Cyber Security Informer

Russia-linked APT TAG-70 targets European government and military mail servers exploiting Roundcube XSS

Security Affairs

FEBRUARY 19, 2024

An APT group, tracked as TAG-70, linked to Belarus and Russia exploited XSS flaws in Roundcube webmail servers to target over 80 organizations. Researchers from Recorded Future’s Insikt Group identified a cyberespionage campaign carried out by an APT group, tracked as TAG-70, linked to Belarus and Russia.

Government

Government Social Engineering Engineering Hacking

Google TAG warns of Russia-linked APT groups targeting Ukraine

Security Affairs

APRIL 20, 2023

The researchers from Google TAG are warning of Russia-linked threat actors targeting Ukraine with phishing campaigns. Russia-linked threat actors launched large-volume phishing campaigns against hundreds of users in Ukraine to gather intelligence and aimed at spreading disinformation, states Google’s Threat Analysis Group (TAG).

Phishing

Phishing Education Accountability Telecommunications

Google TAG: Russia, Belarus-linked APTs targeted Ukraine

Security Affairs

MARCH 8, 2022

Google TAG observed Russian, Belarusian, and Chinese threat actors targeting Ukraine and European government and military orgs. The attacks have been attributed to the Russia-linked FancyBear group (aka APT28) and the Belarus-linked Ghostwriter (aka UNC1151) APT group. ” wrote Shane Huntley, Google’s TAG lead.

DDOS

DDOS Phishing Government Hacking

Multiple APT groups exploited WinRAR flaw CVE-2023-38831

Security Affairs

OCTOBER 18, 2023

Google TAG reported that both Russia and China-linked threat actors are weaponizing the a high-severity vulnerability in WinRAR. Google’s Threat Analysis Group (TAG) reported that in recent weeks multiple nation-state actors were spotted exploiting the vulnerability CVE-2023-38831 in WinRAR. ” reported Google TAG.

Cybercrime

Cybercrime Malware Software Hacking

China-linked APT Curious Gorge targeted Russian govt agencies

Security Affairs

MAY 3, 2022

China-linked Curious Gorge APT is targeting Russian government agencies, Google Threat Analysis Group (TAG) warns. Google Threat Analysis Group (TAG) reported that an APT group linked to China’s People’s Liberation Army Strategic Support Force (PLA SSF), tracked as Curious Gorge , is targeting Russian government agencies.

Manufacturing

Manufacturing Government Phishing Passwords

Zimbra zero-day exploited to steal government emails by four groups

Security Affairs

NOVEMBER 16, 2023

Google TAG revealed that threat actors exploited a Zimbra Collaboration Suite zero-day ( CVE-2023-37580 ) to steal emails from governments. Google TAG researcher Clément Lecigne discovered the zero-day in June while investigating targeted attacks against Zimbra’s email server. ” reads the advisory published by Google TAG.

Government

Government Authentication Phishing Hacking

Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware

The Hacker News

JANUARY 18, 2024

The Russia-linked threat actor known as COLDRIVER has been observed evolving its tradecraft to go beyond credential harvesting to deliver its first-ever custom malware written in the Rust programming language.

Malware

Malware Phishing

Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics

The Hacker News

DECEMBER 7, 2023

The threat actor known as COLDRIVER has continued to engage in credential theft activities against entities that are of strategic interests to Russia while simultaneously improving its detection evasion capabilities. It's also called Blue Callisto, BlueCharlie (or TAG-53),

Google: Russian Hackers Target Ukrainians, European Allies via Phishing Attacks

The Hacker News

MARCH 8, 2022

A broad range of threat actors, including Fancy Bear, Ghostwriter, and Mustang Panda, have launched phishing campaigns against Ukraine, Poland, and other European entities amid Russia's invasion of Ukraine.

Phishing

Google Reveals Alarming Surge in Russian Cyber Attacks Against Ukraine

The Hacker News

FEBRUARY 20, 2023

Russia's cyber attacks against Ukraine surged by 250% in 2022 when compared to two years ago, Google's Threat Analysis Group (TAG) and Mandiant disclosed in a new joint report.

Cyber Attacks

Cyber Attacks Government

Google TAG Warns of Russian Hackers Conducting Phishing Attacks in Ukraine

The Hacker News

APRIL 19, 2023

Elite hackers associated with Russia's military intelligence service have been linked to large-volume phishing campaigns aimed at hundreds of users in Ukraine to extract intelligence and influence public discourse related to the war.

