Security Affairs

JUNE 26, 2023

China-linked APT group VANGUARD PANDA, aka Volt Typhoon, was spotted observing a novel tradecraft to gain initial access to target networks. CrowdStrike researchers observed the China-linked APT group VANGUARD PANDA, aka Volt Typhoon , using a novel tradecraft to gain initial access to target networks. ” concludes the report.

Cleanup 89

Cleanup Libraries Access Manufacturing 89

Security Affairs

NOVEMBER 1, 2021

Meet Balikbayan Foxes: a threat group impersonating the Philippine gov’t. The group focuses on Shipping/Logistics, Manufacturing, Business Services, Pharmaceutical, and Energy entities, among others. Victims of the group are located in North America, Europe, and Southeast Asia. . ” concludes the report.

Healthcare 101

Healthcare Phishing Manufacturing Government 101

Security Affairs

MAY 22, 2020

ZLab researchers spotted a new malicious espionage activity targeting Italian companies operating worldwide in the manufacturing sector. The group behind this activity is the same we identified in the past malicious operations described in Roma225 (12/2018), Hagga (08/2019), Mana (09/2019), YAKKA (01/2020). Technical Analysis.

Manufacturing 138

Manufacturing e-Delivery IT Security 138

eSecurity Planet

SEPTEMBER 16, 2021

During the two-month investigation, McAfee researchers were able to narrow down the list of suspects to two advanced persistent threat (APT) nation-state groups that have links to China. Chinese-Linked APT Groups Likely Suspects. PlugX, Winnti and some other custom tools all point to a group that had access to the same tools.

Military 145

Military Access Manufacturing Phishing 145

Security Affairs

FEBRUARY 3, 2022

A China-linked APT group tracked as Antlion used a custom backdoor called xPack that was undetected for months. A China-linked APT group tracked as Antlion is using a custom backdoor called xPack in attacks aimed at financial organizations and manufacturing companies, Symantec researchers reported. Pierluigi Paganini.

Manufacturing 96

Manufacturing Data collection Encryption Passwords 96

Info Source

MAY 3, 2023

The reason for this situation, is due to the CAD segment being a pure import market, dominated by multinational companies and with no cheaper alternatives either from local producers or from Chinese manufacturers. Indeed, the overall Turkish CAD market has followed a long-term downward trend, falling from 1.7K units in 2014 to 0.5K

Marketing 52

Marketing Sales Manufacturing Paper 52

Security Affairs

SEPTEMBER 23, 2020

Researchers from threat hunting and intelligence firm Group-IB have detected a successful attack by a ransomware gang tracked as OldGremlin. Group-IB , a global threat hunting and intelligence company headquartered in Singapore, has detected a successful attack by a ransomware gang, codenamed OldGremlin. Unsought invoice.

Ransomware 109

Ransomware Phishing Encryption Authentication 109

Security Affairs

NOVEMBER 15, 2023

The FBI and CISA warn of attacks carried out by the Rhysida ransomware group against organizations across multiple industry sectors. The report is part of the ongoing #StopRansomware effort that disseminates advisories about tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with ransomware groups.

Ransomware 122

Ransomware Manufacturing Education Passwords 122

Security Affairs

OCTOBER 4, 2023

Google Threat Analysis Group and Google Project Zero first reported that the CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 are actively exploited in targeted attacks. Please contact your device manufacturer for more information on the patch status about specific devices.” ” reads the advisory.

Authentication 109

Authentication Manufacturing Security Information Security 109

Security Affairs

MAY 3, 2022

China-linked Curious Gorge APT is targeting Russian government agencies, Google Threat Analysis Group (TAG) warns. Google Threat Analysis Group (TAG) reported that an APT group linked to China’s People’s Liberation Army Strategic Support Force (PLA SSF), tracked as Curious Gorge , is targeting Russian government agencies.

