Remove 2019 Remove Analysis Remove Encryption Remove Manufacturing
article thumbnail

Researchers Quietly Cracked Zeppelin Ransomware Keys

Krebs on Security

Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. He’d been on the job less than six months, and because of the way his predecessor architected things, the company’s data backups also were encrypted by Zeppelin. ” they wrote.

article thumbnail

8Base ransomware operators use a new variant of the Phobos ransomware

Security Affairs

Phobos variants are usually distributed by the SmokeLoader , but in 8Base campaigns, it has the ransomware component embedded in its encrypted payloads. The group has been active since March 2022, it focused on small and medium-size businesses in multiple industries, including finance, manufacturing, business services, and IT.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

A new wave of ech0raix ransomware attacks targets QNAP NAS devices

Security Affairs

According to BleepingComputer , forum users reported an intensification of the attacks since December 20, the analysis of submissions to the ID ransomware service for this specific threat started to increase on December 19 and reached a peak on December 20. The malicious code appends.encrypt extension to filenames of encrypted files.

article thumbnail

GreyEnergy: Welcome to 2019

Security Affairs

Technical analysis. In order to investigate the attribution of the sample, Cybaze-Yoroi Zlab researchers performed a comparative analysis of the January 2019’s sample with respect to technical indicators and TTP published in previous articles. Figure 5 – GreyEnergy invokes sleep API to evade analysis. Conclusion.

article thumbnail

Lazarus APT uses DTrack backdoor in attacks against LATAM and European orgs

Security Affairs

DTrack is a modular backdoor used by the Lazarus group since 2019 , it was employed in attacks against a wide variety of targets, from financial environments to a nuclear power plan. The second stage payload is a heavily obfuscated shellcode, the APT group used an encryption method different for each sample.

article thumbnail

China-linked APT41 group targets Hong Kong with Spyder Loader

Security Affairs

The Operation CuckooBees had been operating under the radar since at least 2019, threat actors conducted multiple attacks to steal intellectual property and other sensitive data from victims. The attacks detailed by Cybereason targeted technology and manufacturing companies primarily located in East Asia, Western Europe, and North America.

article thumbnail

P2P Weakness Exposes Millions of IoT Devices

Krebs on Security

But according to an in-depth analysis shared with KrebsOnSecurity by security researcher Paul Marrapese , iLnkP2P devices offer no authentication or encryption and can be easily enumerated, allowing potential attackers to establish a direct connection to these devices while bypassing any firewall restrictions.

IoT 262