article thumbnail

New Linux Ransomware BlackSuit is similar to Royal ransomware

Security Affairs

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. ReadMe file name: README.BlackSuit.txt. ” reads the analysis published by TrendMicro.

article thumbnail

WinRAR CVE-2018-20250 flaw exploited in multiple campaigns

Security Affairs

This campaign was carried out by threat actors impersonating an educational accreditation council to hit users in the United States. The attackers used decoy documents apparently coming from the Council on Social Work Education (CSWE), a US association representing social work education. ” continues the analysis.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

ToxicEye RAT exploits Telegram communications to steal data from victims

Security Affairs

” reads the analysis published by CheckPoint. “The bot is embedded into the ToxicEye RAT configuration file and compiled into an executable file (an example of a file name we found was ‘paypal checker by saint.exe’). ” concludes the report.

article thumbnail

Experts warn of fake Adobe Flash update hiding a miner that works as a legitimate update

Security Affairs

” reads the analysis published by Palo Alto Networks. ” The fake Adobe Flash updates use file names starting with AdobeFlashPlayer that are hosted on cloud-based web servers that don’t belong to Adobe. Network traffic analysis revealed the infected Windows hosts connect to [osdsoft[.]com]

article thumbnail

Crooks target Healthcare facilities involved in Coronavirus containment with Ransomware

Security Affairs

” reads the analysis published by PaloAlto Networks. “The emails all contained a malicious Rich Text Format (RTF) phishing lure with the file name 20200323- sitrep -63- covid -19. ” continues the analysis. int (actual sender IP address at the time of the attack was 176.223.133 [. ]

article thumbnail

Shade Ransomware is very active outside of Russia and targets more English-speaking victims

Security Affairs

.” reads the analysis published by Paloalto Networks. Moth of the victims belongs to high-tech, wholesale and education sectors. The ransomware also drops on the Desktop 10 text files, named README1.txt All the important files on your disks were encrypted. txt through README10.txt, txt, “Attention!

article thumbnail

Production is the “Ringo” of the eDiscovery Phases: eDiscovery Throwback Thursdays

eDiscovery Daily

Processing, Review and Analysis). paper, images or native files); Organization of files (e.g., Two issues with that approach: 1) The proposed format only addressed emails, and 2) Windows file names don’t support certain characters, such as colons (:) or slashes (/). organized by custodian, legal issue, etc.);