Phishing

Google Confirms Increase In Russian Cyber Attacks Against Ukraine

Heimadal Security

FEBRUARY 21, 2023

According to a new report released by Google’s Threat Analysis Group (TAG) and Mandiant, Russia’s cyber attacks against Ukraine increased by 250% in 2022.

Cyber Attacks

Cyber Attacks Media Government Cybersecurity

Russian Hackers Spotted Targeting U.S. Military Weapons and Hardware Supplier

The Hacker News

DECEMBER 7, 2022

A state-sponsored hacking group with links to Russia has been linked to attack infrastructure that spoofs the Microsoft login page of Global Ordnance, a legitimate U.S.-based based military weapons and hardware supplier.

Hacking

Hacking Cybersecurity

Google: Russian phishing attacks target NATO, European military

Bleeping Computer

MARCH 30, 2022

The Google Threat Analysis Group (TAG) says more and more threat actors are now using Russia's war in Ukraine to target Eastern European and NATO countries, including Ukraine, in phishing and malware attacks. [.].

Phishing

Phishing Malware

Google TAG details cyber activity with regard to the invasion of Ukraine

Security Affairs

MARCH 31, 2022

The Google TAG uses uncovered phishing attacks targeting Eastern European and NATO countries, including Ukraine. The researchers uncovered a phishing campaign conducted by a Russia-linked threat actor tracked as COLDRIVER (aka Calisto ) against a NATO Centre of Excellence and Eastern European militaries. ” concludes Google. .”

Phishing

Phishing Accountability Government Hacking

Mar 27 – Apr 02 Ukraine – Russia the silent cyber conflict

Security Affairs

APRIL 3, 2022

Anonymous continues its operations against Russia, the group announced the hack of the Russian investment firm Marathon Group. Mar 31 – Google TAG details cyber activity with regard to the invasion of Ukraine. The Google TAG uses uncovered phishing attacks targeting Eastern European and NATO countries, including Ukraine.

DDOS

DDOS Hacking Mobile Internet

NATO Countries Targeted in Russian Phishing Attacks, Google Reports

Heimadal Security

MARCH 31, 2022

According to the Google Threat Analysis Group (TAG), a great number of threat actors are currently exploiting the event of the Russian invasion in Ukraine to launch phishing and malware cyberattacks against Eastern European and NATO countries. The cyberattacks also target Ukraine.

Phishing

Phishing Government Malware Cybersecurity

Cybercriminals launched “Leaksmas” event in the Dark Web exposing massive volumes of leaked PII and compromised data

Security Affairs

DECEMBER 28, 2023

Numerous leaks disseminated in the underground cyber world were tagged with ‘Free Leaksmas,’ indicating that these significant leaks were shared freely among various cybercriminals as a form of mutual gratitude. Instead, they marked the holiday season in their unique way.

Identity Theft

Identity Theft Data breaches Government Hacking

Google alerts over 50k users about State funded Cyber Attacks

CyberSecurity Insiders

OCTOBER 18, 2021

Ajax Bash, the Security Engineer of Google Threat Analysis Group (TAG) endorsed the statement and attributed a large global campaign to a group of threat actors belonging to Kremlin based Fancy Bear (APT28).

Cyber Attacks

Cyber Attacks Cyber threats Accountability Engineering

Google Blocks Dozens of Malicious Domains Operated by Hack-for-Hire Groups

The Hacker News

JUNE 30, 2022

Google's Threat Analysis Group (TAG) on Thursday disclosed it had acted to block as many as 36 malicious domains operated by hack-for-hire groups from India, Russia, and the U.A.E.

Hacking

Google blocked China-linked APT31’s attacks targeting U.S. Government

Security Affairs

MARCH 9, 2022

The campaign took place in February and Google Threat Analysis Group (TAG) team was not able to link it to the ongoing invasion of Ukraine. Google Threat Analysis Group (TAG) director Shane Huntley confirmed that the IT giant was able to detect and block all phishing messages. government. Pierluigi Paganini.

