Security Affairs

JULY 4, 2019

In October, Kaspersky revealed that the CVE-2018-8453 vulnerability has been exploited by the APT group tracked as FruityArmor , a cyber-espionage group that was first observed in 2016 while targeting activists, researchers, and individuals related to government organizations. ” continues the analysis.

Ransomware 77

Ransomware Encryption Government IT 77

Security Affairs

APRIL 20, 2019

A white hat hacker discovered how to break Tchap, a new secure messaging app launched by the French government for officials and politicians. It aims at replacing popular instant messaging services like Telegram and WhatsApp for government people. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Security 99

Security Encryption Communications Government 99

Security Affairs

APRIL 28, 2020

The malware was an info stealer and according to the researchers, it was part of a long-term campaign, tracked as “PhantomLance” that has been active at least since December 2015. ” reads the analysis published by Kaspersky. ” continues the analysis. Android version, installed apps). .

Marketing 106

Marketing Encryption IT Cybersecurity 106

Security Affairs

NOVEMBER 21, 2019

The group is very sophisticated and used zero-day exploits and complex malware to conduct targeted attacks against governments and organizations in almost every industry, including financial, energy, telecommunications, and education, aerospace. The second stage installs itself and loads the third stage using an encrypted, hardcoded path.

Communications 103

Communications Encryption Education Authentication 103

Security Affairs

JUNE 6, 2019

According to Microsoft, the Platinum has been active since at least 2009, it was responsible for spear phishing attacks on ISPs, government organizations, intelligence agencies, and defense institutes. ” reads the analysis published by the expert. ” continues the analysis. ” continues Kaspersky.

Communications 69

Communications Encryption Military Government 69

IT Governance

OCTOBER 24, 2023

At the end of each month, these incidents – and any others that we find – will be used to inform our monthly analysis of data breaches and cyber attacks. Breached organisation: BHI Energy, providing staffing solutions to the nuclear, fossil, wind, hydro and government energy markets. Records breached: Around 700 records.

Data Privacy 107

Data Privacy Privacy Security Data breaches 107

Security Affairs

MAY 30, 2020

“A new Phishing campaign against INPS users , similar to the previous one of April 6, 2020 , has been detected in the past few hours by our research and analysis center for Phishing campaigns.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” reads the post published D3Lab.

Phishing 92

Phishing Encryption Communications Access 92

Security Affairs

APRIL 3, 2019

The hackers targeting organizations across multiple industries and have also targeted foreign governments, dissidents, and journalists. “ Threat actors used a custom steganography algorithm to hide the encrypted payload within PNG images to to avoid detection. ” reads the report published by the experts. Pierluigi Paganini.

Libraries 76

Libraries Encryption Communications Manufacturing 76

Security Affairs

DECEMBER 28, 2019

“Forensic analysis is currently ongoing but the virus, identified as “Ryuk” ransomware, may have entered the network of the MTSA facility via an email phishing campaign.” The Ryuk ransomware also infected the industrial control systems that monitor and control cargo transfer and encrypted files critical to process operations.

Ransomware 71

Ransomware Phishing Encryption Access 71

Security Affairs

JUNE 8, 2020

The Indian Government fixed a flaw in the secure document wallet service Digilocker that could have potentially allowed anyone’s access without password. DigiLocker is an online service provided by Ministry of Electronics and IT (MeitY), Government of India under its Digital India initiative. Pierluigi Paganini.

Authentication 89

Authentication Passwords Encryption Access 89

Security Affairs

OCTOBER 17, 2018

Today I’d like to share an interesting analysis of a Targeted Attack found and dissected by Yoroi (technical details are available here ). At a first sight, the office document had an encrypted content available on OleObj.1 And why the attacker used an encrypted payload if the victim cannot open it? 1 and OleObj.2.

Computer and Electronics 87

Computer and Electronics Encryption Military Security 87

Security Affairs

MARCH 31, 2019

Malware Static Analysis. How to get back files encrypted by the Hacked Ransomware for free. LUCKY ELEPHANT campaign targets South Asian governments. Exodus, a government malware that infected innocent victims. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Kindle Edition. Paper Copy.

Security 68

Security Data breaches Ransomware Paper 68

Security Affairs

DECEMBER 7, 2019

Russia-linked Gamaredon cyberespionage group has been targeting Ukrainian targets, including diplomats, government and military officials. Russia linked APT group tracked as Gamaredon has been targeting several Ukrainian diplomats, government and military officials, and law enforcement. ” continues the analysis. .

