Security Affairs

SEPTEMBER 17, 2020

The Maze ransomware operators now use a virtual machine to encrypt a computer, a tactic previously adopted by the Ragnar Locker malware. The Maze ransomware operators have adopted a new tactic to evade detection, their malware now encrypts a computer from within a virtual machine. ” reads the analysis published by Sophos. .

Ransomware 145

Ransomware Encryption File names Security 145

Security Affairs

JULY 8, 2019

Experts observed an increase of the malware spreading using less-known archive types as dropper,in particular ISO image.Delphi wrapper makes analysis harder. Technical Analysis. As expected, the malicious payload is stored in the resource section in encrypted way (probably using a simple XOR-encryption). Introduction.

File names 71

File names Encryption Archiving Phishing 71

Security Affairs

SEPTEMBER 10, 2020

Security experts from ESET discovered a new piece of malware, tracked as CDRThief, that targets the Linux VoIP platform, Linknat VOS2009/3000 softswitches, to steal call data records (CDR) from telephone exchange equipment. . ” reads the analysis published by ESET. ” continues the analysis.

Metadata 121

Metadata Encryption File names Passwords 121

Security Affairs

OCTOBER 5, 2020

Security researchers provided technical details about an IoT botnet dubbed Ttint that has been exploiting two zero-days in Tenda routers. Security researchers at Netlab, the network security division Qihoo 360, have published a report that details an IoT botnet dubbed Ttint. Pierluigi Paganini.

IoT 140

IoT Encryption Communications Access 140

Security Affairs

MARCH 16, 2020

Security experts from IBM X-Force have spotted a new strain of ransomware, dubbed PXJ Ransomware, that does share the same code with other known ransomware families. The name PXJ ransomware comes from the file extension that it appends to encrypted files. ” reads the analysis post by IBM X-Force. .

Ransomware 103

Ransomware Encryption Communications IT 103

Security Affairs

MAY 23, 2020

Security experts observed a spike in the use of the GuLoader since March 2020 while investigating COVID-19-themed malspam campaigns. In the last campaign observed by experts, the downloader utilizes cloud hosting services to keep the payload encrypted. ” reads the analysis. Pierluigi Paganini.

Encryption 98

Encryption Cloud Access Security 98

Security Affairs

SEPTEMBER 6, 2020

The skimmer loads dynamically to avoid static malware scanners and uses unique encryption parameters for each victim to obfuscate the malicious code.” The JavaScript URL is hardcoded in the loader script in encrypted format, experts observed that the attackers can change the URL for each victim. Pierluigi Paganini.

e-Delivery 135

e-Delivery Encryption Passwords Authentication 135

Security Affairs

NOVEMBER 26, 2019

Security experts at Microsoft analyzed a new strain of cryptocurrency miner tracked as Dexphot that has been active since at least October 2018. “The Dexphot attack used a variety of sophisticated methods to evade security solutions. ”reads the analysis published by Microsoft. msiexec.exe, unzip.exe, rundll32.exe,

File names 125

File names Encryption Mining Security 125

Security Affairs

MAY 11, 2020

Researchers discovered two security flaws impacting Oracle’s iPlanet Web Server, tracked as CVE-2020-9315 and CVE-2020-9314, that could cause sensitive data exposure and limited injection attacks. The vulnerability could result in the leak of sensitive data, including configuration information and encryption keys. .

Security 92

Security Phishing Encryption Authentication 92

Security Affairs

APRIL 20, 2019

A white hat hacker discovered how to break Tchap, a new secure messaging app launched by the French government for officials and politicians. The key point Tchap is that encrypted communications flow through internal servers to prevent cyber attacks carried out by foreign nation-state actors. or @elysee.fr Pierluigi Paganini.

Security 102

Security Encryption Communications Government 102

Security Affairs

JANUARY 29, 2021

. “In recent months, Microsoft has detected cyberattacks targeting security researchers by an actor we track as ZINC. “Observed targeting includes pen testers, private offensive security researchers, and employees at security and tech companies. ” states the report published by Microsoft.

Security 118

Security Encryption Passwords Communications 118

Security Affairs

MARCH 17, 2020

Last week, security experts from MalwareHunterTeam detected new ransomware dubbed CoronaVirus has been distributed through a malicious web site that was advertising a legitimate system optimization software and utilities from WiseCleaner. The filename of the encrypted files will be changed to the attacker’s email address (i.e.

