Bleeping Computer
Security researchers discovered two previously unseen backdoors dubbed LunarWeb and LunarMail that were used to compromise a European government's diplomatic institutions abroad.
The Cyber Express
Researchers recently uncovered two new backdoors implanted within the infrastructure of a European Ministry of Foreign Affairs (MFA) and its
Ars Technica
Ebury backdoors SSH servers in hosting providers, giving the malware extraordinary reach.
The Hacker News
Two new backdoors, LunarWeb and LunarMail, have targeted a European ministry of foreign affairs and its diplomatic missions in the Middle East
SecurityWeek
The Ebury Linux botnet has ensnared over 400,000 Linux systems in 15 years, with roughly 100,000 still infected.
The Hacker News
Ebury malware botnet has compromised an estimated 400,000 servers since 2009. Learn how to protect your systems from this advanced threat.
The Record
Researchers with cybersecurity company ESET have labeled two new pieces of suspected Russian malware as LunarWeb and LunarMail.
Infosecurity News
The 15-year-old Ebury botnet is more active than ever, as ESET found 400,000 Linux servers compromised for cryptocurrency theft and financial gain
Bleeping Computer
A malware botnet known as 'Ebury' has infected almost 400,000 Linux servers since 2009, with roughly 100,000 still compromised as of late 2023.
.webp)
Cyber Security News
The botnet, operated by the threat group behind the Ebury malware, has been active since at least 2009 but has evolved over the past decade.
Infosecurity News
Well-funded cybercriminals are adopting more sophisticated techniques, creating a need for defenders to stay informed about the evolving threat landscape
Infosecurity News
The bill that could see TikTok banned in the US has been approved by the House of Representatives and the Senate
Cyber Security News
Hackers abuse Windows Print Spooler vulnerabilities because it runs with elevated SYSTEM privileges which allows privilege escalation.
Ars Technica
Microsoft didn't disclose the in-the-wild exploits by Kremlin-backed group until now.
Infosecurity News
A new cyber espionage campaign, called ‘eXotic Visit,’ targeted Android users in South Asia via seemingly legitimate messaging apps
Infosecurity News
Distribution vectors of the Raspberry Robin worm now include Windows Script Files (WSF) alongside other methods like USB drives
The Hacker News
Exposed secrets on GitHub and PyPI are more prevalent than you think. GitGuardian's latest report reveals shocking numbers. Dive into the details here
The Hacker News
Exposed secrets on GitHub and PyPI are more prevalent than you think. GitGuardian's latest report reveals shocking numbers. Dive into the details here
The Hacker News
Active Android spyware campaign 'eXotic Visit' targeting users in India and Pakistan.
.webp)
Cyber Security News
ESET researchers have unveiled an active espionage campaign, dubbed eXotic Visit, targets Android users by benign messaging apps.
The Hacker News
Researchers uncover a fresh wave of the Raspberry Robin campaign spreading malware through malicious Windows Script Files (WSFs) since March 2024.
Security Affairs
Linux variant of DinodasRAT backdoor used in attacks against users in China, Taiwan, Turkey, and Uzbekistan, researchers from Kaspersky warn
Bleeping Computer
Security researchers have observed Red Hat and Ubuntu systems being attacked by a Linux version of the DinodasRAT (also known as XDealer) that may have been operating since 2022.
The Hacker News
Linux users, beware. A nasty piece of malware named DinodasRAT is on the loose, targeting China, Taiwan, Turkey, and Uzbekistan.
SC Magazine
The open-source .NET package stealthily exfiltrates screenshots from BOZHON equipment.
The Hacker News
Researchers at Palo Alto Networks Unit 42 uncover a new wave of phishing attacks delivering StrelaStealer malware, impacting over 100 organizations in
The Record
Researchers at ESET say they spotted thousands of new infections with AceCryptor, which allows malware to slip into systems without being detected by anti-virus software.
Security Affairs
Trend Micro uncovered a sophisticated campaign conducted by Earth Krahang APT group that breached 70 organizations worldwide.
Trend Micro
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.
Infosecurity News
The new restriction to Google’s AI chatbot was first implemented in India, which holds elections in April, before being rolled across other nations
SecurityWeek
Chinese APT Evasive Panda compromises a software developer’s supply chain to target Tibetans with malicious downloaders.
HACKRead
A Chinese hacking group, Evasive Panda (aka BRONZE HIGHLAND and Daggerfly), has launched a cyberespionage campaign targeting Tibetans.
Infosecurity News
ESET researchers said the attackers strategically leveraged the Monlam Festival, targeting individuals associated with Tibetan Buddhism
The Hacker News
China-backed hackers, Evasive Panda, target Tibetan users in watering hole & supply chain attacks.
