Security Affairs

SEPTEMBER 23, 2020

Researchers from threat hunting and intelligence firm Group-IB have detected a successful attack by a ransomware gang tracked as OldGremlin. Group-IB , a global threat hunting and intelligence company headquartered in Singapore, has detected a successful attack by a ransomware gang, codenamed OldGremlin. Unsought invoice.

Ransomware 107

Ransomware Phishing Encryption Authentication 107

Security Affairs

SEPTEMBER 21, 2021

Russia-linked cyber espionage group Turla made the headlines again, the APT has employed a new backdoor in a recent wave of attacks. Cisco Talos researchers reported that the Russia-linked Turla APT group recently used a new backdoor, dubbed TinyTurla, in a series of attacks against the US, Germany, and Afghanistan. Pierluigi Paganini.

Military 90

Military Government Encryption Access 90

Security Affairs

SEPTEMBER 19, 2023

Researchers from Trend Micro, while monitoring the activity of the China-linked threat actor Earth Lusca , discovered an encrypted file hosted on a server under the control of the group. Additional analysis led to the discovery of a previously unknown Linux backdoor tracked as SprySOCKS. ” continues the report.

IT 109

IT Encryption Authentication Communications 109

Security Affairs

JULY 15, 2022

The Microsoft Threat Intelligence Center (MSTIC) researchers linked the activity of the Holy Ghost ransomware (H0lyGh0st) operation to a North Korea-linked group they tracked as DEV-0530. MSTIC linked DEV-0530 to another North Korean-based group tracked as PLUTONIUM (aka DarkSeoul or Andariel ). ” concludes Microsoft.

Ransomware 136

Ransomware Encryption Government Manufacturing 136

Security Affairs

NOVEMBER 24, 2022

RansomExx operation has been active since 2018, the list of its victims includes government agencies, the computer manufacturer and distributor GIGABYTE , and the Italian luxury brand Zegna. ” reads the analysis published by IBM Security X-Force. ” concludes the report. Pierluigi Paganini.

Ransomware 99

Ransomware Encryption Manufacturing Government 99

Security Affairs

MARCH 13, 2023

In February 2023, EclecticIQ researchers spotted multiple KamiKakaBot malware samples that were employed by the Dark Pink APT group (aka Saaiwc) in attacks against government entities in Southeast Asia countries. “The ISO file also contains a decoy Word document that has an XOR-encrypted section.

Phishing 86

Phishing Encryption Military Government 86

Security Affairs

APRIL 3, 2019

The OceanLotus APT group, also known as APT32 or Cobalt Kitty , leverages a steganography-based loader to deliver backdoors on compromised systems. The APT32 group, also known as OceanLotus Group, has been active since at least 2013, according to the experts it is a state-sponsored hacking group.

Libraries 79

Libraries Encryption Communications Manufacturing 79

Data Matters

FEBRUARY 21, 2018

After supporters and opponents of mandated government access to encrypted communications publicly feuded for much of 2016, reprising arguments they’ve had since at least the days of the “Clipper Chip,” these “encryption debates” seemed to quiet down for much of last year. See, e.g., here.)

Encryption 60

Encryption Government Access Privacy 60

Security Affairs

NOVEMBER 28, 2022

The ransomware is written in.NET and experts noticed that deployment is similar to previous attacks attributed to the Russia-linked Sandworm APT group. The group is also the author of the NotPetya ransomware that hit hundreds of companies worldwide in June 2017, causing billions worth of damage.

Ransomware 124

Ransomware IT Encryption Government 124

Security Affairs

DECEMBER 7, 2019

Russia-linked Gamaredon cyberespionage group has been targeting Ukrainian targets, including diplomats, government and military officials. Russia linked APT group tracked as Gamaredon has been targeting several Ukrainian diplomats, government and military officials, and law enforcement. The Gamaredon group.

Military 61

Military Government Phishing Archiving 61

Security Affairs

MAY 15, 2023

The Lancefly APT group is using a custom powerful backdoor called Merdoor in attacks against organizations in South and Southeast Asia. Symantec researchers reported that the Lancefly APT group is using a custom-written backdoor in attacks targeting organizations in South and Southeast Asia, as part of a long-running campaign.

Encryption 91

Encryption Phishing Communications Education 91

Security Affairs

JANUARY 31, 2021

Members of the Great Firewall Report group have analyzed the recent improvement implemented for China’s Great Firewall censorship system and revealed that it is possible to bypass it. Shadowsocks is a free and open-source encryption protocol project, widely used in China to circumvent Internet censorship.

