.png)
Cyber Security News
Staying informed is the key in this dynamic battle of cybersecurity, and due to this, the weekly news recap provides you with the newest trends, weaknesses, infringements found, and some possible defense mechanisms.
Bleeping Computer
Latrodectus malware is now being distributed in phishing campaigns using Microsoft Azure and Cloudflare lures to appear legitimate while making it harder for email security platforms to detect the emails as malicious.
Cyber Security News
In a sophisticated cyberattack that unfolded over 29 days, cybersecurity analysts have meticulously traced the steps of threat actors from the initial infection with IcedID malware to the eventual deployment of Dagon Locker ransomware. The detailed account of this cyber intrusion provides a chilling example of how quickly and stealthily cybercriminals can compromise an organization’s […]
The DFIR Report
Key Takeaways In August 2023, we observed an intrusion that started with a phishing campaign using PrometheusTDS to distribute IcedID. IcedID dropped and executed a Cobalt Strike beacon, which was … Read More
The Hacker News
A sophisticated attack campaign dubbed "FROZEN#SHADOW" is underway, using phishing emails to infect systems with the stealthy malware SSLoad.
The Hacker News
Researchers uncover a fresh wave of the Raspberry Robin campaign spreading malware through malicious Windows Script Files (WSFs) since March 2024.
SC Magazine
The HP Threat Research team says security pros should take note because Raspberry Robin has been used to deliver multiple families of malware – and as a precursor to ransomware.
Infosecurity News
The malware, discovered by Proofpoint and Team Cymru, was mainly utilized by initial access brokers
The Hacker News
'Latrodectus' strikes via phishing emails. This powerful downloader can execute commands, evade detection, and pave the way for further attacks.
DarkReading
Initial access brokers are using the new downloader malware, which emerged just after QBot's 2023 disruption.
Bleeping Computer
A relatively new malware called Latrodectus is believed to be an evolution of the IcedID loader, seen in malicious email campaigns since November 2023.
HACKRead
Latrodectus is a downloader malware used by cybercriminals to gain initial access to victim systems and deploy further malicious payloads.
SC Magazine
Proofpoint researchers say new malware aligns with trend by cybercriminals to find more creative ways to bypass defenders.
The Hacker News
Banking trojan Mispadu expands from Latin America, now targets users in Italy, Poland & Sweden. Finance, automotive, legal & commercial entities at ri
The DFIR Report
Key Takeaways We provide a range of services, one of which is our Threat Feed, specializing in monitoring Command and Control frameworks like Cobalt Strike, Metasploit, Sliver, Viper, Mythic, Havoc, … Read More
The Hacker News
TheMoon botnet, previously thought to be inactive, is back. Over 40,000 routers & IoT devices hijacked to power Faceless - a criminal proxy service.
SC Magazine
Malware first identified in 2014 re-emerges and gets delivered by the criminal proxy service Faceless, now growing at 7,000 users per week.
Security Affairs
A new variant of TheMoon malware infected thousands of outdated small office and home office (SOHO) routers and IoT devices worldwide.
Bleeping Computer
A new variant of "TheMoon" malware botnet has been spotted infecting thousands of outdated small office and home office (SOHO) routers and IoT devices in 88 countries.
Infosecurity News
The US DoJ said that the Ukrainian national has pleaded guilty to leading the Zeus and IcedID malware campaigns, which resulted in losses of tens of millions of dollars
SC Magazine
Ukrainian Vyacheslav Penchukov faces a lengthy U.S. prison sentence for his part in running the JabberZeus and IcedID malware groups.
Security Affairs
A new round of the weekly Security Affairs newsletter arrived! Every week the best security articles from Security Affairs are free for you.
The Hacker News
Ukrainian cybercriminal pleads guilty to masterminding Zeus and IcedID malware schemes, infecting thousands of computers worldwide.
Security Affairs
A Ukrainian national pleaded guilty to his role in the Zeus and IcedID operations, which caused tens of millions of dollars in losses.
DataBreaches
Connor Jones reports: A Ukrainian cybercrime kingpin who ran some of the most pervasive malware operations faces 40 years in prison after spending nearly a...
SecurityWeek
Ukrainian national Vyacheslav Igorevich Penchukov has pleaded guilty to holding key roles in the Zeus and IcedID malware operations.
Bleeping Computer
Ukrainian national Vyacheslav Igorevich Penchukov, one of the heads of the notorious JabberZeus cybercrime gang, has pleaded guilty to charges related to his leadership roles in the Zeus and IcedID malware groups.
The Hacker News
Bumblebee, QakBot, Zloader, & PikaBot are back, sneakier than ever. Don't trust those shady emails or downloads.
Security Affairs
The 2023 RedSense report covers long-term observations we have made regarding intel trends and interconnectivity.
Krebs on Security
Google continues to struggle with cybercriminals running malicious ads on its search platform to trick people into downloading booby-trapped copies of popular free software applications. The malicious ads, which appear above organic search results and often precede links to legitimate…
Cyber Security News
Security analysts at Intrinsic recently discovered ThreeAM (aka 3 AM, ThreeAMtime) ransomware which has been actively attacking small and medium companies.
