adversary applied a wide range of discovery tactics.

VPN 68

VPN Accountability Passwords DNS 68

SecureList

DECEMBER 7, 2021

And Stop, the most prevalent ransomware family with an “old-school” distribution scheme (victims searching for counterfeit software and finding executable files that contain ransomware), rather than human-operated attacks most often used by more modern groups.

Ransomware 122

Ransomware B2B B2C Government 122

Security Affairs

FEBRUARY 25, 2024

I wonder why the alpha, revil, hive blogs were not designed so nicely? All of this information has no value because it is all passed to the FBI and without hacking the panel, after every transaction by insurance agents or negotiators. FBI doesn't appreciate your talents, but I do and am willing to pay generously. Strange isn't it?

Government 123

Government Hacking Cryptocurrency Penetration Testing 123