Security Affairs

DECEMBER 8, 2022

Google warns that the North Korea-linked APT37 group is exploiting Internet Explorer zero-day flaw to spread malware. ” reads the post published by TAG. TAG determined that the APT group abused the zero-day vulnerability in the JScript engine of Internet Explorer. CVE-2017-0199 ). Pierluigi Paganini.

IT 99

IT Security Information Security 99

Security Affairs

DECEMBER 14, 2022

Talos researchers uncovered a phishing campaign distributing the QBot malware to Windows systems using SVG files. Talos researchers uncovered a phishing campaign distributing the QBot malware using a new technique that leverages Scalable Vector Graphics (SVG) images embedded in HTML email attachments. Pierluigi Paganini.

Archiving 98

Archiving Phishing Passwords Security 98

Security Affairs

APRIL 6, 2023

Google’s Threat Analysis Group (TAG) warns of a North Korea-linked cyberespionage group tracked as ARCHIPELAGO. TAG believes that the ARCHIPELAGO group is a subset of a threat actor tracked by Mandiant as APT43. ” reads the analysis published by Google TAG.

Phishing 93

Phishing Passwords Military Education 93

Security Affairs

DECEMBER 1, 2019

Google’s Threat Analysis Group (TAG) revealed that it has detected and blocked attacks carried out by nation-state actors on 12,000 of its users in the third quarter of this year. ” reads the report published by Google TAG.”We SecurityAffairs – Google TAG, state-sponsored hacking). Pierluigi Paganini.

Phishing 141

Phishing Authentication Passwords Risk 141

Security Affairs

FEBRUARY 25, 2024

Iran Crisis Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign U.S.

Military 107

Military Security Ransomware Insurance 107

Security Affairs

NOVEMBER 28, 2021

North Korea-linked APT group posed as Samsung recruiters is a spear-phishing campaign that targeted South Korean security companies that sell anti-malware solutions, Google TAG researchers reported. Google TAG researchers reported that the same group, tracked as Zinc ,” also targeted security researchers in past campaigns.

Security 133

Security Phishing Information Security Communications 133

Security Affairs

AUGUST 31, 2023

Algorithms based on this log source look for certain patterns to detect file system-based malware and prevent them before any irreversible damage is done. Scan files with the tag in the PRE_CLEANUP function even if they were not altered. ” continues the report. “This is where our driver comes into play.

Security 125

Security Ransomware Communications IT 125

Security Affairs

APRIL 17, 2023

Google Threat Analysis Group (TAG) team reported that the China-linked APT41 group used the open-source red teaming tool Google Command and Control ( GC2 ) in an attack against an unnamed Taiwanese media organization. ” Upon installing the malware on the target system, it queries Google Sheets to obtain attacker commands. .”The

Phishing 98

Phishing Cloud Government Education 98

Security Affairs

MARCH 9, 2022

The campaign took place in February and Google Threat Analysis Group (TAG) team was not able to link it to the ongoing invasion of Ukraine. Google Threat Analysis Group (TAG) director Shane Huntley confirmed that the IT giant was able to detect and block all phishing messages. government.

Government 97

Government Phishing Military IT 97

Security Affairs

MARCH 31, 2022

The Google TAG uses uncovered phishing attacks targeting Eastern European and NATO countries, including Ukraine. “ However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.” In one case observed by the TAG team.

Military 89

Military Phishing Government Ransomware 89

Security Affairs

MARCH 13, 2022

Threat actors are spreading password-stealing malware disguised as a security tool to target Ukraine’s IT Army. March 8 – Google TAG: Russia, Belarus-linked APTs targeted Ukraine. Google TAG observed Russian, Belarusian, and Chinese threat actors targeting Ukraine and European government and military orgs.

Blockchain 97

Blockchain Phishing Military Passwords 97

Security Affairs

OCTOBER 14, 2021

The data were provided by Google’s Threat Analysis Group (TAG), which tracks government-backed hacking campaign, which warns of a significant increase in the number of the alert compared to the previous year. ” wrote Ajax Bash, a Google security engineer from the TAG.

Phishing 95

Phishing Military Government Security 95

Security Affairs

AUGUST 19, 2022

Most Bumblebee infections started by users executing LNK files which use a system binary to load the malware. The malware is distributed through phishing messages using a malicious attachment or a link to the malicious archive containing Bumblebee. SecurityAffairs – hacking, malware). Pierluigi Paganini.