Ransomware 101

Ransomware Passwords File names Encryption 101

The Last Watchdog

JUNE 21, 2020

Numerous strains of this destructive code have been the front-page news in global computer security chronicles for almost a decade now, with jaw-dropping ups and dramatic downs accompanying its progress. File encryption 2013 – 2015. Ransomware is undoubtedly one of the most unnerving phenomena in the cyber threat landscape.

Ransomware 244

Ransomware Encryption Privacy Security awareness 244

Security Affairs

JUNE 22, 2020

” reads the analysis published by Juniper, “Previous versions of IcedID injected into svchost.exe and downloaded encrypted modules and config as “.dat” The size of the image is more than 600KB and embedded in it is the encrypted IcedID main module. ” continues the analysis. “[The dat” files.

Encryption 109

Encryption IT Security Information Security 109

Security Affairs

OCTOBER 11, 2020

Experts believe that However the FONIX RaaS can quickly become rampant if security firms and authorities underestimate it. “Notably, FONIX varies somewhat from many other current RaaS offerings in that it employs four methods of encryption for each file and has an overly-complex post-infection engagement cycle.”

Ransomware 89

Ransomware Encryption Compliance Communications 89

Security Affairs

JUNE 5, 2020

” reads the analysis published by BlackBerry. Attackers timestamped files with date timestamps of 11th April 2020, 15:16:22: Upon establishing a foothold onto the target network, the attackers executed the Java ransomware module, which encrypted the files on connected servers. ”continues the analysis.

Ransomware 76

Ransomware Encryption Archiving Education 76

Security Affairs

DECEMBER 10, 2019

Experts spotted a new piece of the Snatch ransomware that reboots computers it infects into Safe Mode to bypass resident security solutions. Researchers discovered a new strain of the Snatch ransomware that reboots computers it infects into Safe Mode to bypass resident security solutions and encrypt files on the system.

Ransomware 68

Ransomware Security Encryption Access 68

Security Affairs

APRIL 1, 2020

In malspam attacks, attackers could encrypt the Excel file by setting up a password, then when the victims receive the email, hackers trick them into opening the attachment using a password included in the content of the message. ” reads the analysis published by the experts. Pierluigi Paganini.

Passwords 98

Passwords Encryption Security IT 98

Security Affairs

APRIL 30, 2020

Security experts from Cybereason Nocturnus team discovered a new piece of Android malware dubbed EventBot that targets banks, financial services across Europe. ” reads the analysis published by Cybereason. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” concludes the report.

Financial Services 110

Financial Services Libraries Encryption Authentication 110

Security Affairs

OCTOBER 2, 2018

GandCrab operates like a classic ransomware, it encrypts all user files and drops some ransom notes on the infected machine. to allow the code to encrypt the files opened by these applications. Technical details, including IoCs and Yara Rules, are reported in the analysis shared by researchers at the ZLab. Pierluigi Paganini.

Ransomware 92

Ransomware Encryption Security IT 92

Security Affairs

SEPTEMBER 27, 2020

” continues the analysis. The binaries are stored encrypted and obfuscated too, with a slightly different format, the AES Initialization vector being stored within the core module binary instead of in the encrypted module files.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Encryption 140

Encryption Communications IT Government 140

Security Affairs

JULY 11, 2019

Malware researchers at two security firms Intezer and Anomali have discovered a new piece of ransomware targeting Network Attached Storage (NAS) devices. Experts at security firms Intezer and Anomali have separately discovered a new piece of ransomware targeting Network Attached Storage (NAS) devices. base64 encoded encrypted data].

Ransomware 91

Ransomware Encryption Manufacturing Security 91

Security Affairs

JUNE 13, 2020

D-Link has released a firmware update to address three security flaws impacting the DIR-865L home router model, but left some issue unpatched. D-Link has recently released a firmware update to address three out of six security flaws impacting the DIR-865L wireless home router. ” reads the analysis published by Palo Alto Networks.

Security 79

Security Encryption Risk Access 79

Security Affairs

NOVEMBER 5, 2020

” reads the analysis published by Sophos. The attackers use a simple XOR encryption algorithm with the string “Hapenexx is very bad” as a key. ” continues the analysis. . In these attacks, the encryption key used is the string “HELLO_USA_PRISIDENT.” Pierluigi Paganini.