Bleeping Computer
Security researchers analyzing the activity of the recently emerged 3AM ransomware operation uncovered close connections with infamous groups, such as the Conti syndicate and the Royal ransomware gang.
The Hacker News
TA866 is back with thousands of invoice-themed, booby-trapped emails targeting users with WasabiSeed and Screenshotter malware.
DarkReading
An emerging threat actor, Water Curupira, is wielding a new, sophisticated loader in a series of thread-jacking phishing campaigns that precede ransomware.
The Hacker News
Beware of Water Curupira! This threat actor is spreading PikaBot, more than a malware loader – it's a gateway to ransomware attacks.
Trend Micro
Pikabot is a loader with similarities to Qakbot that was used in spam campaigns during most of 2023. Our blog entry provides a technical analysis of this malware.
Cyber Security News
Threat actors, particularly those with financial motivations, have been observed spreading malware via the ms-appinstaller URI scheme.
HACKRead
Microsoft has disabled the App Installer feature to protect users and prevent threat actors from maliciously exploiting its products and features.
The Record
Microsoft said Thursday that it disabled a feature intended to streamline app installation after it discovered financially motivated hacking groups using it to distribute malware.
The Hacker News
A new phishing campaign is using Microsoft Word docs as bait to deliver Nim-based malware.
The Hacker News
PikaBot, a dangerous loader, is spreading via malvertising campaigns targeting users searching for legit software like AnyDesk
Bleeping Computer
WordPress hosting provider Kinsta is warning customers that Google ads have been observed promoting phishing sites to steal hosting credentials.
The Hacker News
Microsoft Warns of New CACTUS Ransomware Threat. Malvertising used to deploy DanaBot as initial access. Learn more about this evolving cyber threat.
Cyber Security News
cybersecurity researchers at Proofpoint discovered two malicious campaigns in which TA571 was found spreading the Forked IcedID variant
The Hacker News
The FBI and CISA issue advisory on AvosLocker ransomware gang. They use open-source tools, leave minimal traces.
Trend Micro
We detail an ongoing campaign abusing messaging platforms Skype and Teams to distribute the DarkGate malware to targeted organizations. We also discovered that once DarkGate is installed on the victim’s system, additional payloads were introduced to the environment.
CSO
Researchers from Group-IB believe it's likely the group is an independent affiliate working for multiple ransomware-as-a-service operations
The Hacker News
Cybercriminals are currently employing ASMCrypt, an advanced iteration of DoubleFinger, to evade detection by security tools.
Cyber Security News
A new Ransomware-as-a-service (RaaS) provider has been discovered by researchers, which notably uses multiple ransomware families and is found to have links with several ransomware attacks since July 2022.
DarkReading
Ransomware-as-a-service affiliate ShadowSyndicate is unusual for the size of its malicious infrastructure and the fact that it's distributing seven different ransomware strains.
Infosecurity News
The investigation was conducted by Group-IB, Bridewell and threat researcher Michael Koczwara
The Hacker News
Cyber experts uncover a new threat: ShadowSyndicate. Explore their connections to ransomware and the latest findings from cybersecurity experts.
Bleeping Computer
Security researchers have identified infrastructure belonging to a threat actor now tracked as ShadowSyndicate, who likely deployed seven different ransomware families in attacks over the past year.
The Hacker News
Microsoft sounds the alarm on Storm-0324's tactics, luring its prey through Teams messages to breach corporate networks.
Cyber Security News
Researchers bserved an uptick in threat actors using PDFs for email-based initial access, highlighting a growing trend in evasive tactics.
The Record
Last week's global takedown of the Qaknet botnet was momentous, but if history is a lesson there is no guarantee the malware won't resurface.
Cyber Security News
The latest attack techniques, significant weaknesses, and exploits have all been highlighted. We also provide the most latest software upgrades available to keep your devices secure.
The Hacker News
Operation Duck Hunt takes down QakBot, a powerful Windows malware! Over 700,000 computers globally compromised. $8.6 Million in crypto seized.
Cyber Security News
Threat actors adopt the highly invasive techniques of HTML smuggling to launch Nokoyawa ransomware despite being delivered through macro and ICedID malware.
The DFIR Report
We’ve previously reported on a Nokoyawa ransomware case in which the initial access was via an Excel macro and IcedID malware. This case, which also ended in Nokoyawa Ransomware, involved … Read More
The Hacker News
New findings: QakBot malware operators set up 15 new command-and-control servers, raising questions about their activities during the 'break' period.
The Hacker News
Upgraded version of Rilide malware discovered. Targets Chromium-based web browsers. New version now adopts Chrome Extension Manifest V3.
Infosecurity News
BlackBerry found that public services now rank as the second most targeted industry by threat actors
The Hacker News
Latest findings reveal that the IcedID malware is getting even more dangerous with updates to its BackConnect module for post-compromise activity.
The Hacker News
Researchers warn of Nitrogen, a malvertising campaign infecting enterprise networks via Google Search and Bing ads. Targets users seeking IT tools.
