article thumbnail

MY TAKE: The no. 1 reason ransomware attacks persist: companies overlook ‘unstructured data’

The Last Watchdog

One reason for the enduring waves of ransomware is that unstructured data is easy for hackers to locate and simple for them to encrypt. I talked with Jonathan Sander, Chief Technology Officer with STEALTHbits Technologies , about this at Black Hat USA 2018. Ransomware “is encrypting files, unstructured data.” Ransomware target.

article thumbnail

APT hacked a US municipal government via an unpatched Fortinet VPN

Security Affairs

The threat actors are actively exploiting the following vulnerabilities in Fortinet FortiOS: CVE-2018-13379 ; CVE-2020-12812 ; CVE-2019-5591. In April, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) previously warned of attacks carried out by APT groups targeting Fortinet FortiOS servers using multiple exploits.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

MyKings botnet operators already amassed at least $24 million

Security Affairs

” The malware was first spotted in February 2018 by researchers from Proofpoint when the bot was using the EternalBlue exploit to infect Windows computers and recruit them in Monero cryptocurrency mining activities. Encryption used is a very simple ROT cipher, where the key is set to -1.”

ROT 103
article thumbnail

Weekly podcast: 2018 end-of-year roundup

IT Governance

Hello and welcome to the final IT Governance podcast of 2018. that the crooks were only able to mine a paltry $24 – which Coinhive refused to pay out anyway. Equifax issued its financial report for the first quarter of 2018, revealing that its huge 2017 data breach had so far cost it $242.7 million account holders.

article thumbnail

New Go malware Capoae uses multiple flaws to target WordPress installs, Linux systems

Security Affairs

CVE-2020-14882 Oracle WebLogic Server RCE, and CVE-2018-20062 ThinkPHP RCE) and targeting sites and systems protected with weak administrative credentials. Upon infecting a system, the malware abuses its resources to mine cryptocurrency. . The malware spread through attacks exploiting known vulnerabilities (i.e.

article thumbnail

Ezuri memory loader used in Linux and Windows malware

Security Affairs

“The loader decrypts the malicious malware and executes it using memfd create (as described in this blog in 2018). Upon executing the code, it will ask the user the path for the payload to be encrypted and the password to be used for AES encryption to hide the malware within the loader.

article thumbnail

Microsoft warns of Dexphot miner, an interesting polymorphic threat

Security Affairs

Security experts at Microsoft analyzed a new strain of cryptocurrency miner tracked as Dexphot that has been active since at least October 2018. The malicious code abuse of the resources of the infected machine to mine cryptocurrency , according to the experts it has already infected 80,000 computers worldwide.