Security Affairs
A new Linux variant of the Clop ransomware has been observed in the wild, the good news is that its encryption algorithm is flawed. SentinelLabs researchers have observed the first Linux variant of the Clop ransomware. The researchers noticed that the encryption algorithm implemented in the ELF executable is flawed and can allow victims to […]
Security Affairs
Samba released updates to address multiple vulnerabilities that can be exploited to take control of impacted systems. Samba released updates to address multiple vulnerabilities, tracked as CVE-2022-38023, CVE-2022-37966, CVE-2022-37967, and CVE-2022-45141, that can be exploited to take control of impacted systems. On December 15, 2022, Samba announced the 4.17.4, 4.16.8 and 4.15.13 security releases to address […]
The Hacker News
Samba has released updates to fix several vulnerabilities that could potentially allow hackers to gain control of affected systems.
Cyber Security News
Zloader, also known as Terdot, DELoader, or Silent Night, is a modular trojan that reappeared after nearly two years of absence.
Trend Micro
Our blog entry provides an in-depth analysis of Earth Hundun's Waterbear and Deuterbear malware.
Bleeping Computer
The Clop ransomware gang is now also using a malware variant that explicitly targets Linux servers, but a flaw in the encryption scheme has allowed victims to quietly recover their files for free for months.
Cyber Security News
Hackers use stealers to gather sensitive information for example login credentials, financial data or personal details from victims’ devices.
Trend Micro
In March 2021, we investigated a backdoor with a unique modular architecture and called it BumbleBee due to a string embedded in the malware. However, in our recent investigations, we have discovered a controller application that expands its capabilities.
DarkReading
A targeted attack aiming to exploit geopolitical relations between India and Europe delivers previously undocumented, uniquely evasive backdoor malware.
Trend Micro
We recently found a new advanced persistent threat (APT) group that we have dubbed Earth Berberoka (aka GamblingPuppet). This APT group targets gambling websites on Windows, macOS, and Linux platforms using old and new malware families.
DarkReading
For the moment, victims can decrypt data without paying a ransom. But Clop is a ransomware variant that has caused havoc on Windows systems, so that's bound to change.
.webp)
Cyber Security News
Hackers have been found leveraging weaponized virtual hard disk (VHD) files to deploy the notorious Remote Control Software (RAT), Remcos.
SecurityWeek
Microsoft has released an out-of-band update after learning that the security patch for CVE-2022-37966 started causing Kerberos authentication issues.
Bleeping Computer
A new, stealthier variant of the Linux malware 'BPFDoor' has been discovered, featuring more robust encryption and reverse shell communications.
DarkReading
The Evil Corp-linked malware family has undergone an evolution, becoming more obfuscated and "several times more complex," as the group behind it tests how far the worm can be spread.
Naked Security
“Three may keep a secret, if two of them are dead.”
DarkReading
Long-awaited security fixes for ProxyNotShell and Mark of the Web bypasses are part of a glut of actively exploited zero-day vulnerabilities and other critical flaws that admins need to prioritize in the coming hours.
The Hacker News
A new "B1txor20" Linux botnet has been discovered that spreads via the Log4J vulnerability and uses DNS tunnels for covert C2 communications.
Security Affairs
Researchers spotted a new information stealer, called Stealc, which supports a wide set of stealing capabilities. In January 2023, researchers at SEKOIA.IO discovered a new information stealer, dubbed Stealc, which was advertised in the dark web forums. The malware was developed by a threat actor that uses the moniker Plymouth who claims the info-stealer supports a […]
The Hacker News
A Pakistani threat group called SideCopy is suspected of being behind the spear-phishing campaign targeting Indian government entities.
The Hacker News
A new malicious campaign has been spotted taking advantage of Windows event logs to stash chunks of shellcode for the first time in the wild.
CSO
Ransomware gangs seem to be exploiting concerns over disruptions in the energy and other critical infrastructure sectors.
Security Affairs
Russia-linked threat actors employ the WINELOADER backdoor in recent attacks targeting German political parties.
Security Affairs
Microsoft released an out-of-band update to fix problems tied to a recent Windows security patch that caused Kerberos authentication issues. Microsoft released an out-of-band update to address issues caused by a recent Windows security patch that causes Kerberos authentication problems. Microsoft Patch Tuesday security updates for November 2022 addressed a privilege escalation vulnerability, tracked as CVE-2022-37966, […]
HACKRead
It is worth noting that the notorious Bifrost RAT, also known as Bifrose, was originally identified two decades ago in 2004.