DarkReading
The nation-state group compromised the website of a Tibetan festival and a software application to target user systems in Asia.
The Record
Tibetans are being targeted with corrupted language translation software in a cyber espionage campaign that began last September, according to researchers at cybersecurity firm ESET.
CyberNews
Prior to the release of iOS 17.4, Apple has published a whitepaper that explains what changes the company has rolled out to comply with the new EU Digital Markets Act.
SC Magazine
Avast researchers say North Korean APT has developed a new, stealthier rootkit and appears poised to continue enhancements.
SecurityWeek
Moving to a risk-based vulnerability management approach requires a systematic approach encompassing people, processes, and technology.
The Hacker News
Lazarus Group's latest exploit showcases unprecedented sophistication in cyber warfare, leveraging a zero-day flaw in Windows Kernel.
Bleeping Computer
North Korean threat actors known as the Lazarus Group exploited a flaw in the Windows AppLocker driver (appid.sys) as a zero-day to gain kernel-level access and turn off security tools, allowing them to bypass noisy BYOVD (Bring Your Own Vulnerable Driver) techniques.
DarkReading
Operation Texonto spanned several months, using various Russian propaganda lures and spear-phishing to misinform and trick users into giving up Microsoft 365 credentials.
SecurityWeek
Leaked documents show how Chinese authorities surveil dissidents overseas, hack other nations and promote pro-Beijing narratives online
CyberNews
A Russia-aligned actor has launched PSYOP campaigns bombarding Ukrainians with propaganda themes, suggesting that they won’t have food, drugs, or heating.
Infosecurity News
ESET researchers reveal a Russian threat actor has targeted Ukrainian citizens with PYSOPs messages warning of impacts such as food and medicine shortages from the war
The Hacker News
Cybersecurity experts uncover a Russia-aligned cyber operation targeting Ukraine with disinformation.
The Record
Emails containing strange recipes and other dark content arrived in the inboxes of Ukrainians, Russian dissidents and others late last year, researchers at ESET said.
Bleeping Computer
In an advisory today Germany's federal intelligence agency (BfV) and South Korea's National Intelligence Service (NIS) warn of an ongoing cyber-espionage operation targeting the global defense sector on behalf of the North Korean government.
Security Affairs
An APT group, tracked as TAG-70, linked to Belarus and Russia exploited XSS flaws in Roundcube webmail servers to target over 80 orgs
The Hacker News
A new cyberespionage campaign has targeted over 80 organizations in Europe, exploiting vulnerabilities in Roundcube webmail servers.
Security Affairs
Cybersecurity firm ESET has addressed a high-severity elevation of privilege vulnerability in its Windows security solution.
SecurityWeek
Three vulnerabilities in CU Solutions Group CMS exposed 275 credit unions to credential theft, account takeover.
SecurityWeek
ESET has released patches for a high-severity elevation of privilege vulnerability in its Windows security products.
Security Affairs
U.S. CISA adds Roundcube Webmail Persistent Cross-Site Scripting (XSS) vulnerability to its Known Exploited Vulnerabilities catalog.
CyberNews
LastPass has alerted its customers to a fraudulent app on the Apple App Store.
Latest Hacking News
Heads up, Android users! Another wave of malicious apps has flooded the Google Play Store – this time, distributing the VajraSpy RAT to Android users. While Google removed the apps after knowing the matter, they
DarkReading
Latest iteration of the malware is aimed at targets in Mexico.
The Hacker News
Threat actor "Patchwork" uses romance scams to spread espionage apps in India and Pakistan! Learn how they infiltrated Android devices with VajraSpy.
DarkReading
The Indian state-sponsored cyberattackers lurked in Google's official app store, distributing a new RAT and spying on Pakistanis.
Infosecurity News
New data from Lloyds found that romance scam victims increased by 22% in 2023, with the average amount lost per incident £6937
Bleeping Computer
An Android remote access trojan (RAT) known as VajraSpy was found in 12 malicious applications, six of which were available on Google Play from April 1, 2021, through September 10, 2023.
The Record
Indian state-sponsored hackers have used romance scams to lure victims in Pakistan into installing malicious apps, infecting their devices with spying malware, according to new research.
The Hacker News
Brazilian law enforcement has taken down a major cybercrime ring behind the notorious Grandoreiro banking trojan
Bleeping Computer
The Federal Police of Brazil and cybersecurity researchers have disrupted the Grandoreiro banking malware operation, which has been targeting Spanish-speaking countries with financial fraud since 2017.
The Record
The Brazilian government and researchers at cybersecurity company ESET released information about the sting, which included more than a dozen warrants related to the Grandoreiro banking trojan.
