Security Affairs

JANUARY 18, 2022

Trend Micro researchers spotted an elusive threat actor, called Earth Lusca, that targets organizations worldwide via spear-phishing and watering hole attacks. . The Winnti group was first spotted by Kaspersky in 2013, but according to the researchers the gang has been active since 2007. Both clusters served as a C&C server.

Healthcare 126

Healthcare Phishing Archiving Education 126

Security Affairs

DECEMBER 10, 2020

Russia-link cyberespionage APT28 leverages COVID-19 as phishing lures to deliver the Go version of their Zebrocy (or Zekapab) malware. Russia-linked APT28 is leveraging COVID-19 as phishing lures in a new wave of attacks aimed at distributing the Go version of their Zebrocy (or Zekapab) malware. ” Pierluigi Paganini.

Phishing 114

Phishing Healthcare Military Data collection 114

Security Affairs

MARCH 20, 2020

According to security researchers from Trend Micro, the Russia-linked APT28 cyberespionage group has been scanning vulnerable email servers for more than a year. Most of APT28s’ campaigns leveraged spear-phishing and malware-based attacks, the recent mass scanning activity represents a change in the modus operandi of the group.

Phishing 145

Phishing Military Government Passwords 145

Security Affairs

DECEMBER 5, 2023

Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks. The group was involved also in the string of attacks that targeted 2016 Presidential election. The group operates out of military unity 26165 of the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS).

Military 119

Military Government Phishing Access 119

Krebs on Security

SEPTEMBER 17, 2020

The government alleges the men used malware-laced phishing emails and “supply chain” attacks to steal data from companies and their customers. Security firm FireEye dubbed that hacking blitz “one of the broadest campaigns by a Chinese cyber espionage actor we have observed in recent years.”

Government 355

Government Mining Big data Phishing 355

Security Affairs

JUNE 21, 2023

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , BlueDelta, and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks.

Military 98

Military Phishing Government Communications 98

Security Affairs

APRIL 17, 2023

The APT41 group, aka Winnti , Axiom, Barium , Blackfly, HOODOO) is a China-linked cyberespionage group that has been active since at least 2007. The attack took place in October 2022, threat actors sent phishing emails that contained links to a password-protected file hosted in Drive.

Phishing 98

Phishing Cloud Government Education 98

Security Affairs

DECEMBER 7, 2023

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , BlueDelta, and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks.

Military 123

Military Government Phishing Authentication 123

eSecurity Planet

SEPTEMBER 14, 2022

As a matter of fact, the most-reported crime in the 2021 Internet Crime Report report was phishing , a social engineering scam wherein the victim receives a deceptive message from someone in an attempt to get the victim to reveal personal information or account credentials or to trick them into downloading malware. since Q3 of 2007.

Energy and Utilities 120

Energy and Utilities Phishing Blockchain Cybersecurity 120

Security Affairs

AUGUST 13, 2020

The FBI and NSA have published a joint security alert containing technical details about a new piece of Linux malware, tracked as Drovorub , allegedly employed by Russia-linked the APT28 group. Most of APT28s’ campaigns leveraged spear-phishing and malware-based attacks. Pierluigi Paganini.

Military 138

Military IoT Phishing Government 138

Security Affairs

APRIL 8, 2022

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Most of APT28s’ campaigns leveraged spear-phishing and malware-based attacks. Pierluigi Paganini.

Military 126

Military Government Phishing Security 126

Security Affairs

SEPTEMBER 27, 2022

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Most of APT28s’ campaigns leveraged spear-phishing and malware-based attacks. Pierluigi Paganini.

Military 99

Military Phishing Government Security 99

Security Affairs

FEBRUARY 9, 2021

The developers behind the NextGen Gallery plugin have fixed two critical Cross-site request forgery (CSRF) vulnerabilities, their exploitation could lead to a site takeover, malicious redirects, spam injection, phishing, and other malicious activities. If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Phishing 119

Phishing Security IT Information Security 119

Krebs on Security

AUGUST 1, 2018

What’s interesting about the incident is that it showcases once again why relying on mobile text messages (SMS) for two-factor authentication (2FA) can lull companies and end users into a false sense of security. SECURITY KEYS. Probably the most secure form of 2FA available involves the use of hardware-based security keys.

