Security Affairs
An APT group tracked as Dragon Breath has been observed employing a new DLL sideloading technique. Sophos researchers observed an APT group, tracked as Dragon Breath (aka APT-Q-27 and Golden Eye), that is using a new DLL sideloading technique that adds complexity and layers to the execution of the classic DLL sideloading. The attack consists of a clean […]
Cyber Security News
Researchers at Sophos detected the "Dragon Breath" APT group using complex DLL sideloading variations to avoid detection.
DarkReading
In the latest iteration, Qakbot operators are using DLL sideloading to deliver malware, a technique that places legitimate and malicious files together in a common directory to avoid detection.
Bleeping Computer
An APT hacking group known as "Dragon Breath," "Golden Eye Dog," or "APT-Q-27" is demonstrating a new trend of using several complex variations of the classic DLL sideloading technique to evade detection.
DarkReading
The tech giant says that being more open to comply with EU regulations brings risks such as malware, fraud, and scams.
Bleeping Computer
The operators of the QBot malware have been using the Windows Calculator to side-load the malicious payload on infected computers.
The Hacker News
Google starts blocking sideloaded apps in Singapore: This pilot program targets apps that abuse permissions to steal one-time passwords and sensitive
Security Affairs
Qakbot malware operators are using the Windows Calculator to side-load the malicious payload on target systems. Security expert ProxyLife and Cyble researchers recently uncovered a Qakbot campaign that was leveraging the Windows 7 Calculator app for DLL side-loading attacks. Dynamic-link library (DLL) side-loading is an attack method that takes advantage of how Microsoft Windows applications handle DLL […]
Infosecurity News
Symantec highlights distinctive DLL sideloading technique
Infosecurity News
The malicious software employs DLL sideloading techniques to run its malicious components
Infosecurity News
Zscaler also confirmed MadMxShell uses DLL sideloading and DNS tunneling for C2 communication
Cyber Security News
Grayling hints at using public infrastructure for initial access, deploying web shells, and then DLL sideloading to load the following elements.
DarkReading
Cyber spies are using legitimate apps for DLL sideloading, deploying an updated range of malware, including the new "Logdatter" info-stealer.
Bleeping Computer
Hackers are abusing the Windows Problem Reporting (WerFault.exe) error reporting tool for Windows to load malware into a compromised system's memory using a DLL sideloading technique.
Bleeping Computer
Google has launched a new pilot program to fight financial fraud by blocking the sideloading of Android APK files that request access to risky permissions.
SecurityWeek
Researchers at cybersecurity firm SentinelOne have observed a Chinese hacking group taking a trial-and-error approach to abusing antivirus applications for the sideloading of malicious DLLs.
Computerworld
Every day, Apple’s online and physical stores handle thousands of inquiries that relate to issues with third-party products. Sideloading will make it worse.
Latest Hacking News
Pledging the utmost security and privacy for its users, Samsung has now developed a dedicated device protection feature. Dubbed “Auto Blocker,” this new feature protects Samsung Galaxy devices from malicious actions, such as sneaky sideloading,
Security Affairs
A new variant of the information-stealing malware ViperSoftX implements sophisticated techniques to avoid detection. Trend Micro researchers observed a new ViperSoftX malware campaign that unlike previous attacks relies on DLL sideloading for its arrival and execution technique. The variant employed in the campaign supports a more sophisticated encryption method of byte remapping and a monthly […]
Infosecurity News
ReversingLabs uncovered two suspicious packages on PyPI: NP6HelperHttptest and NP6HelperHttper
SecurityWeek
Google Play Protect will block the installation of sideloaded applications requesting permissions frequently abused by fraudsters.
HACKRead
Watch out for the new CHAVECLOAK banking Trojan as it spreads its infection through SMS phishing, phishing emails, and hacked websites.
Bleeping Computer
The North Korean 'Lazarus' hacking group is linked to a new attack spreading fake cryptocurrency apps under the made-up brand, "BloxHolder," to install the AppleJeus malware for initial access to networks and steal crypto assets.