File names 110

File names Encryption Libraries IT 110

Security Affairs

SEPTEMBER 10, 2020

Security experts from ESET discovered a new piece of malware, tracked as CDRThief, that targets the Linux VoIP platform, Linknat VOS2009/3000 softswitches, to steal call data records (CDR) from telephone exchange equipment. . ” reads the analysis published by ESET. ” continues the analysis.

Metadata 69

Metadata Encryption File names Passwords 69

Security Affairs

SEPTEMBER 27, 2020

Security researchers from Zscaler spotter 17 apps in the Play Store that were infected with the Joker (Bread) malware. In February, the infamous Joker malware has found a way to bypass the security checks to be published in the official Play Store, Check Point researchers discovered a new clicker.

Encryption 142

Encryption Paper Security IT 142

Security Affairs

FEBRUARY 17, 2019

The best news of the week with Security Affairs. Adiantum will bring encryption on Android devices without cryptographic acceleration. Malicious PDF Analysis. SAP security fixes address Critical flaw in SAP HANA XSA. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. 20% discount.

Security 70

Security Sales Data breaches Paper 70

Security Affairs

AUGUST 29, 2021

So far, Konni RAT has managed to evade detection as only 3 security solutions on VirusTotal were able to detect the malware. Security researchers at Malwarebytes Labs have uncovered an ongoing malware campaign that is mainly targeting Russia with the Konni RAT. ” reads the analysis published by Malwarebytes.

Encryption 135

Encryption IT Security Information Security 135

Security Affairs

JANUARY 21, 2020

In a few days back, the MalwareMustDie team’s security researcher unixfreaxjp has published a new Linux malware analysis of Fbot that has focused on the decryption of the last encryption logic used by its bot client. This article explains what we have learned about the Fbot traced back from the year of 2014.

IoT 133

IoT Honeypots Encryption IT 133

Security Affairs

AUGUST 7, 2020

“Per our analysis, the leaked files contained Intel intellectual property respective to the internal design of various chipsets. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. . ” reported ZDNet.

Security 66

Security Encryption Authentication Marketing 66

Security Affairs

JULY 4, 2019

Researchers published a technical analysis of the privilege escalation process that allows the threat to gain SYSTEM privileges. The body of each Sodin sample includes an encrypted configuration block that stores the settings and data used by the malware. ” continues the analysis. Pierluigi Paganini.

Ransomware 80

Ransomware Encryption Government IT 80

Security Affairs

MARCH 31, 2019

The best news of the week with Security Affairs. Malware Static Analysis. How to get back files encrypted by the Hacked Ransomware for free. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Kindle Edition.

Security 71

Security Data breaches Ransomware Paper 71

Security Affairs

NOVEMBER 21, 2019

The second stage installs itself and loads the third stage using an encrypted, hardcoded path. ” reads the analysis. ” The malware leverages the Microsoft implementation of SSL/TLS, Secure Channel, for C2 communication. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Communications 104

Communications Encryption Education Authentication 104

Security Affairs

MAY 4, 2022

APT38 appears to be a North Korea-linked group separate from the infamous Lazarus group, it has been active since at least 2014 and it has been observed targeting over 16 organizations across 11 countries. The investigation of the security firm started with the discovery of ‘ VHD ransomware ’ in the threat landscape in March 2020.

Ransomware 104

Ransomware Encryption Cybersecurity Security 104

Security Affairs

AUGUST 15, 2020

The malware also implements ransomware behavior, it is able to encrypt files and display a ransom note. ” reads the analysis published by Trend Micro. The analysis of the C&C server revealed a list of 380 victim IP addresses, most of them in China (152) and India (103). Xcode developers are at risk. Pierluigi Paganini.

Ransomware 127

Ransomware Encryption Risk IT 127

eSecurity Planet

OCTOBER 3, 2022

Then they moved the conversation away from the platform to encrypted messaging apps like WhatsApp. See the Best Open Source Security Tools. ZINC cybercriminals are considered sophisticated attackers who made themselves known with an attack against Sony Pictures Entertainment in 2014. Putty) and networking tools. UK, and India.

IT 128

IT Phishing Encryption Archiving 128

Security Affairs

SEPTEMBER 23, 2018

Security experts from Trend Micro discovered a new malware tracked as Virobot that combines ransomware and botnet capabilities. Virobot encrypts files on infected machines and is also implements spam botnet abilities and leverages it target other systems. ” reads the analysis published by Trend Micro. Pierluigi Paganini.

Ransomware 85

Ransomware Encryption Risk Security 85