Remove 2012 Remove Archiving Remove Military Remove Passwords
article thumbnail

NK-linked InkySquid APT leverages IE exploits in recent attacks

Security Affairs

APT37 has been active since at least 2012, it mainly targeted government, defense, military, and media organizations in South Korea. Harvest cookies and a password database for supported browsers. Spawn a thread to recursively search a path and upload files as a ZIP archive. ” reads the post published by Volexity.

Metadata 110
article thumbnail

The Platinum APT group adds the Titanium backdoor to its arsenal

Security Affairs

In June 2018, experts at Kaspersky were investigating attacks against government and military entities in South and Southeast Asian countries, The experts tracked the campaign as EasternRoppels, they speculate it may have started as far back as 2012. The backdoor deploys an SFX archive containing a Windows task installation script.

IT 47
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Russia’s SolarWinds Attack

Schneier on Security

We don’t know how, but last year the company’s update server was protected by the password “solarwinds123” — something that speaks to a lack of security culture.) In 2012, Iran attacked the Saudi national oil company. Russia is almost certainly laying the groundwork for future attack.

article thumbnail

The return of TA402 Molerats APT after a short pause

Security Affairs

MoleRATs is an Arabic-speaking, politically motivated group of hackers that has been active since 2012, in 2018 monitoring the operation of the group, Kaspersky identified different techniques utilized by very similar attackers in the MENA region.