DarkReading
A sophisticated threat actor managed to fly under the radar for three years, despite flexing serious muscle.
CSO
The threat actor uses the malware to target critical government infrastructure employees, manufacturing companies, and others.
DarkReading
A sophisticated APT known as "ToddyCat," sponsored by Beijing, is cleverly using unsophisticated malware to keep defenders off their trail.
Security Affairs
A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute backdoors and cryptocurrency miners.
Infosecurity News
Symantec explained that the attack leveraged a new variant of Budworm’s SysUpdate backdoor
SecurityWeek
A previously unknown APT group is targeting organizations in biomedical, IT, and manufacturing sectors in Taiwan.
Security Affairs
Experts warn of an ongoing campaign attributed to China-linked Bronze Starlight that is targeting the Southeast Asian gambling sector. SentinelOne observed China-linked APT group Bronze Starlight (aka APT10, Emperor Dragonfly or Storm-0401) targeting the gambling sector within Southeast Asia. The malware and infrastructure employed in the campaign are linked to the ones observed in Operation ChattyGoblin attributed by the […]
Trend Micro
Trend Micro’s Managed Extended Detection and Response (MxDR) team discovered that a file called x32dbg.exe was used to sideload a malicious DLL we identified as a variant of PlugX.
Bleeping Computer
Microsoft has released the first preview version of the Windows Subsystem for Android for Windows 11 Insiders, and one of the more interesting features is that you can sideload Android apps.
Infosecurity News
Cobalt Strike beacon loader migrates across criminal ecosystems
CSO
The Ghostpulse loader, injected through MSIX packages, is a stealthy dropper that avoids detection by the victim’s scanners.
Latest Hacking News
Researchers have found a new variant of the MidgeDropper malware typically targeting Windows systems. In fact, the malware specifically aims at work-from-home users with Windows PCs, potentially indicating the attackers’ intentions to exploit the likely
SecurityWeek
Spyware vendor Varonis is shutting down, Crowdstrike tracks 232 threat actors, Meta and Freenom reach settlement.
Computerworld
Apple has told its European customers that new EU competition laws will make iPhones less safe.
HACKRead
Cybersecurity researchers at Zscaler ThreatLabz believe that the primary target of the MadMxShell backdoor seems to be IT professionals.
The Cyber Express
As the New Year festivities unfold, cyber threats take on a deceptive facade, with malicious actors exploiting the celebratory spirit
Security Affairs
The North Korea-linked Lazarus APT spreads fake cryptocurrency apps under the fake brand BloxHolder to install the AppleJeus malware. Volexity researchers warn of a new malware campaign conducted by the North Korea-linked Lazarus APT against cryptocurrency users. The threat actors were observed spreading fake cryptocurrency apps under the fake brand BloxHolder to deliver the AppleJeus […]
Bleeping Computer
A phishing campaign that security researchers named SmugX and attributed to a Chinese threat actor has been targeting embassies and foreign affairs ministries in the UK, France, Sweden, Ukraine, Czech, Hungary, and Slovakia, since December 2022.
Trend Micro
We break down a new cyberespionage campaign deployed by a cybercriminal group we named Earth Estries. Analyzing the tactics, techniques, and procedures (TTPs) employed, we observed overlaps with the advanced persistent threat (APT) group FamousSparrow as Earth Estries targets governments and organizations in the technology sector.
Computerworld
Apple has told its European customers that new EU competition laws will make iPhones less safe.
Trend Micro
We analyzed cases of a Log4Shell vulnerability being exploited in certain versions of the software VMware Horizon. Many of these attacks resulted in data being exfiltrated from the infected systems. However, we also found that some of the victims were infected with ransomware days after the data exfiltration.