Security Affairs
North Korea-linked Lazarus APT is exploiting the Log4J remote code execution (RCE) in attacks aimed at VMware Horizon servers. North Korea-linked group Lazarus is exploiting the Log4J RCE vulnerability (CVE-2021-44228) to compromise VMware Horizon servers. Multiple threat actors are exploiting this flaw since January, in January VMware urged customers to patch critical Log4j security vulnerabilities impacting Internet-exposed […]
Security Affairs
A new Linux variant of the remote access trojan (RAT) BIFROSE (aka Bifrost) uses a deceptive domain mimicking VMware.
Bleeping Computer
A new Linux variant of the Bifrost remote access trojan (RAT) employs several novel evasion techniques, including the use of a deceptive domain that was made to appear as part of VMware.
SecurityWeek
SpectralBlur is a new macOS backdoor that shows similarities with North Korean hacking group’s KandyKorn malware.
Cyber Security News
Recruiters Beware! Threat actors have been targeting recruiters disguised as job applicants to deliver their malware.
Infosecurity News
The intrusion, tracked as REF7001 by Elastic Security Labs, uses custom and open source capabilities
Security Affairs
Researchers uncovered a new Linux botnet, tracked as B1txor20, that exploits the Log4J vulnerability and DNS tunnel. Researchers from Qihoo 360’s Netlab have discovered a new backdoor used to infect Linux systems and include them in a botnet tracked as B1txor20. The malware was first spotted on February 9, 2022, when 360Netlab’s honeypot system captured […]
The Hacker News
Breaking down Lu0Bot's layers: From BAT files to unique domain assembly. Analysts share insights into the unconventional methods used by this Node.js
Trend Micro
This report describes how Waterbear and Deuterbear — two of the tools in Earth Hundun's arsenal — operate, based on a campaign from 2024.
The Hacker News
Raspberry Robin worm is targeting financial and insurance sectors in Europe, especially Spanish and Portuguese-speaking organizations, and has evolved
Cyber Security News
One of the most prominent North Korean hacking groups, Lazarus exploited the Log4J RCE vulnerability known as "NukeSped" to inject backdoors aboard VMware Horizon servers to retrieve information stealing payloads.
SecurityWeek
Threat hunters at Kaspersky find a malicious campaign that abuses Windows event logs to store fileless last stage Trojans and keep them hidden in the file system.
Bleeping Computer
The Chinese espionage APT (advanced persistent threat), tracked as 'Billbug' (aka Thrip, or Lotus Blossom), is currently running a 2022 campaign targeting government agencies and defense organizations in multiple Asian countries.
Cyber Security News
A completely new and previously unreported form of BPFdoor was recently discovered and examined by Deep Instinct's threat lab.
Bleeping Computer
A vulnerability in Argo CD, used by thousands of orgs for deploying applications to Kubernetes, can be leveraged in attacks to disclose sensitive information such as passwords and API keys.
The Hacker News
ZLoader malware resurfaces after 2 years, targeting Windows systems with ransomware.
Bleeping Computer
The official installer for the Comm100 Live Chat application, a widely deployed SaaS (software-as-a-service) that businesses use for customer communication and website visitors, was trojanized as part of a new supply-chain attack.
Cyber Security News
A brand-new information stealer named Mystic Stealer appeared in April 2023; nearly 40 web browsers and more than 70 browser extensions
Bleeping Computer
A new Linux malware downloader created using SHC (Shell Script Compiler) has been spotted in the wild, infecting systems with Monero cryptocurrency miners and DDoS IRC bots.
Cyber Security News
A new Linux variant of Bifrost dubbed Bifrose, was observed exhibiting a creative way to avoid detection, such as using a deceptive domain
Bleeping Computer
A nation-state threat actor known as 'Charming Kitten' (Phosphorus, TA453, APT35/42) has been observed deploying a previously unknown backdoor malware named 'Sponsor' against 34 companies around the globe.
Cyber Security News
Hackers use loaders to bypass security measures and run harmful code in a genuine process's memory themselves.
Security Affairs
Experts spotted a malware campaign that is the first one using a technique of hiding a shellcode into Windows event logs. In February 2022 researchers from Kaspersky spotted a malicious campaign using a novel technique that consists of hiding the shellcode in Windows event logs. The technique allows hiding a fileless Trojan, the experts also […]
Bleeping Computer
The North Korean hacking group known as Lazarus is exploiting the Log4J remote code execution vulnerability to inject backdoors that fetch information-stealing payloads on VMware Horizon servers.
