article thumbnail

China-linked APT41 group targets Hong Kong with Spyder Loader

Security Affairs

Winnti (aka APT41 , Axiom, Barium , Blackfly) is a cyberespionage group that has been active since at least 2007. Like the sample analyzed by Cyberreason, the Spyder Loader sample analyzed by Symantec uses the CryptoPP C++ library. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

article thumbnail

Experts attribute WyrmSpy and DragonEgg spyware to the Chinese APT41 group

Security Affairs

The APT41 group, aka Winnti , Axiom, Barium , Blackfly, HOODOO) is a China-linked cyberespionage group that has been active since at least 2007. These commands include instructing the malware to upload log files, photos stored on the device, and acquire device location using the Baidu Location library.” government.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

North Korea-linked Lazarus APT uses a Mac variant of the Dacls RAT

Security Affairs

This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems. “Both Mac and Linux variants use the WolfSSL library for SSL communications. ” continues the report. Pierluigi Paganini.

article thumbnail

ESET analyzes Turla APT’s usage of weaponized PowerShell

Security Affairs

Turla group has been active since at least 2007 targeting government organizations and private businesses. “To confound detection, its operators recently started using PowerShell scripts that provide direct, in- memory loading and execution of malware executables and libraries. ” reads the report published by ESET.

article thumbnail

Hidden Cobra APT used the new ATM cash-out scheme FASTCash to hit banks worldwide

Security Affairs

This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems. “HIDDEN COBRA actors most likely deployed ISO 8583 libraries on the targeted switch application servers. Pierluigi Paganini.

Retail 88
article thumbnail

CVE-2020-15359: VDALabs Uses Mayhem To Find MP3Gain Stack Overflow

ForAllSecure

VDA Labs, LLC, was founded in 2007 to make the world safer by providing world class cyber security services, products, and training to organizations of all sizes. A harness is an entry-point executable that allows the fuzzer to pass inputs into the library function that requires testing. 2) Finding CVE-2020-15359. 6) Summary.

IoT 52
article thumbnail

CVE-2020-15359: VDALabs Uses Mayhem To Find MP3Gain Stack Overflow

ForAllSecure

VDA Labs, LLC, was founded in 2007 to make the world safer by providing world class cyber security services, products, and training to organizations of all sizes. A harness is an entry-point executable that allows the fuzzer to pass inputs into the library function that requires testing. 2) Finding CVE-2020-15359. 6) Summary.

IoT 52