Authentication 195

Authentication Passwords Phishing Data breaches 195

Security Affairs

APRIL 19, 2023

The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , and STRONTIUM ) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks.

Military 98

Military Access Cybersecurity Education 98

Security Affairs

APRIL 20, 2021

BMP) image files in a recent spear-phishing campaign targeting entities in South Korea. . Experts from Malwarebytes have uncovered a spear-phishing attack conducted by a North Korea-linked Lazarus APT group that obfuscated a malicious code within a bitmap (.BMP) North Korea-linked Lazarus APT group is abusing bitmap (.BMP)

Phishing 89

Phishing Encryption Communications Ransomware 89

Security Affairs

DECEMBER 25, 2020

This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems. If you want to receive the weekly Security Affairs Newsletter for free subscribe here. Pierluigi Paganini.

Healthcare 136

Healthcare Phishing Passwords Ransomware 136

IT Governance

JUNE 18, 2018

A mystery man walked into an ABN Amro bank in Belgium back in 2007 and walked out with a large amount of diamonds and other gems weighing 120,000 carats. The man, who is still at large, walked in through the front door at regular hours, skipped through all security measures and walked out with the loot. “He No, seriously.

Phishing 102

Phishing Authentication Marketing Access 102

Security Affairs

JANUARY 27, 2022

This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems. The group keeps updating its toolset to evade security mechanisms.” ” reads t he analysis published by Malwarebytes.

Metadata 96

Metadata Phishing Communications Ransomware 96

Security Affairs

SEPTEMBER 24, 2019

Security experts at ESET have uncovered a new campaign carried out by Russia-linked Fancy Bear APT group aimed at political targets. Security researchers at ESET have uncovered a new campaign carried out by Russia-linked Fancy Bear APT group (i.e. APT28 , Sednit , Sofacy , Zebrocy , and Strontium ) aimed at political targets.

Phishing 102

Phishing Military Archiving Security 102

Security Affairs

NOVEMBER 16, 2020

North Korea-linked Lazarus APT group is behind new campaigns against South Korean supply chains that leverage stolen security certificates. . Security experts from ESET reported that North-Korea-linked Lazarus APT (aka HIDDEN COBRA ) is behind cyber campaigns targeting South Korean supply chains.

Financial Services 104

Financial Services Government Phishing Security 104

Security Affairs

DECEMBER 1, 2020

Learn how the group tried to stay under the radar using threats perceived to be less alarming: [link] — Microsoft Security Intelligence (@MsftSecIntel) November 30, 2020. The APT32 also targeted peripheral network security and technology infrastructure corporations, and security firms that may have connections with foreign investors.

Mining 111

Mining Manufacturing Phishing Government 111

Security Affairs

FEBRUARY 8, 2021

In 2018, researchers at security firm CheckPoint uncovered an extensive surveillance operation conducted by Domestic Kitten aimed at specific groups of domestic individuals that were considered a threat to the Iranian regime. If you want to receive the weekly Security Affairs Newsletter for free subscribe here. Pierluigi Paganini.

Phishing 108

Phishing Security IT Information Security 108

Security Affairs

MARCH 22, 2019

The APT28 group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. FireEye revealed that the two Russia-linked APT groups carried out spear-phishing attacks to trick victims into revealing government information and credentials. Pierluigi Paganini.

Government 107

Government Military Phishing Access 107

eSecurity Planet

APRIL 23, 2021

Host Ran Levi takes listeners on a journey through the history of cybersecurity through the lens of real hackers, security experts, journalists, and politicians. The Privacy, Security, & OSINT Show. The Privacy, Security, & OSINT Show. Smashing Security. 5 Stars, 558 ratings. 5 Stars, 558 ratings.