Security Affairs
A new round of the weekly Security Affairs newsletter arrived! Every week the best security articles from Security Affairs for free in your email box. If you want to also receive for free the newsletter with the international press subscribe here. Reading the “ENISA THREAT LANDSCAPE FOR RANSOMWARE ATTACKS” report CISA orders to patch an actively exploited […]
The Cyber Express
Cyble Research and Intelligence Labs (CRIL) has identified an ongoing campaign targeting individuals seeking asylum in the United States through
Ars Technica
Currently, all iOS and iPadOS browsers need to use the same engine as Safari.
CyberSecurity Dive
Check Point researchers say the “Rorschach” ransomware – found during an attack on a U.S. company – may be the fastest ever seen.
SecurityWeek
The RatMilad spyware has been used indiscriminately in a broad campaign rather than to target specific individuals.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. We are in the final! Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERSVote for me in the sections […]
The Hacker News
Hackers are using sneaky compression methods in Android APK files to evade malware detection
Infosecurity News
The original RatMilad spyware hid behind a VPN and phone number spoofing app called Text Me
Infosecurity News
The mobile malware has been used by threat actors to target minority groups
Latest Hacking News
SpyAgent exploits RATs like Teamviewer to deploy other malware and RATs to steal data and gain control on target device.
SecurityWeek
Two Chinese cyberespionage groups have been targeting entities and member countries affiliated with ASEAN.
Infosecurity News
Kaspersky links campaign to Gopuram backdoor
Computerworld
The problem with Apple’s passionate stance on privacy and user security is that those attacking its position aren’t interested in the same thing.
CSO
Latest campaigns by Mustang Panda highlight the threat actor's versatility in terms of the tools and techniques it is able to use.
The Hacker News
A new Android malware dubbed "RatMilad" has been observed targeting Middle Eastern enterprise mobile devices by posing as VPNs and spoofing apps.
Infosecurity News
Trend Micro noted that “Earth Estries” employed advanced tactics to infiltrate networks
The Hacker News
Researchers have discovered a new Android banking trojan targeting customers of the Spanish financial services company BBVA.
CyberSecurity Dive
Researchers warn a state-linked actor has launched malicious activity against a voice application widely used by major corporate customers.
The Hacker News
Malicious packages lurking in open-source repositories. Discover how DLL side-loading is the latest technique used to evade security software.
Trend Micro
We break down the cyberespionage activities of advanced persistent threat (APT) group Earth Preta, observed in large-scale attack deployments that began in March. We also show the infection routines of the malware families they use to infect multiple sectors worldwide: TONEINS, TONESHELL, and PUBLOAD.
Infosecurity News
Trend Micro analyzed two separate Earth Longzhi campaigns between 2020 and 2022
Cyber Security News
A sophisticated malware campaign has been compromising the update mechanism of eScan antivirus software to distribute malicious backdoors and cryptocurrency mining software.
SecurityWeek
A new Android trojan named Brokewell can steal user’s sensitive information and allows attackers to take over devices.
DarkReading
China pairs cyber and kinetic attacks in the South Pacific as it continues to wrangle control of the South China Sea.
Infosecurity News
Symantec's Threat Hunter Team said these campaigns have been ongoing for several years
Bleeping Computer
A Chinese cyber-espionage hacking group tracked as Budworm has been observed targeting a telecommunication firm in the Middle East and a government entity in Asia using a new variant of its custom 'SysUpdate' backdoor.
Bleeping Computer
With Windows 11, Microsoft is planning to integrate Amazon Appstore into Windows 11's Microsoft Store. Here's everything we know so far.
Security Affairs
China-linked APT group Mustang Panda targeted various Asian countries with a variant of the PlugX (aka Korplug) backdoor dubbed DOPLUGS.
Infosecurity News
The malware targets browsers, steals crypto wallet and messaging app data, and collects system information
Trend Micro
We analyzed the infection routine used in recent Gootkit loader attacks on the Australian healthcare industry and found that Gootkit leveraged SEO poisoning for its initial access and abused legitimate tools like VLC Media Player.
Bleeping Computer
An ongoing malware campaign targets YouTube and Facebook users, infecting their computers with a new information stealer that will hijack their social media accounts and use their devices to mine for cryptocurrency.
