article thumbnail

China-linked Alloy Taurus APT uses a Linux variant of PingPull malware

Security Affairs

On March 7, 2023, the researchers found a Linux variant of the PingPull that was uploaded to VirusTotal, it had a very low detection rate (3 out of 62) “Despite a largely benign verdict, additional analysis has determined that this sample is a Linux variant of PingPull malware. ” reads the analysis published by Unit 42.

article thumbnail

China-linked APT Curious Gorge targeted Russian govt agencies

Security Affairs

China-linked Curious Gorge APT is targeting Russian government agencies, Google Threat Analysis Group (TAG) warns. Google Threat Analysis Group (TAG) reported that an APT group linked to China’s People’s Liberation Army Strategic Support Force (PLA SSF), tracked as Curious Gorge , is targeting Russian government agencies.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Experts warn of mass exploitation of Ivanti Connect Secure VPN flaws

Security Affairs

reads the analysis published by Volexity.” reads the analysis published by Volexity. Through forensic analysis of the memory sample, Volexity was able to recreate two proof-of-concept exploits that allowed full unauthenticated command execution on the ICS VPN appliance. ” reads the update provided by Volexity.

article thumbnail

Analyzing attacks conducted by North Korea-linked ARCHIPELAGO APT group

Security Affairs

Google’s Threat Analysis Group (TAG) warns of a North Korea-linked cyberespionage group tracked as ARCHIPELAGO. ” reads the analysis published by Google TAG. In one case, the group posed as a journalist for a South Korean news agency and sent benign emails with an interview request to North Korea experts.”

article thumbnail

Phishing attacks using the topic “Azovstal” targets entities in Ukraine

Security Affairs

The analysis of encryption techniques employed in the attack allowed the government experts to associate the campaign with the cybercrime group Trickbot. The alert published by the Ukraine CERT-UA includes Indicators of Compromise (IoCs) for this campaign and recommendations. To nominate, please visit:? Pierluigi Paganini.

article thumbnail

Iran-linked Lyceum APT adds a new.NET DNS Backdoor to its arsenal

Security Affairs

” reads the analysis published ZScaler. The attack chain observed by the researchers starts with spear-phishing messages using weaponized Word document disguised as a news report related to military affairs in Iran. ” APT groups continue to evolve their TTPs and embrace new anti-analysis and anti-evasion techniques.

IT 144
article thumbnail

Google TAG warns of Russia-linked APT groups targeting Ukraine

Security Affairs

Russia-linked threat actors launched large-volume phishing campaigns against hundreds of users in Ukraine to gather intelligence and aimed at spreading disinformation, states Google’s Threat Analysis Group (TAG). ” reads the report published by the Google TAG.