The Hacker News
New variants of TrueBot malware targeting U.S. and Canadian organizations, exploiting a critical vulnerability in Netwrix Auditor.
Bleeping Computer
Security researchers discovered a new malicious tool they named PindOS that delivers the Bumblebee and IcedID malware typically associated with ransomware attacks.
The Hacker News
New JavaScript Dropper PindOS delivers dangerous payloads like Bumblebee and IcedID, acting as loaders for ransomware and other malware.
Bleeping Computer
The Royal ransomware gang has begun testing a new encryptor called BlackSuit that shares many similarities with the operation's usual encryptor.
The DFIR Report
Threat actors have moved to other means of initial access, such as ISO files combined with LNKs or OneNote payloads, but some appearances of VBA macros in Office documents can … Read More
DarkReading
APT37 is among a growing list of threat actors that have switched to Windows shortcut files after Microsoft blocked macros last year.
The Hacker News
Microsoft has confirmed that hackers linked to Cl0p and LockBit ransomware families are actively exploiting PaperCut servers.
The DFIR Report
IcedID continues to deliver malspam emails to facilitate a compromise. This case covers the activity from a campaign in late September of 2022. Post exploitation activities detail some familiar and … Read More
The Hacker News
New IcedID Lite and Forked malware variants discovered! Threat actors pivot away from banking fraud functionality to focus on payload delivery.
Bleeping Computer
New IcedID variants have been found without the usual online banking fraud functionality and instead focus on installing further malware on compromised systems.
CSO
The new IcedID variants are likely used for ransomware delivery, and researchers expect new variants to emerge.
Infosecurity News
The new variants hint that considerable effort is going into the future of IcedID and its codebase
Security Affairs
The infamous Emotet malware is back after a short hiatus, threat actors are spreading it via Microsoft OneNote email attachments. The Emotet malware returns after a three-month hiatus and threat actors are distributing it via Microsoft OneNote email attachments to avoid detection. The Emotet banking trojan has been active at least since 2014, the botnet is operated by a threat actor tracked […]
The Hacker News
Emotet is back, now hiding in Microsoft OneNote email attachments to bypass macro-based security restrictions and compromise systems.
The Hacker News
Threat actors from Chinese and Russian cybercriminal ecosystems have been observed using a new malware designed to load Cobalt Strike.
The DFIR Report
As we move into the new year, it’s important to reflect on some of the key changes and developments we observed and reported on in 2022. This year’s year-in-review report … Read More
The Hacker News
Researchers have uncovered crucial insights into the inner workings of RIG Exploit Kit and its administrators.
Bleeping Computer
The RIG Exploit Kit is undergoing its most successful period, attempting roughly 2,000 intrusions daily and succeeding in about 30% of cases, the highest ratio in the service's long operational history.
CSO
Study and prepare for these five threats and you will be well on your way to protecting your network, assets, and employees.
CSO
Study and prepare for these five threats and you will be well on your way to protecting your network, assets, and employees.
Infosecurity News
Extortion was most common impact from cyber-attacks in 2022
The Hacker News
Russia's cyber attacks against Ukraine surged by 250% in 2022, according to a report by Google's Threat Analysis Group and Mandiant.
The Record
Google's Threat Analysis Group reports that cyberattacks on Ukraine and its supporters increased aggressively as Russia waged war.
CSO
Researchers cite an increased prevalence of HTML smuggling activity including impersonation of brands such as Adobe Acrobat, Google Drive, and the US Postal Service.
The Hacker News
Gootkit malware is now targeting healthcare and financial organizations in the US, UK and Australia by using a new method of deployment.
The Hacker News
Researchers have uncovered a malvertising campaign that distributes virtualized . NET MalVirt loaders to evade detection and infect victims' computers
.webp)
Cyber Security News
The loaders, known as MalVirt, leverage the Windows Process Explorer driver for process termination together with obfuscated virtualization for anti-analysis and evasion.
The DFIR Report
In this intrusion from August 2022, we observed a compromise that was initiated with a Word document containing a malicious VBA macro, which established persistence and communication to a command … Read More
Ars Technica
Over the past month, Google has been outgunned by malvertisers with new tricks.
Bleeping Computer
An ongoing Google ads malvertising campaign is spreading malware installers that leverage KoiVM virtualization technology to evade detection when installing the Formbook data stealer.
Cyber Security News
The group behind the Windows Gootloader malware, known as UNC2565, has effectively modified the code to make it more intrusive and difficult to detect.
The Hacker News
Gootkit malware continues to evolve and become more sophisticated, with notable changes to the toolkit, adding new components and obfuscations.
CSO
Barriers that Microsoft has placed to prevent malicious macros has forced some cybercriminals to use LNK files for malware delivery, but at the cost of easier detection.
The Hacker News
Cyber criminals are always evolving their tactics, and the Emotet malware operation is no exception
The Hacker News
New study by cybersecurity experts shows potential to identify relationships among threat actors by analyzing metadata of malicious LNK files.
Loading more articles....