Paper 137

Paper Encryption Government IT 137

Security Affairs

SEPTEMBER 23, 2023

MILES/CBS NEWS TEXAS The Royal ransomware group is behind the attack and threatens to publish stolen data if the City will not meet its ransom demand. Once obtained access to the City’s network, the group performed reconnaissance and information-gathering activities using legitimate third-party remote management tools.

Ransomware 112

Ransomware Encryption Systems administration Cybersecurity 112

Security Affairs

AUGUST 7, 2019

Security researcher Marco Ramilli presents a comparative analysis of attacks techniques adopted by the Iran-Linked OilRig APT group. Today I’d like to share a comparative analysis of OilRig techniques mutation over time. I would define this group of references as reports. and more personal thoughts.

e-Delivery 83

e-Delivery Computer and Electronics Phishing Communications 83

Security Affairs

JULY 7, 2019

Croatia government agencies have been targeted by unknown hackers with a new piece of malware tracked as SilentTrinity. A mysterious group of hackers carried out a series of cyber attacks against Croatian government agencies, infecting employees with a new piece of malware tracked as SilentTrinity. Pierluigi Paganini.

Government 87

Government Computer and Electronics Archiving Phishing 87

Security Affairs

JUNE 3, 2023

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. ” reads the analysis published by TrendMicro. BlackSuit appends the . similarities in blocks, and 98.9%

Ransomware 98

Ransomware Encryption File names Cybersecurity 98

Security Affairs

JULY 3, 2023

China-linked APT group was spotted using HTML smuggling in attacks aimed at Foreign Affairs ministries and embassies in Europe. A China-linked APT group was observed using HTML smuggling in attacks against Foreign Affairs ministries and embassies in Europe, reports the cybersecurity firm Check Point. and Ukraine.

Encryption 95

Encryption Phishing Government Cybersecurity 95

Security Affairs

JULY 17, 2019

Kaspersky researchers revealed that since earlier this year, Russia-linked APT group Turla used new variants of the KopiLuwak Trojan in targeted attacks. Security experts at Kaspersky revealed that the Russia-linked APT group Turla used new variants of the KopiLuwak Trojan in targeted attacks since early 2019. Pierluigi Paganini.

IT 71

IT Encryption Security Government 71

Security Affairs

AUGUST 7, 2022

Researchers spotted a new family of ransomware, named GwisinLocker, that encrypts Windows and Linux ESXi servers. Researchers warn of a new ransomware called GwisinLocker which is able to encrypt Windows and Linux ESXi servers. Pierluigi Paganini. SecurityAffairs – hacking, GwisinLocker ransomware).

Ransomware 108

Ransomware Healthcare Encryption IT 108

Security Affairs

FEBRUARY 8, 2023

Researchers from Broadcom Symantec spotted a Russia-linked ATP group, tracked as Nodaria (aka UAC-0056), deploying new info-stealing malware, dubbed Graphiron, in attacks against Ukraine. Upon execution, the downloader will check against a blacklist of malware analysis tools by checking for running processes’ specific names (i.e.

File names 89

File names Passwords Phishing Encryption 89

Security Affairs

NOVEMBER 9, 2019

Kaspersky researchers have found a new advanced backdoor used by the Platinum advanced persistent threat (APT) group in attacks in the wild. The APT group was discovered by Microsoft in 2016, it targeted organizations in South and Southeast. ” reads the analysis publisjed by Kaspersky. ” continues the analys i s.

IT 51

IT Archiving Encryption Passwords 51

Security Affairs

AUGUST 28, 2019

Recent campaigns show t hreat actors behind the Dridex and Locky malware families , the TA505 group, have updated tactics and expanded its target list. Trend Micro revealed that the TA505 group that is behind the Dridex and Locky malware families continue to make small changes to its operations. ” continues the report.

e-Delivery 74

e-Delivery Insurance Retail Government 74

Security Affairs

MAY 23, 2023

On March 2023, researchers from Kaspersky spotted a previously unknown APT group, tracked as Bad Magic (aka Red Stinger), that targeted organizations in the region of the Russo-Ukrainian conflict. The APT group targeted individuals, as well as diplomatic and research organizations in the area of the conflict.

Communications 87

Communications Agriculture Cloud Archiving 87

Security Affairs

APRIL 23, 2022

The analysis of encryption techniques employed in the attack allowed the government experts to associate the campaign with the cybercrime group Trickbot.

Phishing 95

Phishing Military Ransomware Encryption 95

Security Affairs

SEPTEMBER 13, 2022

A cyber espionage group targets governments and state-owned organizations in multiple Asian countries since early 2021. Threat actors are targeting government and state-owned organizations in multiple Asian countries as parts of a cyber espionage campaign that remained under the radar since early 2021.