DarkReading
The threat actor has gone more than half a decade before being spotted — thanks to a remarkable backdoor delivered in invisible adversary-in-the-middle attacks.
HACKRead
The NSPX30 backdoor, initially uncovered in 2005 as a simple form of malware, has evolved over time into an advanced threat.
SecurityWeek
The China-linked cyberespionage group Blackwood has been caught delivering malware to entities in China and Japan.
Bleeping Computer
A previously unknown advanced threat actor tracked as 'Blackwood' is using sophisticated malware called NSPX30 in cyberespionage attacks against companies and individuals.
Infosecurity News
ESET said Blackwood has been actively engaged in cyber-espionage since at least 2018
The Hacker News
APT10, a Chinese nation-state hacking group, has updated its LODEINFO backdoor to target Japanese organizations with fileless malware.
The Hacker News
China-linked group called Blackwood is hijacking updates for popular apps like Tencent QQ & WPS Office to inject their sophisticated "NSPX30" spyware
DarkReading
Cybercriminals who conspire to put credit-card skimmers on e-commerce sites have hit some large vendors in the region.
Infosecurity News
A haul of 26 billion records found online was compiled from historic breaches
The Hacker News
TA866 is back with thousands of invoice-themed, booby-trapped emails targeting users with WasabiSeed and Screenshotter malware.
Infosecurity News
The main British Library catalogue will be back online on Monday, January 15, as the institution continues its technical rebuild following the ransomware attack last year
DarkReading
Malicious insider threats are increasingly becoming a cause for concern among businesses in the United Arab Emirates.
HACKRead
After gaining control of the SEC’s account, hackers posted tweets claiming that the agency had approved the listing and trading of spot Bitcoin ETFs on all registered national securities exchanges.
The Hacker News
New Bandook Trojan variant targets Windows users! Disguised in phishing emails as PDFs.
HACKRead
Fortunately for Radioactive Waste Management (RWM), the first-of-its-kind hacker attack on the project was unsuccessful.
The Hacker News
A new malware loader called JinxLoader is being used by threat actors to deliver payloads such as Formbook and XLoader.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you.
CyberNews
External actors are responsible for the vast majority (83%) of breaches.
The Hacker News
Threat actors are using a new malware loader to distribute various information stealers, including Lumma Stealer, Vidar, RecordBreaker, and Rescoms.
Infosecurity News
The MOVEit hack, OpenAI service targeting and Android spyware top the threat landscape in H2 2023, according to ESET
Security Affairs
ESET fixes flaw in Secure Traffic Scanning Feature that could have been exploited to cause web browsers to trust untrustworthy sites
SecurityWeek
ESET has patched CVE-2023-5594, a high-severity vulnerability that can cause a browser to trust websites that should not be trusted.
DarkReading
Cybersecurity pioneer and soccer fan Rudolf Hruby was a prominent business figure in post-independence Slovakia.
Cyber Security News
A cluster of malicious Python projects has been identified in PyPI, the official Python PyPI package repository.
DarkReading
The prolific APT repeatedly compromised targets in healthcare, manufacturing, and government with new lightweight downloaders that blend into network traffic for evasion.
The Record
The report from researchers at ESET is the latest insight into malicious code used by a group known as OilRig or APT34.
The Hacker News
Cybersecurity researchers have uncovered 18 malicious loan apps on the Google Play Store.
Cyber Security News
There were reports of several Android loan apps that pretended to be providing loan services and easy access to funds, which were found to be malicious apps that collected personal and financial information from the victims.
DarkReading
Cyber mimics life, as Iran uses Lebanese hackers to attack its bête noire.
PCMag
ESET is warning about malicious loan apps infiltrating the Google Play Store. But so far, the apps have been targeting users outside the US.
Infosecurity News
ESET said these apps request sensitive user information, exfiltrating it to attackers’ servers
CyberNews
SpyLoan apps circumvent Google Play requirements to track their users’ data and then use it to blackmail them.
Bleeping Computer
More than a dozen malicious loan apps, which are generically named SpyLoan, have been downloaded more than 12 million times this year from Google Play but the count is much larger since they are also available on third-party stores and suspicious websites.
The Cyber Wire
Ukraine's SSSCIP gets a new chief, and Russian defense industries are targeted by foreign intelligence services. Who those services might be are unknown, but circumstantially they look a little like people from Shanghai or Pyongyang.
The Cyber Wire
Ukraine's SSSCIP gets a new chief, and Russian defense industries are targeted by foreign intelligence services. Who those services might be are unknown, but circumstantially they look a little like people from Shanghai or Pyongyang.
Loading more articles....