Access 115

Access Archiving Phishing Passwords 115

Security Affairs

MAY 7, 2020

This category of malware includes famous malware like Azorult , Agent Tesla , and Hawkeye. Like most of the malware of this specific family, it is generated from a builder available to cyber criminal groups that offer a subscription plan for its “product”. Figure 4: Loader module of the malware. Introduction.

Data structuring 104

Data structuring IT Marketing Security 104

Security Affairs

JANUARY 25, 2022

The investigation started in November after Google TAG published a blogpost about watering-hole attacks targeting macOS users in Hong Kong. Google TAG researchers discovered that threat actors leveraged a zero-day vulnerability in macOS in a watering hole campaign aimed at delivering malware to users in Hong Kong.

Authentication 96

Authentication Security IT Information Security 96

Krebs on Security

JULY 25, 2023

Now new findings reveal that AVrecon is the malware engine behind a 12-year-old service called SocksEscort , which rents hacked residential and small business devices to cybercriminals looking to hide their true location online. ” According to Kilmer, AVrecon is the malware that gives SocksEscort its proxies. SocksEscort[.]com

Analytics 195

Analytics Passwords Systems administration Retail 195

Security Affairs

JANUARY 21, 2024

million cryptojacking scheme arrested in Ukraine Cybercrime Cryptojacker arrested in Ukraine over EUR 1.8

Security 109

Security e-Discovery Artificial Intelligence Ransomware 109

Security Affairs

MAY 24, 2021

Last month experts spotted a new variant of the ransomware on a hacker forum allowing buyers to opt how to use the malware. “This is in contrast with the classic RaaS operations, where developers typically look for partners to breach into a victim network, to steal data, and deploy the file-encrypting malware.

Ransomware 129

Ransomware Encryption Sales Security 129

Security Affairs

AUGUST 6, 2023

Reptile Rootkit employed in attacks against Linux systems in South Korea New PaperCut flaw in print management software exposes servers to RCE attacks A cyberattack impacted operations of multiple hospitals in several US states Married couple pleaded guilty to laundering billions in cryptocurrency stolen from Bitfinex in 2016 Malicious packages in (..)

Security 91

Security Military Phishing Sales 91

Security Affairs

AUGUST 9, 2023

During a routine web monitoring operation, we discovered an address that led us down a rabbit hole of WordPress-orientated “hack waves” caused by the Balada Injector malware. Within the file, there were seven brackets of PHP tags and each of them contained an obfuscated piece of code within. 206.76.55.162.clients.your-server.de

Access 98

Access IT Security Information Security 98

Security Affairs

MARCH 31, 2021

Researchers from Google’s Threat Analysis Group (TAG) reported that North Korea-linked hackers are targeting security researchers via social media. ” reads the post published by Google TAG. Unlike January campaign, the website of SecuriElite site wasn’t yet to host malicious exploits to deliver malware.

Security 104

Security Cybersecurity IT 104

Krebs on Security

MARCH 2, 2020

A large number of French critical infrastructure firms were hacked as part of an extended malware campaign that appears to have been orchestrated by at least one attacker based in Morocco, KrebsOnSecurity has learned. ‘FATAL’ ERROR.

Passwords 248

Passwords Manufacturing Security Data breaches 248

Security Affairs

JUNE 5, 2021

The US Department of Justice (DOJ) announced the arrest of a Latvian woman for her alleged role in the development of the Trickbot malware. The US Department of Justice (DOJ) announced the arrest of Alla Witte (aka Max), a Latvian woman that was charged for her alleged role in the development of the Trickbot malware.

Ransomware 118

Ransomware Encryption Government Security 118

Security Affairs

JULY 14, 2021

Security researchers from Google Threat Analysis Group (TAG) and Google Project Zero revealed that four zero-day vulnerabilities have been exploited in the wild earlier this year. ” Post by @_clem1 & @maddiestone on 4 0days TAG found this year (with IOCs!). Also thoughts on why we are seeing so many 0day in 2021.

Government 144

Government Security IT Cybersecurity 144

Security Affairs

DECEMBER 7, 2021

Botnet operators use to spread the malware via cracked or pirated software and pay-per-install (PPI) schemes. “Glupteba malware masquerades as free, downloadable software, videos, or movies (“freeware”) and infects a device when a user clicks on a link to the freeware. .” users were warned via Safe Browsing.