HACKRead
Latrodectus is a downloader malware used by cybercriminals to gain initial access to victim systems and deploy further malicious payloads.
Cyber Security News
The Crambus espionage group, formally known as OilRig or APT34, has a lengthy history and a great deal of experience conducting prolonged attack.
The Hacker News
Mustang Panda escalates cyber espionage in Asia with advanced DOPLUGS malware. Discover how this China-linked group targets nations with sophisticated
Security Affairs
Researchers found a new variant of the BunnyLoader malware with a modular structure and new evasion capabilities.
Cyber Security News
Nood RAT was recently found to be utilized in malware attacks targeting Linux servers to steal sensitive information.
SC Magazine
Proofpoint researchers say new malware aligns with trend by cybercriminals to find more creative ways to bypass defenders.
Security Affairs
Exatrack researchers warn of an unknown China-linked hacking group that has been linked to a new Linux malware, dubbed Mélofée. Cybersecurity researchers from ExaTrack recently discovered a previously undetected malware family, dubbed Mélofée, targeting Linux servers. The researchers linked with high-confidence this malware to China-linked APT groups, in particular the Winnti group. The Mélofée malware includes a […]
Bleeping Computer
Researchers are warning that a notorious hacking group linked to Russia's Foreign Intelligence Service (SVR) is targeting political parties in Germany for the first time, shifting their focus away from the typical targeting of diplomatic missions.
Bleeping Computer
Security researchers found vulnerabilities in the encryption mechanism of the Zeppelin ransomware and exploited them to create a working decryptor they used since 2020 to help victim companies recover files without paying the attackers.
Bleeping Computer
A new and upgraded version of the SharkBot malware has returned to Google's Play Store, targeting banking logins of Android users through apps that have tens of thousands of installations.
Cyber Security News
Hackers actively target and exploit Windows Defender SmartScreen to deceive users and deliver malicious content by creating convincing, misleading websites or applications.
DarkReading
Spike in new versions of an old Trojan — which mimic legitimate VMware domains — alarms security researchers.
The Hacker News
U.S. shut down Warzone RAT, a tool used for data theft and remote control. Two individuals face charges.
Trend Micro
We break down the cyberespionage activities of advanced persistent threat (APT) group Earth Preta, observed in large-scale attack deployments that began in March. We also show the infection routines of the malware families they use to infect multiple sectors worldwide: TONEINS, TONESHELL, and PUBLOAD.
.webp)
Cyber Security News
The well-known advanced persistent threat (APT) group Turla, which is based in Russia, is said to be going after the European Ministry.
Bleeping Computer
Threat analysts have uncovered yet another large-scale campaign delivering the RedLine stealer malware onto worldwide targets.
Ars Technica
Microsoft said it's working on an accelerated schedule to roll out a patch.
Security Affairs
Russia-linked Turla APT allegedly used two new backdoors, named Lunar malware and LunarMail, to target a European government agencies.
Bleeping Computer
A phishing campaign that security researchers named SmugX and attributed to a Chinese threat actor has been targeting embassies and foreign affairs ministries in the UK, France, Sweden, Ukraine, Czech, Hungary, and Slovakia, since December 2022.
The Hacker News
3CX, has confirmed that multiple versions of its desktop app for Windows and macOS have been affected by a supply chain attack.
Bleeping Computer
A new and powerful malware named 'Mars Stealer' has appeared in the wild, and appears to be a redesign of the Oski malware that shut down development abruptly in the summer of 2020.
Cyber Security News
Active Directory (AD) is one of the most widely used services that allow organizations to manage users, computers, and other resources inside their internal network.
%20(1).webp)
Cyber Security News
Earth Hundun, a notable Asia-Pacific malware organization, uses Waterbear and Deuterbear, first encountered Deuterbear.
The Hacker News
Microsoft's latest round of monthly security updates has been released with fixes for 68 vulnerabilities spanning its software portfolio.
Security Affairs
China-linked APT group was spotted using HTML smuggling in attacks aimed at Foreign Affairs ministries and embassies in Europe. A China-linked APT group was observed using HTML smuggling in attacks against Foreign Affairs ministries and embassies in Europe, reports the cybersecurity firm Check Point. The researchers tracked the campaign as SmugX and reported that it […]
Bleeping Computer
Security researchers discovered two previously unseen backdoors dubbed LunarWeb and LunarMail that were used to compromise a European government's diplomatic institutions abroad.