The Hacker News
Dragon Breath APT group using double-clean-app technique to sideload malicious DLLs and target the online gaming and gambling industries.
Cyber Security News
Organizations, regardless of their size, employ Windows IIS web servers to host various web content, including websites, applications, and services like Outlook on the Web from Microsoft Exchange.
The Hacker News
Lucky Mouse has developed SysUpdate, a malware toolkit with a Linux version, and updated the artifact since July 2022.
Latest Hacking News
The popular communication software business 3CX has admitted a supply-chain attack, potentially affecting its customers too. As the attackers trojanized the legit app version, deleting the 3CX Desktop App remains the only working fix for
The Hacker News
Attackers are exploiting WebAPK technology to trick you into downloading fake banking apps.
Cyber Security News
Cybersecurity analysts at Kaspersky Labs recently discovered Coyote malware that leverages the NodeJS to attack users of more than 60 banks.
SecurityWeek
The sophisticated APT group ‘Dark Pink’ has successfully carried out cyberattacks against government and military organizations in Asia and Europe.
Security Affairs
A China-linked APT group, tracked as Moshen Dragon, is exploiting antivirus products to target the telecom sector in Asia. A China-linked APT group, tracked as Moshen Dragon, has been observed targeting the telecommunication sector in Central Asia with ShadowPad and PlugX malware, SentinelOne warns. Both PlugX and ShadowPad malware are very common among China-linked cyberespionage […]
DarkReading
Plug X and other information-stealing remote-access Trojans are among the malware targeting networking, manufacturing, and logistics companies in Taiwan.
HACKRead
The SpyNote Android spyware returns, exploiting Accessibility APIs to target crypto wallets and users, ultimately stealing their cryptocurrency.
Bleeping Computer
A threat group tracked as 'Worok' hides malware within PNG images to infect victims' machines with information-stealing malware without raising alarms.
Ars Technica
Some changes will arrive for non-EU users, too, but not the easy removals.
Bleeping Computer
A new password-stealing malware named Ov3r_Stealer is spreading through fake job advertisements on Facebook, aiming to steal account credentials and cryptocurrency.
The Hacker News
Mustang Panda escalates cyber espionage in Asia with advanced DOPLUGS malware. Discover how this China-linked group targets nations with sophisticated
Trend Micro
We present a case study of the cyberespionage efforts by Earth Preta. This study on an active campaign delves into the structure, goals, and requirements of the organizations involved, and provides an opportunity to conduct wider intelligence analysis and insights in the development of effective countermeasures.
Security Affairs
Threat actors are targeting organizations in the Australian healthcare sector with the Gootkit malware loader. Trend Micro researchers warn that Gootkit Loader is actively targeting the Australian healthcare industry. The experts analyzed a series of attacks and discovered that Gootkit leveraged SEO poisoning for its initial access and abused legitimate tools like VLC Media Player. […]
DarkReading
The ransomware group is using Qakbot to make the initial point of entry before moving laterally within an organization’s network.
The Hacker News
Heads up, Latin America! A powerful botnet named Horabot is targeting Outlook users with phishing emails, compromising their accounts.
Cyber Security News
Black hat SEO methods are used by hackers to manipulate search engine rankings and make malicious or fraudulent websites more visible.
Bleeping Computer
Microsoft says an Iranian-backed threat group has targeted thousands of organizations in the U.S. and worldwide in password spray attacks since February 2023.
SC Magazine
Security pros say using Windows backdoor in a malvertising campaign could expose companies to other malware attacks.
DarkReading
The notorious Chinese APT is spreading cyber maliciousness around Southeast Asia, and its next targets are already in sight.
Cyber Security News
The ever-changing landscape of mobile security is a constant battle between security researchers and malicious actors.
HACKRead
The vulnerability was patched on November 14, 2023, but the Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) list due to evidence of in-the-wild exploitation.
Cyber Security News
RedEyes APT has recently been identified by the researchers at AhnLab Security using a new info-stealer that is dubbed "FadeStealer."
Loading more articles....