Government

Government Phishing DDOS Hacking

Google Threat Analysis Group took down ten influence operations in Q2 2020

Security Affairs

AUGUST 7, 2020

Google published its second Threat Analysis Group (TAG) report which reveals the company has taken down ten coordinated operations in Q2 2020. Google has published its second Threat Analysis Group (TAG) report , a bulletin that includes coordinated influence operation campaigns tracked in Q2 of 2020. response to COVID-19.

Accountability

Accountability Advertising Media Government

Mar 06- Mar 12 Ukraine – Russia the silent cyber conflict

Security Affairs

MARCH 13, 2022

This post provides a timeline of the events related to the Russia invasion of Ukraine from the cyber security perspective. Russian Internet watchdog Roskomnadzor is going to ban Instagram in Russia to prevent the spreading of info related to the Ukraine invasion. March 8 – Google TAG: Russia, Belarus-linked APTs targeted Ukraine.

Hacking

Hacking DDOS Phishing Malware

Russia’s SVR WellMess Malware Is Seemingly Still in the Game

Heimadal Security

AUGUST 2, 2021

In July 2020, a joint advisory was published that revealed a Russian espionage campaign named APT29 or Cozy Bear, seen also as an extension of SVR (Russia’s Foreign Intelligence Services). The post Russia’s SVR WellMess Malware Is Seemingly Still in the Game appeared first on Heimdal Security Blog.

Malware

Malware Cybersecurity

Security Affairs newsletter Round 460 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

FEBRUARY 25, 2024

Iran Crisis Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign U.S.

Spyware

Spyware Cyber Insurance Hacking Advertising

Reuters: Russia-linked APT behind Brexit leak website

Security Affairs

MAY 28, 2022

Russia-linked threat actors are behind a new website that published leaked emails from leading proponents of Britain’s exit from the EU, the Reuters reported. According to Reuters, at least victims of the leak confirmed the authenticity of the messages and revealed they were targeted by Russia-linked hackers. Pierluigi Paganini.

Authentication

Authentication Hacking Cybersecurity Accountability

Russia-linked Turla APT targets Austria, Estonia, and NATO platform

Security Affairs

MAY 23, 2022

Russia-linked APT group Turla was observed targeting the Austrian Economic Chamber, a NATO eLearning platform, and the Baltic Defense College. The researchers investigated the TURLA’s infrastructures starting from the domains in the TAG report: wkoinfo.webredirect[.]org Researchers from SEKOIA.IO org jadlactnato.webredirect[.]org.

Government

Government Hacking Cybersecurity Information Security

Security Affairs newsletter Round 455 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

JANUARY 21, 2024

Admin of the BreachForums hacking forum sentenced to 20 years supervised release Russia-linked Midnight Blizzard APT hacked Microsoft corporate emails VF Corp December data breach impacts 35 million customers China-linked APT UNC3886 exploits VMware zero-day since 2021 Ransomware attacks break records in 2023: the number of victims rose by 128% U.S.

Artificial Intelligence

Artificial Intelligence VPN Hacking Firewall

Winter Vivern APT exploited zero-day in Roundcube webmail software in recent attacks

Security Affairs

OCTOBER 25, 2023

Russia-linked threat actor Winter Vivern has been observed exploiting a zero-day flaw in Roundcube webmail software. The analysis of the email HTML source code revealed the presence of a SVG tag at the end, which contains a base64-encoded payload. The messages were sent from team.managment@outlook[.]com

Software

Software Government Phishing Internet

Estonia faces Russian Cyber Attack for removing Soviet World War 3 Monument

CyberSecurity Insiders

AUGUST 18, 2022

As Estonia is a NATO affiliated nation and is against the war of Russia with Ukraine, Putin backed Killnet hacking group is suspected to be behind the incident. NOTE- The war between Ukraine and Russia is soon going to end as the latter has faced extreme criticism from its populace, from the entire world and now its own military personnel.

Cyber Attacks

Cyber Attacks Digital transformation DDOS Hacking

Mar 13- Mar 19 Ukraine – Russia the silent cyber conflict

Security Affairs

MARCH 20, 2022

This post provides a timeline of the events related to the Russia invasion of Ukraine from the cyber security perspective. Google’s TAG team revealed that China-linked APT groups are targeting Ukraine ’s government for intelligence purposes. March 18 – Russia-linked Cyclops Blink botnet targeting ASUS routers.

