Remove 2008 Remove Analysis Remove Government Remove Security
article thumbnail

Chinese APT IronHusky use Win zero-day in recent wave of attacks

Security Affairs

The exploit had numerous debug strings from an older, publicly known exploit for vulnerability CVE-2016-3309 , but closer analysis revealed that it was a zero-day.” ” reported the analysis published by Kaspersky. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini. SecurityAffairs – hacking, Windows).

article thumbnail

CVE-2019-1132 Windows Zero-Day exploited by Buhtrap Group in government attack

Security Affairs

The CVE-2019-1132 flaw addressed by Microsoft this month was exploited by Buhtrap threat actor to target a government organization in Eastern Europe. The second one, tracked as CVE-2019.0880, affects Windows 7 and Server 2008. ” reads the analysis published by ESET. ” concludes the analysis.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

A deeper insight into the CloudWizard APT’s activity revealed a long-running activity

Security Affairs

A deeper analysis revealed that the threat actor CloudWizard has been linked to an activity cluster that dates back to May 2016 that was tracked by ESET researchers as Operation Groundbait. Further analysis revealed that the actor behind the above operations has been active since at least 2008. ” We are in the final! .”

article thumbnail

Purple Lambert, a new malware of CIA-linked Lambert APT group

Security Affairs

A deeper analysis of some of these samples revealed that they were compiled in 2014 and used in the wild between 2014 and 2015. ” The Lambert APT (aka Longhorn APT ) has been active since at least 2008, but its first samples were spotted in 2014. reads the analysis published by Symantec.

article thumbnail

AcidBox, a malware that borrows Turla APT exploit, hit Russian organizations

Security Affairs

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. ” reads the analysis published by Palo Alto Networks.

Security 116
article thumbnail

Qbot uses a new email collector module in the latest campaign

Security Affairs

QBot, aka Qakbot and Pinkslipbot , has been active since 2008, it is used by malware for collecting browsing data and banking credentials and other financial information from the victims. ” reads the analysis published by CheckPoint. According to the experts, the QBot Trojan has infected over 100,000 systems across the world.

Passwords 109
article thumbnail

Cyber espionage group used CVE-2018-8589 Windows Zero-Day in Middle East Attacks

Security Affairs

Kaspersky reported the flaw to Microsoft on October 17, the security firm observed attacks against systems protected by its solution and attempting to exploit the zero-day flaw affecting the Win32k component in Windows. The CVE-2018-8589 vulnerability only affects Windows 7 and Windows Server 2008. Pierluigi Paganini.