Government 94

Government Access Libraries Education 94

Security Affairs

MARCH 18, 2023

The US government released a joint advisory that provides technical details about the operation of the Lockbit 3.0 “The Federal Bureau of Investigation (FBI), CISA, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) has released a joint cybersecurity advisory (CSA), #StopRansomware: LockBit 3.0. ransomware.

Ransomware 90

Ransomware Encryption Passwords Cybersecurity 90

Security Affairs

JANUARY 16, 2022

Microsoft spotted a new destructive malware operation targeting government, non-profit, and IT entities in Ukraine. Microsoft spotted a destructive attack that targeted government, non-profit, and IT entities in Ukraine with a wiper disguised as ransomware. Virtually all ransomware encrypts the contents of files on the filesystem.

Ransomware 109

Ransomware Government Encryption Communications 109

Security Affairs

JUNE 6, 2019

The Platinum cyber espionage group uses steganographic technique to hide communications with the Command and Control Servers (C&C). Experts from Kaspersky have linked the Platinum APT group with cyber attacks involving an elaborate, and new steganographic technique used to hide communications with C2 servers.

Communications 73

Communications Encryption Military Government 73

Security Affairs

SEPTEMBER 27, 2020

Finisher, aka FinFisher, is a multiplatform surveillance software used by government and law enforcement agencies for their investigations, but unfortunately, it made the headlines because it was also used by oppressive regimes to spy on dissidents, activists, and Journalists. ” continues the analysis.

Encryption 138

Encryption Communications IT Government 138

Security Affairs

FEBRUARY 23, 2022

The forensic analysis conducted by researchers revealed the presence of multiple instances of the general-purpose Dridex malware which was also used to distribute other malware. In a first stage it allocates the memory space where to copy the encrypted data and whose content is executed by the packer. ” continues the report.

Ransomware 102

Ransomware Encryption IT Government 102

Security Affairs

JULY 4, 2019

In October, Kaspersky revealed that the CVE-2018-8453 vulnerability has been exploited by the APT group tracked as FruityArmor , a cyber-espionage group that was first observed in 2016 while targeting activists, researchers, and individuals related to government organizations. ” continues the analysis.

Ransomware 83

Ransomware Encryption Government IT 83

Security Affairs

MARCH 17, 2021

Back in December, the SolarWinds supply chain attack made the headlines when a Russian cyber espionage group tampered with updates for SolarWinds’ Orion Network Management products that the IT company provides to government agencies, military, and intelligence offices. ” reads the incident report published by mimecast.

Encryption 105

Encryption Military Access Archiving 105

Security Affairs

NOVEMBER 21, 2019

The new DePriMon downloader was used by the Lambert APT group, aka Longhorn, to deploy malware. According to a report published by Symantec in 2017, Longhorn is a North American hacking group that has been active since at least 2011. The second stage installs itself and loads the third stage using an encrypted, hardcoded path.

Communications 106

Communications Encryption Education Authentication 106

The Last Watchdog

JUNE 21, 2020

Related: What local government can do to repel ransomware Ransomware came into existence in 1989 as a primitive program dubbed the AIDS Trojan that was spreading via 5.25-inch Although most people think of ransomware as a dodgy application that encrypts data and holds it for ransom, the concept is much more heterogeneous than that.

Ransomware 204

Ransomware Encryption Privacy Security awareness 204

Security Affairs

FEBRUARY 13, 2022

The analysis of the ransomware revealed that it was developed to avoid infecting systems that primarily use Russian or related languages. Unlike other ransomware that may have a unique key in each session, that version of BlackByte was using the same raw key to encrypt files and it uses the symmetric-key algorithm AES.

Ransomware 87

Ransomware Agriculture Encryption Cybersecurity 87

Security Affairs

JUNE 26, 2022

Researchers from Secureworks reported that a China-linked APT group, tracked as Bronze Starlight (APT10), is deploying post-intrusion ransomware families to cover up the cyber espionage operations. The HUI Loader is used to decrypt and load a third file containing an encrypted payload that is also deployed to the infected host.

Ransomware 91

Ransomware Healthcare Manufacturing Encryption 91

Security Affairs

OCTOBER 19, 2021

Symantec spotted a previously unknown nation-state actor, tracked as Harvester, that is using a custom implant, dubbed Backdoor.Graphon, in attacks aimed at telecommunication providers, IT firms, and government entities in South Asia. At this time, the APT group is mostly targeting organizations in Afghanistan.

Archiving 103

Archiving Encryption Passwords Government 103