Government

Government Antivirus Hacking Software

U.S. Govt. Apps Bundled Russian Code With Ties to Mobile Malware Developer

Krebs on Security

NOVEMBER 28, 2022

area — as the company had represented — but was instead operated from Novosibirsk, Russia. the company’s employees are located in Novosibirsk, Russia. Pushwoosh was incorporated in Novosibirsk, Russia in 2016. Pushwoosh employees posing at a company laser tag event. THE PINCER TROJAN CONNECTION.

Mobile

Mobile Malware Technology Government

Google: four zero-day flaws have been exploited in the wild

Security Affairs

JULY 14, 2021

Google security experts revealed that Russia-linked APT group targeted LinkedIn users with Safari zero-day. Security researchers from Google Threat Analysis Group (TAG) and Google Project Zero revealed that four zero-day vulnerabilities have been exploited in the wild earlier this year. ” reads the post published by Google.

Surveillance

Surveillance Government Internet Internet

Smooth Cybercriminals: Google Warns of Iran-Backed APT Hackers

SecureWorld News

OCTOBER 19, 2021

Microsoft, for instance, just released the 2021 Digital Defense Report pointing a finger at Russia as making up 58% of all nation-state cyberattack incidents observed by the corporation. With numbers like that and a focus on ransomware, it is easy to see why Russia is owning most of the headlines.

Phishing

Phishing Authentication Social Engineering Government

Security Affairs newsletter Round 428 by Pierluigi Paganini – International edition

Security Affairs

JULY 15, 2023

Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

Spyware

Spyware Hacking Data breaches Mobile

Google warned users of 33,015 nation-state attacks since January

Security Affairs

OCTOBER 17, 2020

Shane Huntley, Director at Google’s Threat Analysis Group (TAG), revealed that her team has shared its findings with the campaigns and the Federal Bureau of Investigation. ” reads the report published by Google TAG. SecurityAffairs – hacking, Google TAG). Pierluigi Paganini.

DDOS

DDOS Phishing Advertising Accountability

Google files lawsuit against blockchain botnet operators

CyberSecurity Insiders

DECEMBER 9, 2021

As per the Threat Analysis Group (TAG) of Google, the criminals are using such compromised devices to mine cryptocurrency, steal credentials from victims, and use them as proxies to hide their attacks.

Cryptocurrency

Cryptocurrency Government Internet Internet

Apple ups its mobile security by unlocking phones with masked faces

CyberSecurity Insiders

MARCH 15, 2022

update along with some new set of emojis and technically blocks illegal tracking of Air Tag users. Apple Inc has also issued a public statement that it will suspend sales and services of its iPhones in Russia, to support sanctions imposed by the White House. What’s disappointing is that the iOS 15.4

Mobile

Mobile Authentication Cybersecurity

Exclusive: Pro-Russia group ‘Cyber Spetsnaz’ is attacking government agencies

Security Affairs

JUNE 6, 2022

USA) has identified an increase in activity within hacktivist groups, they’re leveraging current geopolitical tensions between the Ukraine and Russia to perform cyber-attacks. The post Exclusive: Pro-Russia group ‘Cyber Spetsnaz’ is attacking government agencies appeared first on Security Affairs. Resecurity, Inc.

Government

Government DDOS Cyber Attacks Hacking

Russia-linked Cold River APT targeted US nuclear research laboratories

Security Affairs

JANUARY 9, 2023

Russia-linked Cold River APT targeted three nuclear research laboratories in the United States in 2022 summer, Reuters reported. Reuters reported that the Russia-linked APT group Cold River (aka Calisto) targeted three nuclear research laboratories in the United States between August and September 2022. Pierluigi Paganini.

Phishing

Phishing Hacking Cybersecurity Passwords

Google sent over 50,000 warnings of state-sponsored attacks, +33% from same period in 2020

Security Affairs

OCTOBER 14, 2021

The data were provided by Google’s Threat Analysis Group (TAG), which tracks government-backed hacking campaign, which warns of a significant increase in the number of the alert compared to the previous year. ” wrote Ajax Bash, a Google security engineer from the TAG.

Phishing

Phishing Hacking Government VPN

Anonymous Hacking Group Targets Russian Government

SecureWorld News

FEBRUARY 25, 2022

Anonymous, the decentralized international activist and hacktivist collective, announced it will be the latest organization to join the efforts in fighting back against Russia. In a 2015 cyberattack, widely attributed to Russia state hackers, 225,000 Ukrainians lost electricity.