Blockchain 116

Blockchain Mining Cloud Access 116

Security Affairs

JUNE 5, 2023

In the recent campaign uncovered by Akamai, threat actors hijack legitimate websites to act as makeshift C2 servers and use them to distribute malware. Once stolen the data, attackers exfiltrate them through a straightforward HTTP request that is initiated by creating an IMG tag within the software skimmer.

CMS 86

CMS Retail Analytics IT 86

Security Affairs

JULY 10, 2023

. “This file’s goal is to load the OLE streams into Microsoft Word, to render an iframe tag responsible for the execution of the next stage of malware.” The last stage malware is the RomCom RAT which is used by operators to collect information about the compromised system and execute remote commands.

Phishing 91

Phishing Government IT Security 91

Security Affairs

JANUARY 29, 2021

Microsoft, like Google TAG, observed a cyber espionage campaign aimed at vulnerability researchers that attributed to North Korea-linked Zinc APT group. ” This week, Google Threat Analysis Group (TAG) also warned of North Korea-linked hackers targeting security researchers through social media. ” concludes Microsoft.

Security 122

Security Encryption Passwords Communications 122

Security Affairs

OCTOBER 31, 2022

Will asked Patrick about the ZIP files used in the malware campaign to see if they were exploiting the same vulnerability or employing some other trick to bypass the “Mark of the Web.” In order to prevent unauthorized actions, files downloaded from the internet in Windows are tagged with a MotW flag.

Ransomware 113

Ransomware Security IT Information Security 113

Security Affairs

NOVEMBER 15, 2021

IDA Pro is widely used by malware researchers to translate machine-executable code into assembly language source code for purpose of debugging and reverse engineering. . In March, researchers from Google’s Threat Analysis Group (TAG) reported that North Korea-linked hackers are targeting security researchers via social media.

Cybersecurity 110

Cybersecurity Ransomware Security IT 110

The Last Watchdog

SEPTEMBER 7, 2022

An unsuspecting employee will open a legitimate-looking message and click a link or download a file that releases embedded malware onto their machine or the broader company network. The price tag of the ransom is just one of the many costs of these attacks, and remediation can often exceed this fee many times over.

Ransomware 124

Ransomware Education Phishing Financial Services 124

Schneier on Security

SEPTEMBER 3, 2019

Earlier this year, Google's Project Zero found a series of websites that have been using zero-day vulnerabilities to indiscriminately install malware on iPhones that would visit the site. Earlier this year Google's Threat Analysis Group (TAG) discovered a small collection of hacked websites. released on February 7.).

Government 90

Government IT 90

Security Affairs

MARCH 13, 2022

CVE-2022-0492 flaw in Linux Kernel cgroups feature allows container escape Charities and NGOs providing support in Ukraine hit by malware. If you want to also receive for free the newsletter with the international press subscribe here. Is it fake news? Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

Security 96

Security Data breaches Ransomware Manufacturing 96

Security Affairs

SEPTEMBER 6, 2020

Baka is a sophisticated e-skimmer developed by a skilled malware developer that implements a unique obfuscation method and loader. The skimmer loads dynamically to avoid static malware scanners and uses unique encryption parameters for each victim to obfuscate the malicious code.” ” reads the alert published by VISA.

e-Delivery 134

e-Delivery Encryption Passwords Authentication 134

Security Affairs

APRIL 15, 2023

A new Android malware named Goldoson was distributed through 60 legitimate apps on the official Google Play store. “The tags such as ‘ads_enable’ or ‘collect_enable’ indicates each functionality to work or not while other parameters define conditions and availability.”

Libraries 98

Libraries Data collection Education Security 98

Security Affairs

OCTOBER 8, 2021

Shane Huntley, the head of the Threat Analysis Group (TAG), wrote on Twitter that his group had sent an above-average batch of government-backed security warnings. . TAG sent a above average batch of government-backed security warnings yesterday. Most of APT28s’ campaigns leveraged spear-phishing and malware-based attacks.

Phishing 102

Phishing Military Government Security 102

Security Affairs

APRIL 23, 2023

Abandoned Eval PHP WordPress plugin abused to backdoor websites CISA adds MinIO, PaperCut, and Chrome bugs to its Known Exploited Vulnerabilities catalog At least 2 critical infrastructure orgs breached by North Korea-linked hackers behind 3CX attack American Bar Association (ABA) suffered a data breach,1.4

Security 87

Security Ransomware Data breaches Cybersecurity 87