Manufacturing 120

Manufacturing Phishing Passwords Military 120

IBM Big Data Hub

JUNE 20, 2023

According to Warranty Week , claims totaling 46 billion USD were paid by the global automotive Original Equipment Manufacturers in 2021. avoiding warranty issues through simulation), manufacturing (e.g., detecting and preventing failures through sensor data analysis) and after sales (e.g.,

Manufacturing 96

Manufacturing Sales IoT Analytics 96

Security Affairs

DECEMBER 12, 2023

North Korea-linked APT group Lazarus was spotted exploiting Log4j vulnerabilities to deploy previously undocumented remote access trojans. The North Korea-linked APT group Lazarus is behind a new hacking campaign that exploits Log4j vulnerabilities to deploy previously undocumented remote access trojans (RATs).

Agriculture 111

Agriculture Data collection Access Manufacturing 111

Krebs on Security

NOVEMBER 17, 2022

Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. There are multiple examples of ransomware groups doing just that after security researchers crowed about finding vulnerabilities in their ransomware code. ” they wrote.

Ransomware 310

Ransomware Encryption Manufacturing Phishing 310

Security Affairs

NOVEMBER 19, 2023

In June, VMware Carbon Black researchers observed an intensification of the activity associated with a stealthy ransomware group named 8Base. The group has been active since March 2022, it focused on small and medium-size businesses in multiple industries, including finance, manufacturing, business services, and IT. and Brazil.

Ransomware 130

Ransomware Encryption Metadata Manufacturing 130

Security Affairs

OCTOBER 19, 2023

The Europen Agency for cybersecurity ENISA releases its ENISA Threat Landscape 2023 (ETL) report , which is the annual analysis of the state of the cybersecurity threat landscape. It identifies the top threats, major trends observed with respect to threats, threat actors and attack techniques, as well as impact and motivation analysis.

Artificial Intelligence 120

Artificial Intelligence Ransomware Cybersecurity Manufacturing 120

Security Affairs

MARCH 5, 2019

A cyber-espionage group, tracked as APT40, apparently linked to the Chinese government is focused on targeting countries important to the country’s Belt and Road Initiative. The cyber-espionage group tracked as APT40 (aka TEMP. ” reads the analysis published by FireEye. ” continues the analysis. .

Phishing 87

Phishing Passwords Manufacturing Government 87

Security Affairs

DECEMBER 1, 2023

The Black Basta ransomware group has been active since April 2022, like other ransomware operations, it implements a double-extortion attack model. A joint research by Elliptic and Corvus Insurance revealed that the group accumulated at least $107 million in Bitcoin ransom payments since early 2022. The average ransom payment was $1.2

Ransomware 95

Ransomware Blockchain Retail Insurance 95

Security Affairs

JUNE 28, 2023

Researchers warn of a massive spike in May and June 2023 of the activity associated with the ransomware group named 8Base. VMware Carbon Black researchers observed an intensification of the activity associated with a stealthy ransomware group named 8Base. The 8BASE group claims to be composed of honest pentesters. “We

Ransomware 95

Ransomware Encryption Manufacturing Business Services 95

IT Governance

FEBRUARY 14, 2024

At the end of each month, these incidents – and any others that we find – will be used to inform our monthly analysis of data breaches and cyber attacks. TB JP Original Corp Source New Manufacturing USA Yes 1.2 TB JP Original Corp Source New Manufacturing USA Yes 1.2 TB JP Original Corp Source New Manufacturing USA Yes 1.2

Data Privacy 52

Data Privacy Manufacturing Privacy Security 52

Security Affairs

APRIL 3, 2019

The OceanLotus APT group, also known as APT32 or Cobalt Kitty , leverages a steganography-based loader to deliver backdoors on compromised systems. The APT32 group, also known as OceanLotus Group, has been active since at least 2013, according to the experts it is a state-sponsored hacking group.

