Security Affairs

MARCH 19, 2020

” According to the experts, the first infections were observed in late 2019, victims reported their files were encrypted by a strain of malware. locked to the filename of the encrypted files. CERT-FR’s alert states that the Pysa ransomware code based on public Python libraries. newversion file extension instead of.

Ransomware 105

Ransomware Government Encryption Passwords 105

Security Affairs

APRIL 3, 2019

. “While continuing to monitor activity of the OceanLotus APT Group, BlackBerry Cylance researchers uncovered a novel payload loader that utilizes steganography to read an encrypted payload concealed within a.png image file.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Libraries 76

Libraries Encryption Communications Manufacturing 76

Security Affairs

FEBRUARY 10, 2020

The good news is that according to the Agency, data was encrypted, it also added that Google and Adobe were not able to see the CP R numbers. “Google Hosted Libraries have been designed to remove all information that allows identifying users before logging on. ” states the Government Agency. “Google has accessed 1.2

Encryption 106

Encryption Libraries Access Government 106

Security Affairs

JANUARY 11, 2019

In this phase, the ransomware sends to the command and control server information on the encryption process, including a string that contains the Initialization Vector (IV) and a random password used by the ransomware to encrypt the files. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Ransomware 96

Ransomware Encryption Passwords Libraries 96

Security Affairs

NOVEMBER 5, 2020

Dynamic-link library (DLL) side-loading takes advantage of how Microsoft Windows applications handle DLL files. The attackers use a simple XOR encryption algorithm with the string “Hapenexx is very bad” as a key. In these attacks, the encryption key used is the string “HELLO_USA_PRISIDENT.”

File names 108

File names Encryption Libraries IT 108

Security Affairs

NOVEMBER 27, 2018

The Event-Stream library is a very popular NodeJS module used to allow developers the management of data streams, it has nearly 2 million downloads a week. It has been estimated that the tainted version of the library was downloaded by nearly 8 million developers. The malicious code was introduced in the version 3.3.6,

Libraries 80

Libraries Encryption IT Security 80

Security Affairs

SEPTEMBER 3, 2020

The second layer of Python code decodes and loads to memory the main RAT and the imported libraries. The malware communicates with the C2 communications via POST HTTP requests and uses RC4 encryption with a hardcoded key encoded with Base64. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Phishing 135

Phishing Encryption File names Metadata 135

Security Affairs

AUGUST 27, 2019

The module was hidden in a 3rd-party advertising library that the author of the app recently was introduced. “After analyzing the app, we saw an advertising library in it that contains a malicious dropper component. . Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

IT 97

IT Libraries Encryption Security 97

Security Affairs

SEPTEMBER 4, 2019

JSWorm encrypts all the user files appending a new extension to their name. During the encryption phase, the ransomware creates an HTML Application “JSWRM-DECRYPT.hta” in each folder it encounters. The malware encrypts all the files whose extension is not present in the list. Figure 3: Extensions excluded from encryption.

Ransomware 81

Ransomware Encryption File names Libraries 81

Security Affairs

SEPTEMBER 12, 2019

This operation is similar to the threat group’s August 2018 campaign , using compromised university resources to send library-themed phishing emails.” The hackers appear to be interested in getting access to the library, they sent phishing messages to people with access to the library of the targeted university.

Phishing 79

Phishing Libraries File names Metadata 79

Security Affairs

OCTOBER 15, 2020

Over the weekend, users have been complaining on Nook’s Facebook page and Twitter that they were not able to access their library of purchased eBooks and magazine subscriptions. 2/2) Please be assured that there is no compromise of customer payment details which are encrypted and tokenized. Thank you for your patience.

Ransomware 110

Ransomware Encryption Retail Access 110

Security Affairs

APRIL 14, 2020

.” The messages use a weaponized rich text format (RTF) attachment that exploits the CVE-2012-0158 buffer overflow in Microsoft’s ListView / TreeView ActiveX controls in MSCOMCTL.OCX library. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” continues the analysis.

Ransomware 114

Ransomware Phishing File names Encryption 114

Security Affairs

MARCH 19, 2019

The flaw is an “Absolute Path Traversal” issue in the library that could be exploited to execute arbitrary code by using a specially-crafted file archive. The ransomware encrypts data on the victim’s machine and appends the.Jnec extension to the encrypted data asking a ransom 0.05 bitcoins (about $200). Pierluigi Paganini.