Military 57

Military Government Phishing Archiving 57

Security Affairs

SEPTEMBER 23, 2020

The operators use a suite of custom tools with the ultimate goal of encrypting files in the infected system and holding it for a ransom of about $50,000. In other instances, the gang exploited the COVID-19 theme and anti-government rallies in Belarus in their phishing emails. About Group-IB. Pierluigi Paganini.

Ransomware 100

Ransomware Phishing Encryption Authentication 100

Security Affairs

AUGUST 31, 2020

Most of the infections were observed in organizations in the US and Europe, the most targeted industries were in the government, military, and manufacturing sectors. . ” reads the analysis published by CheckPoint. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Passwords 106

Passwords Military Manufacturing Encryption 106

Security Affairs

SEPTEMBER 16, 2020

Cybersecurity and Infrastructure Security Agency (CISA) released a malware analysis report (MAR) that includes technical details about web shells employed by Iranian hackers. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Passwords 89

Passwords Insurance Access Encryption 89

Security Affairs

AUGUST 4, 2020

and foreign government organizations. and foreign government organizations, education entities, private companies, and health agencies by unidentified cyber actors.” In order to encrypt the user files on a victim network, the actors typically launch a malicious PowerShell script embedded with the Netwalker ransomware executable.”.

Ransomware 95

Ransomware Phishing Encryption Education 95

Security Affairs

MARCH 8, 2020

Once the GuLoader malware has downloaded an encrypted file from [link] it will decrypt it and inject the malware into the legitimate Windows wininit.exe process. states the analysis published by FireEye. Use trusted sources—such as legitimate, government websites —for up-to-date, fact-based information about COVID-19.

Phishing 121

Phishing Sales Archiving Encryption 121

Security Affairs

DECEMBER 6, 2018

“Hackers behind a massive breach at hotel group Marriott International Inc left clues suggesting they were working for a Chinese government intelligence gathering operation, according to sources familiar with the matter.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Data breaches 87

Data breaches Archiving Access Encryption 87

Security Affairs

JULY 17, 2019

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America and former Soviet bloc nations. ” reads the analysis published by Kaspersky.

IT 70

IT Encryption Security Government 70

Security Affairs

NOVEMBER 9, 2019

According to Microsoft, the Platinum has been active since at least 2009, it was responsible for spear phishing attacks on ISPs, government organizations, intelligence agencies, and defense institutes. ” reads the analysis publisjed by Kaspersky. This C2 encrypts data with the same key as the C&C requests.

IT 47

IT Archiving Encryption Passwords 47

Security Affairs

APRIL 5, 2019

This is not going to be a full path analysis so If you are interested in a more complete one, including dissection steps on final payloads, please refer to some of my previous analysis ( HERE , HERE , HERE ) or to Yoroi’s Blog. The used variable holds a Base64 representation of encrypted data. Traffic Patterns Stage3.

Computer and Electronics 90

Computer and Electronics Encryption Communications Security 90

Security Affairs

AUGUST 4, 2020

and foreign government organizations. and foreign government organizations, education entities, private companies, and health agencies by unidentified cyber actors.” In order to encrypt the user files on a victim network, the actors typically launch a malicious PowerShell script embedded with the Netwalker ransomware executable.”.

Ransomware 75

Ransomware Phishing Encryption Education 75

Security Affairs

JANUARY 6, 2019

The analysis of the Bitcoin address used by The Dark Overlord’ revealed 16 transactions for a total of 3.27749466 BTC (more than $12,500). The hackers organized the files in five “layers” of encrypted documents and now likely released “layer 1? Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Insurance 111

Insurance Data breaches Sales Government 111

Security Affairs

MAY 26, 2020

The Turla APT group (aka Snake , Uroburos , Waterbug , Venomous Bear and KRYPTON ) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. Pierluigi Paganini. SecurityAffairs – Tesla, hacking).

Military 96

Military Communications Encryption Authentication 96

Security Affairs

SEPTEMBER 10, 2018

The hackers attempted to inject malicious JavaScript code into the government websites connected to the data center. ” reads the analysis published by Kaspersky. ” The cyberespionage campaign analyzed by Kaspersky targeted Middle Asian government entities immediately prior to the Central Asian high-level meeting.

