article thumbnail

Experts linked Maui ransomware to North Korean Andariel APT

Security Affairs

North Korean nation-state actors used Maui ransomware to encrypt servers providing healthcare services, including electronic health records services, diagnostics services, imaging services, and intranet services. critical infrastructure in violation of the Computer Fraud and Abuse Act, may be eligible for a reward.

article thumbnail

NASA warns of a significant increase in cyber attacks during Coronavirus outbreak

Security Affairs

NASA employees and contractors should be aware that nation-states and cyber criminals are actively using the COVID-19 pandemic to exploit and target NASA electronic devices, networks, and personal devices.” Refrain from opening your personal email or non-work related social media on your NASA computer systems/devices.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Sopra Steria hit by the Ryuk ransomware gang

Security Affairs

A cyber attack was detected on the Sopra Steria computer network on the evening of October 20. And part of the information system would have been encrypted.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Security measures have been taken to limit the risk of propagation.”

article thumbnail

First Multistate HIPAA Data Breach Lawsuit May Signal Increased State Interest in Data Security Enforcement

Data Matters

On December 3, 2018, twelve attorneys general (“AGs”) jointly filed a data breach lawsuit against Medical Informatics Engineering and its subsidiary, NoMoreClipboard LLC (collectively “the Company”), an electronic health records company, in federal district court in Indiana. See Indiana v. Informatics Eng’g, Inc. , 3:18-cv-00969 (N.D.

article thumbnail

MartyMcFly Malware: new Cyber-Espionage Campaign targeting Italian Naval Industry

Security Affairs

At a first sight, the office document had an encrypted content available on OleObj.1 Those objects are real Encrypted Ole Objects where the Encrypted payload sits on “EncryptedPackage” section and information on how to decrypt it are available on “EncryptionInfo” xml descriptor. Stage1: Encrypted Content.

article thumbnail

Step By Step Office Dropper Dissection

Security Affairs

From the recorded traffic it’s possible to see the following patterns: a HTTP GET request with some encrypted information to download plugin/additional stages and finally a HTTP POST to send victim’s data directly on the “attacker side”. The used variable holds a Base64 representation of encrypted data. Edited by Pierluigi Paganini.

article thumbnail

Croatia government agencies targeted with news SilentTrinity malware

Security Affairs

The SilentTrinity malware can take control over an infected computer, it allows attackers to execute arbitrary commands. The C2 traffic is encrypted with AES, the public key is generated using the Diffie–Hellman protocol, the network transport is implemented over HTTP(S) with proxy support. The result is sent back to the C2 server.