Cybersecurity 139

Cybersecurity Privacy Data breaches Security 139

Security Affairs

FEBRUARY 25, 2021

The attack chain starts with COVID19-themed spear-phishing messages that contain either a malicious Word attachment or a link to one hosted on company servers. . If you want to receive the weekly Security Affairs Newsletter for free subscribe here. Pierluigi Paganini. SecurityAffairs – hacking, Lazarus).

Encryption 103

Encryption Access Phishing Passwords 103

Security Affairs

JULY 6, 2020

This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems. The post North Korean Lazarus APT stole credit card data from US and EU stores appeared first on Security Affairs.

Retail 110

Retail Phishing Marketing IT 110

Hunton Privacy

MARCH 5, 2020

On March 4, 2020, the UK Information Commissioner’s Office (“ICO”) fined the international airline Cathay Pacific Airways Limited (“Cathay Pacific”) £500,000 for failing to protect the security of its customers’ personal data. The fine was issued under the Data Protection Act 1998 (the “DPA”) and represents the maximum fine available.

Personal data 60

Personal data Security Authentication Access 60

Security Affairs

OCTOBER 7, 2018

The APT28 group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. The Earworm group carried out spear-phishing campaigns aimed at delivering the Trojan.Zekapab downloader and the Backdoor.Zekapab. appeared first on Security Affairs.

Military 103

Military Government Phishing Security 103

Security Affairs

OCTOBER 3, 2018

This threat actor has been active since at least 2009, possibly as early as 2007, and it was involved in both cyber espionage campaigns and sabotage activities aimed to destroy data and disrupt systems. Experts believe APT threat actors carried out spear-phishing attacks against the bank, malicious messages used Windows executable.

Retail 103

Retail Libraries Phishing Government 103

Security Affairs

DECEMBER 19, 2018

The Sofacy APT group has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. Attackers carried out a spear-phishing attack using messages with an LNK attachment that would run a series of PowerShell scripts to extract a payload. Pierluigi Paganini.

Military 105

Military Data collection Phishing IT 105

IT Governance

AUGUST 10, 2018

For the next few days,” Cybereason says, “the honeypot was hit with cryptomining bots, phishing bots, DDoS bots, activity that Internet-connected assets typically experience”. The security basics are really what’s going to prevent a bad day from becoming a catastrophic day”. These included recipients’ usernames and email addresses.

Honeypots 48

Honeypots Authentication Energy and Utilities Passwords 48

Krebs on Security

MARCH 4, 2019

Both of these entities are owned by Jesse Willms , a man The Atlantic magazine described in an unflattering January 2014 profile as “The Dark Lord of the Internet” [not to be confused with The Dark Overlord ]. Jesse Willms’ Linkedin profile.

Access 193

Access Marketing Passwords Risk 193

Security Affairs

JUNE 3, 2024

The experts observed the APT deploying Headlace in three distinct phases from April to December 2023, respectively, using phishing, compromised internet services, and living off the land binaries. Insikt Group speculates the operation is aimed at influencing regional and military dynamics.

Military 133

Military Phishing Authentication Government 133

Security Affairs

MARCH 2, 2019

In February 2019, SI-LAB captured multiple samples of phishing campaigns using an Office Excel document carrying a malicious Excel 4.0 This is part of a giant list of Living off the Land (LOL) techniques that attackers employ to mask their activities from runtime endpoint security monitoring tools such as AVs.

File names 98

File names Phishing Libraries IT 98

Security Affairs

JANUARY 8, 2024

Reseachers from Fortinet observed a new variant of a remote access trojan dubbed Bandook that has been used in phishing attacks against Windows users. Bandook has been active since 2007, it has been continuously developed since then and was employed in several campaigns by different threat actors. 7z file.

Phishing 123

Phishing Communications Archiving Passwords 123

Krebs on Security

JUNE 7, 2021

KrebsOnSecurity recently had occasion to contact the Russian Federal Security Service (FSB), the Russian equivalent of the U.S. biz, circa 2007. Mind you, I’m not suggesting anyone go do that: Horohorin pointed out that this random number generator was flagged by 20 different antivirus and security products as malicious.

Encryption 301

Encryption Ransomware Government Communications 301