Government

Government Hacking Cybersecurity Technology

Russia could have hacked the UK Spy agency says MoD

CyberSecurity Insiders

APRIL 26, 2022

Tory MP Mark Francois tagged the data breach as extremely concerning for the government and entire nation, as data leaks could put the lives of the on-duty spies working for the nation and their families in extreme danger. The post Russia could have hacked the UK Spy agency says MoD appeared first on Cybersecurity Insiders.

Hacking

Hacking Data breaches Government Cybersecurity

Zeppelin ransomware gang is back after a temporary pause

Security Affairs

MAY 24, 2021

Unlike other variants of the Vega ransomware, the Zeppelin ransomware doesn’t infect users in Russia or other ex-USSR countries like Ukraine, Belorussia, and Kazakhstan. The malware was available for sale at a price tag of $2,300 per core build, but they offered individual conditions to their subscribers.

Ransomware

Ransomware Encryption Malware Healthcare

Russia-linked APT TAG-70 targets European government and military mail servers exploiting Roundcube XSS

Google TAG warns of Russia-linked APT groups targeting Ukraine

Trending Sources

Google TAG: Russia, Belarus-linked APTs targeted Ukraine

Multiple APT groups exploited WinRAR flaw CVE-2023-38831

China-linked APT Curious Gorge targeted Russian govt agencies

Zimbra zero-day exploited to steal government emails by four groups

Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware

Microsoft Warns of COLDRIVER's Evolving Evading and Credential-Stealing Tactics

Google: Russian Hackers Target Ukrainians, European Allies via Phishing Attacks

Google Reveals Alarming Surge in Russian Cyber Attacks Against Ukraine

Google TAG Warns of Russian Hackers Conducting Phishing Attacks in Ukraine

Google Confirms Increase In Russian Cyber Attacks Against Ukraine

Russian Hackers Spotted Targeting U.S. Military Weapons and Hardware Supplier

Google: Russian phishing attacks target NATO, European military

Google TAG details cyber activity with regard to the invasion of Ukraine

Mar 27 – Apr 02 Ukraine – Russia the silent cyber conflict

NATO Countries Targeted in Russian Phishing Attacks, Google Reports

Cybercriminals launched “Leaksmas” event in the Dark Web exposing massive volumes of leaked PII and compromised data

Google alerts over 50k users about State funded Cyber Attacks

Google Blocks Dozens of Malicious Domains Operated by Hack-for-Hire Groups

Google blocked China-linked APT31’s attacks targeting U.S. Government

Google Threat Analysis Group took down ten influence operations in Q2 2020

Mar 06- Mar 12 Ukraine – Russia the silent cyber conflict

Russia’s SVR WellMess Malware Is Seemingly Still in the Game

Security Affairs newsletter Round 460 by Pierluigi Paganini – INTERNATIONAL EDITION

Reuters: Russia-linked APT behind Brexit leak website

Russia-linked Turla APT targets Austria, Estonia, and NATO platform

Security Affairs newsletter Round 455 by Pierluigi Paganini – INTERNATIONAL EDITION

Winter Vivern APT exploited zero-day in Roundcube webmail software in recent attacks

Estonia faces Russian Cyber Attack for removing Soviet World War 3 Monument

Mar 13- Mar 19 Ukraine – Russia the silent cyber conflict

U.S. Govt. Apps Bundled Russian Code With Ties to Mobile Malware Developer

Google: four zero-day flaws have been exploited in the wild

Smooth Cybercriminals: Google Warns of Iran-Backed APT Hackers

Security Affairs newsletter Round 428 by Pierluigi Paganini – International edition

Google warned users of 33,015 nation-state attacks since January

Google files lawsuit against blockchain botnet operators

Apple ups its mobile security by unlocking phones with masked faces

Exclusive: Pro-Russia group ‘Cyber Spetsnaz’ is attacking government agencies

Russia-linked Cold River APT targeted US nuclear research laboratories

Google sent over 50,000 warnings of state-sponsored attacks, +33% from same period in 2020

Anonymous Hacking Group Targets Russian Government

Russia could have hacked the UK Spy agency says MoD

Zeppelin ransomware gang is back after a temporary pause

Stay Connected