Cyber Security News
Cybersecurity researcher, Aziz Farghly recently discovered an infostealer, "Stealc." Plymouth has promoted Stealc, a new non-resident stealer
ThreatPost
Symbiote, discovered in November, parasitically infects running processes so it can steal credentials, gain rootlkit functionality and install a backdoor for remote access.
Bleeping Computer
A new information stealer called Stealc has emerged on the dark web gaining traction due to aggressive promotion of stealing capabilities and similarities with malware of the same kind like Vidar, Raccoon, Mars, and Redline.
Trend Micro
This blog delves into the Phemedrone Stealer campaign's exploitation of CVE-2023-36025, the Windows Defender SmartScreen Bypass vulnerability, for its defense evasion and investigates the malware's payload.
SC Magazine
Cybercriminals posing as job candidates are luring recruiters to install the “more_eggs” backdoor.
DarkReading
A criminal crowd-sourcing campaign has led to swift adoption of the stealer, which can pilfer key computer data, credentials from browsers and chat apps, and cryptocurrency from multiple wallets.
CSO
A possibly new threat actor packaged and deployed backdoors as vSphere Installation Bundles, gaining remote code execution and persistence capabilities.
%20(1).webp)
Cyber Security News
The Coper malware, a descendant of the Exobot malware family, was first distributed as a fake version of Bancolombia's ‘Personas' application.
Trend Micro
In 2022, we discovered Earth Zhulong, a hacking group that has been targeting Vietnam's telecom, technology, and media sectors similar to another well-known threat actor. In this article, we unravel their new tactics, techniques and procedures that they apply on their misdeeds.
Trend Micro
In 2022, we discovered Earth Zhulong, a hacking group that has been targeting Asian firms similar to another well-known threat actor. In this article, we unravel their new tactics, techniques and procedures that they apply on their misdeeds.
Bleeping Computer
A newly discovered malware loader called Bumblebee is likely the latest development of the Conti syndicate, designed to replace the BazarLoader backdoor used to deliver ransomware payloads.
Bleeping Computer
A newly discovered malware loader called Bumblebee is likely the latest development of the Conti syndicate, designed to replace the BazarLoader backdoor used to deliver ransomware payloads.
Infosecurity News
Recorded Future details a novel campaign that abuses legitimate internet services to deploy multiple malware variants for credential theft
Trend Micro
In this blog entry, we focus on Earth Preta's campaign that employed a variant of the DOPLUGS malware to target Asian countries.
Ars Technica
Three major campaigns from 3 different Chinese groups are keeping US defenders busy.
Computerworld
The December Patch Tuesday update from Microsoft fixes 59 flaws, including two zero-day vulnerabilities in Windows that need to be addressed right away.
Trend Micro
We break down a new cyberespionage campaign deployed by a cybercriminal group we named Earth Estries. Analyzing the tactics, techniques, and procedures (TTPs) employed, we observed overlaps with the advanced persistent threat (APT) group FamousSparrow as Earth Estries targets governments and organizations in the technology sector.
Bleeping Computer
Today is Microsoft's November 2022 Patch Tuesday, and with it comes fixes for six actively exploited Windows vulnerabilities and a total of 68 flaws.
Trend Micro
Our blog entry provides a look at an attack involving the LV ransomware on a Jordan-based company from an intrusion analysis standpoint
The DFIR Report
In this intrusion, dated May 2023, we observed Truebot being used to deploy Cobalt Strike and FlawedGrace (aka GraceWire & BARBWIRE) resulting in the exfiltration of data and the deployment … Read More
Trend Micro
The APT group Water Hydra has been exploiting the zero-day Microsoft Defender SmartScreen vulnerability (CVE-2024-21412) in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day Initiative.
The DFIR Report
In this report, we observed threat actors deploy multiple Cobalt Strike DLL beacons, perform internal discovery using Windows utilities, execute lateral movement using AnyDesk and RDP, dump credentials multiple ways, exfiltrate data and deploy domain wide ransomware in as little as 42 hours from initial access.
Trend Micro
This report examines the infection chain and the pieces of malware used by malicious actors in supply-chain attacks that leveraged trojanized installers of chat-based customer engagement platforms.
Trend Micro
We found samples of the Raspberry Robin malware spreading in telecommunications and government office systems beginning September. The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools.
The DFIR Report
In this intrusion from April 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee is a malware loader that was first reported by Google Threat Analysis Group in March 2022…
Loading more articles....