Communications 67

Communications Financial Services Phishing Encryption 67

Security Affairs

AUGUST 25, 2019

At least 23 Texas local governments targeted by coordinated ransomware attacks. Malware Analysis Sandboxes could expose sensitive data of your organization. million to allow towns to access encrypted data. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Once again thank you!

Security 50

Security Mining Data breaches Libraries 50

Security Affairs

APRIL 23, 2019

According to Kaspersky, threat actors tampered with a legitimate binary that was initially compiled in 2015 and that was digitally signed to avoid detection. ” reads the analysis published by Kaspersky. ” continues the analysis. “Even the data with the encrypted payload is stored inside this code section.

Mining 71

Mining Encryption IT Government 71

Security Affairs

OCTOBER 14, 2019

Today I’d like to share a quick analysis resulted by a very interesting email which claimed to deliver a SOC “weekly report” on the victim email. Technical Analysis. Analysis of dropped and executed file (emotet). AV and plenty static traffic signatures confirm we are facing a new encrypted version of Emotet trojan.

Computer and Electronics 76

Computer and Electronics Security Encryption IT 76

Security Affairs

JANUARY 16, 2020

dll module that contains various ‘Certificate and Cryptographic Messaging functions’ used by the Windows Crypto API for data encryption. . ” The US DHS CISA agency also issued an emergency directive urging government agencies to address the bug in their systems in ten days. The flaw affects the way Crypt32.dll

Encryption 73

Encryption Security Cybersecurity Risk 73

Security Affairs

AUGUST 7, 2019

Security researcher Marco Ramilli presents a comparative analysis of attacks techniques adopted by the Iran-Linked OilRig APT group. Today I’d like to share a comparative analysis of OilRig techniques mutation over time. The original post and other interesting analysis are published on the Marco Ramilli’s blog: [link].

e-Delivery 80

e-Delivery Computer and Electronics Phishing Communications 80

Security Affairs

AUGUST 23, 2018

Malware researchers from ESET have conducted a new analysis of a backdoor used by the Russia-linked APT Turla in targeted espionage operations. The new analysis revealed a list of high-profile victims that was previously unknown. ” reads the analysis published by ESET. ” reads the analysis published by ESET.

Metadata 45

Metadata Military Libraries Access 45

Security Affairs

AUGUST 28, 2019

” reads the analysis published by TrendMicro. TA505 also used in one attack an updated version of ServHelper that included the strings’ binary encrypted in Vigenère cipher. The TA505 also targeted government agencies in Saudi Arabia, Oman, and Qatar using another type of.XLS or.DOC attachments. XLS or VBA.DOC macros.”

e-Delivery 72

e-Delivery Insurance Retail Government 72

Hunton Privacy

FEBRUARY 6, 2015

On February 3, 2015, the Securities and Exchange Commission (“SEC”) released a Risk Alert , entitled Cybersecurity Examination Sweep Summary, summarizing observations from the recent round of cybersecurity examinations of registered broker-dealers and investment advisers under the Cybersecurity Examination Initiative.

Cybersecurity 40

Cybersecurity Insurance Financial Services Risk 40

Security Affairs

SEPTEMBER 9, 2018

” reads the analysis published by CheckPoint. Data exfiltrated from the victim’s device are transferred to the C&C server via HTTP POST requests, it is encrypted with the AES algorithm and can be decrypted with a device ID that is unique for each victim. ” continues the analysis. call records.

Encryption 49

Encryption Government Security IT 49

Security Affairs

FEBRUARY 21, 2020

So, Cybaze-Yoroi ZLab team decided to dive deep into technical analysis. Technical Analysis. The money is kept by the government and in return, a “non-permanent” profit officially titled as “interest” is given back to the officers at the end of each year. The Fund is financial planning for defense personnel. Conclusion.

Military 113

Military Communications Encryption IT 113

Security Affairs

AUGUST 20, 2018

During the analysis time, only really few Antivirus (6 out of 60) were able to “detect” the sample. In this stage the JavaScript is loading an encrypted content from the original JAR, using a KEY decrypts such a content and finally loads it (Dynamic Class Loader) on memory in order to fire it up as a new Java code.

Computer and Electronics 64

Computer and Electronics Encryption Security File names 64