Ransomware 70

Ransomware Archiving Encryption Libraries 70

Security Affairs

SEPTEMBER 28, 2019

One of the second-stage instances of PowerShell downloads the legitimate node.exe tool, while another drops WinDivert packet capture library components. based payload, and a bunch of encrypted files. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

e-Delivery 80

e-Delivery Retail Libraries Education 80

Security Affairs

NOVEMBER 12, 2019

Buran is advertised as a stable malware that uses an offline cryptoclocker , 24/7 support, global and session keys, and has no third-party dependencies such as libraries. The malware will encrypt the files only if the machines are not in Russia, Belarus or Ukraine. . ” reads the analysis published by McAfee. Pierluigi Paganini.

Ransomware 44

Ransomware Encryption Libraries Security 44

Security Affairs

MAY 10, 2020

This issue could be exploited only when the encryption keys are obtained via a separate attack, meaning that the attackers have to chain more exploits in their campaigns. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” reads the report published by Red Canary experts. Pierluigi Paganini.

Mining 84

Mining Libraries Access Encryption 84

Security Affairs

OCTOBER 10, 2019

The malware implements a modular structure with a dispatcher and loadable plugins, all of which are implemented as dynamic-link libraries (DLLs). The Attor malware makes sophisticated use of encryption to hide its components. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Communications 79

Communications Encryption Metadata Libraries 79

Security Affairs

FEBRUARY 19, 2019

It spreads Shade/ Treshold variants, one of the most dangerous threats in the cyber crime scenario, known since its massive infection into the Russian panorama back in 2015, its expansion has been tracked by several CSIRTs and CERTs all across the world. Shade encrypts all the user files using an AES encryption scheme.

Ransomware 75

Ransomware Mining File names Encryption 75

Security Affairs

AUGUST 12, 2019

Searching online the expert first found an encrypted firmware, he found on a forum a Portable ROM Dumper , (a custom firmware update file that once loaded, dumps the memory of the camera into the SD Card) that allowed him to dump the camera’s firmware and load it into his disassembler (IDA Pro). ” continues the post.

Ransomware 87

Ransomware Encryption Libraries Authentication 87

Security Affairs

APRIL 7, 2020

Upon the installation, the malicious app registers itself as a foreground service and extracts an encrypted payload that gathers information about the victim’s device (android_id, manufacturer, model, firmware version, etc.) Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” concludes Kaspersky.

Manufacturing 121

Manufacturing Libraries Access Encryption 121

Security Affairs

NOVEMBER 2, 2019

“Although issues with certificate validation have been identified within the encrypted communication between the mobile application and the backend system, the inner layer of end-to-end encryption could not be broken.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Encryption 47

Encryption Privacy Libraries Risk 47

Security Affairs

JANUARY 15, 2020

dll module that contains various ‘Certificate and Cryptographic Messaging functions’ used by the Windows Crypto API for data encryption. . “This month we addressed the vulnerability CVE-2020-0601 in the usermode cryptographic library, CRYPT32.DLL, The flaw affects the way Crypt32.dll Pierluigi Paganini.

Libraries 73

Libraries Encryption Security Risk 73

Security Affairs

JUNE 18, 2020

It exploits a vulnerability in the Windows wdigest.dll library and then uses an improved ListPlanting technique to inject its code into a trusted process. The activity of the group is characterized by the heavy use of legitimate tools and per-victim encryption in the early stages of the attack chains. Pierluigi Paganini.

Military 79

Military Communications Libraries Encryption 79

Security Affairs

NOVEMBER 21, 2019

One of the addresses disguised the Bot sample as a Google font library “ roboto. ” The analysis of the bot revealed that it supports seven functions: reverse shell, self-uninstall, gather process’ network information, gather Bot information, execute system commands, run encrypted files specified in URLs, DDoS attack, etc.

Honeypots 80

Honeypots Systems administration Passwords IoT 80

Security Affairs

JUNE 12, 2019

Experts pointed out that Microsoft failed to address a flaw in SymCrypt , a core cryptographic function library currently used by Windows. The flaw could be exploited by malicious programs trigger a denial of service condition by interrupting the encryption service for other programs. Pierluigi Paganini.

Security 63

Security Authentication Libraries Encryption 63

Security Affairs

NOVEMBER 11, 2018

Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain. Apache Struts users have to update FileUpload library to fix years-old flaws. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. High severity XML external entity flaw affects Sauter building automation product.

Security 62

Security IoT Insurance Libraries 62

Security Affairs

AUGUST 25, 2019

A backdoor mechanism found in tens of Ruby libraries. million to allow towns to access encrypted data. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Malware Analysis Sandboxes could expose sensitive data of your organization. 5 Ways to Protect Yourself from IP Address Hacking. Pierluigi Paganini.

Security 50

Security Mining Data breaches Libraries 50

Security Affairs

MAY 5, 2020

Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Recently other IoT botnets made the headlines, such as including Hoaxcalls , Mukashi , and dark_nexus. Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS [link]. Pierluigi Paganini.

IoT 126

IoT Libraries IT Security 126

Security Affairs

JANUARY 29, 2019

Then, all the information is encoded in Base64 and sent to the C2 through the “ connect ” function, using a SSL encrypted HTTP channel. This last code snippet is likely borrowed from a publicly available AutoIT library script called “ CompInfo.au3 ”: an AutoIt interface to access the Windows Management Instrumentation framework’s data.

Communications 80

Communications Libraries Encryption Security 80

Security Affairs

NOVEMBER 1, 2019

The vulnerabilities, tracked as CVE-2019-13720 and CVE-2019-13721, reside respectively in Chrome’s audio component and in the PDFium library. “[$7500][ 1013868 ] High CVE-2019-13721: Use-after-free in PDFium. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Libraries 54

Libraries Encryption Security IT 54

JKevinParker

MARCH 2, 2015

So I checked out the latest Office 365 service comparison page on TechNet (updated 1/28/2015 at the time of this post). Feature Differences in Office 365 Plans (January 2015). Features (Updated 1/28/2015) Office 365 Business Premium Office 365 Enterprise E1 Office 365 Enterprise E3. Data Connection Library No No Yes.

Archiving 40

Archiving Libraries Encryption Compliance 40

Security Affairs

AUGUST 22, 2018

This dynamic-link library (DLL) is responsible for decrypting the encrypted rcview.log file and executing it in memory. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. . “The program will then execute rcview40u.dll, signed with the stolen certificate, with Microsoft register server (regsvr32.exe).

Passwords 43

Passwords Libraries Encryption Access 43

Security Affairs

DECEMBER 20, 2018

The malware tries to connect to the remote host 149.154.157.104 (EDIS-IT IT) through an encrypted SSL channel, then it downloads other components and deletes itself from the filesystem. These registry keys are responsible of the loading of dynamically linked libraries in the “read only ” and “ hidden ” “ C:ProgramDataD93C2DAC ”.

Libraries 73

Libraries Phishing Encryption Authentication 73

Security Affairs

FEBRUARY 21, 2020

The two dll are legit windows library and are used in support of the malicious behaviour. This executable has got a sophisticated encryption method of communication with the C2: Figure 13: Evidence of the decrypting routine of the certificate. The downloaded code has been encrypted through the Rijndael algorithm with a hard-coded key.

Military 113

Military Communications Encryption IT 113

Security Affairs

SEPTEMBER 20, 2019

Before passing the control to the “ swety.dll ” library, which is a sort of helper component with no particular scope except the identification of analysis environments, the first instructions executed here are designed to decode and load a byte array embedded inside the executable, unpacking the obfuscated code. Load()” method.

Libraries 80

Libraries Passwords IT Phishing 80

Elie

MARCH 10, 2018

This APK embedded a secondary hidden/encrypted payload. Play Store app module : This is an injected library that allows the malware to issue commands to the Play store through the Play store app. that emerged in March 2015 and was discovered by Check Point in July of the same year. SnapPea adware.

Libraries 107

Libraries Access Encryption IT 107

Security Affairs

AUGUST 23, 2018

This is a binary blob with a special format that contains encrypted commands for the backdoor ,” reads the report released by ESET. The backdoor is a standalone DLL (dynamic link library) that interacts with Outlook and The Bat! Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Metadata 45

Metadata Military Libraries Access 45