Libraries 81

Libraries Encryption Communications Manufacturing 81

Security Affairs

JUNE 15, 2020

The Earth Empusa threat group is distributing new Android spyware, dubbed ActionSpy, through watering hole attacks to targets Turkic minority group. ” continues the analysis. The post Earth Empusa targets minority group with Android ActionSpy spyware appeared first on Security Affairs. Pierluigi Paganini.

Phishing 70

Phishing Encryption Manufacturing Access 70

The Last Watchdog

AUGUST 26, 2019

The state-sponsored hacking groups are still in business. And not just of power plants and utilities, but also in the firmware and software that run manufacturing plants of all types and sizes, Carcano told me.

Artificial Intelligence 158

Artificial Intelligence Cybersecurity Manufacturing Security 158

Security Affairs

SEPTEMBER 2, 2022

Researchers attribute the Raspberry Robin malware to the Russian cybercrime group known as Evil Corp group. The malware was first spotted on September 2021, the experts observed it targeting organizations in the technology and manufacturing industries. The malware uses TOR exit nodes as a backup C2 infrastructure.

Security awareness 112

Security awareness Manufacturing Ransomware Cybersecurity 112

Security Affairs

MARCH 26, 2021

Accenture security researchers published an analysis of the latest Hades campaign, which is ongoing since at least December 2020. . Experts discovered that threat actors targeted a large US transportation & logistics organization, a large US consumer products organization, and a global manufacturing organization.

Ransomware 144

Ransomware Encryption File names Manufacturing 144

Security Affairs

AUGUST 7, 2023

Two North Korea-linked APT groups compromised the infrastructure of the major Russian missile engineering firm NPO Mashinostroyeniya. Cybersecurity firm SentinelOne linked the compromise of the major Russian missile engineering firm NPO Mashinostroyeniya to two different North Korea-linked APT groups.

Military 94

Military Communications Manufacturing Phishing 94

Security Affairs

NOVEMBER 16, 2022

DTrack is a modular backdoor used by the Lazarus group since 2019 , it was employed in attacks against a wide variety of targets, from financial environments to a nuclear power plan. The second stage payload is a heavily obfuscated shellcode, the APT group used an encryption method different for each sample.

Manufacturing 130

Manufacturing Education Encryption IT 130

Security Affairs

OCTOBER 1, 2022

A cyberespionage group, tracked as Witchetty, used steganography to hide a previously undocumented backdoor in a Windows logo. The group used the backdoor in attacks against Middle Eastern governments. The group used the backdoor in attacks against Middle Eastern governments. ” the researchers concluded.

Manufacturing 121

Manufacturing Government Cybersecurity IT 121

IT Governance

MAY 7, 2024

At the end of each month, these incidents – and any others that we find – will be used to inform our monthly analysis of data breaches and cyber attacks. Source (New) IT services USA Yes 1,382 Worthen Industries Source 1 ; source 2 (Update) Manufacturing USA Yes 1,277 R.J. Source (New) Manufacturing USA Yes Unknown Human Events.

Data breaches 59

Data breaches Education Manufacturing Retail 59

IT Governance

FEBRUARY 21, 2024

At the end of each month, these incidents – and any others that we find – will be used to inform our monthly analysis of data breaches and cyber attacks. Source New Manufacturing USA Yes 20,415 TECA Srl Source New Transport Italy Yes 16.7 GB AGC Flat Glass North America, Inc.

Data Privacy 52

Data Privacy Manufacturing Privacy Energy and Utilities 52

Security Affairs

DECEMBER 19, 2022

The Qilin ransomware-as-a-service (RaaS) group uses a double-extortion model, with most of the victims in the manufacturing and IT industries. ” reads the analysis published by Trend Micro. ” reads the analysis published by Trend Micro. ” continues the analysis. AGENDA.THIAFBB.”

Ransomware 132

Ransomware Encryption Passwords Education 132

Security Affairs

JULY 15, 2022

The Microsoft Threat Intelligence Center (MSTIC) researchers linked the activity of the Holy Ghost ransomware (H0lyGh0st) operation to a North Korea-linked group they tracked as DEV-0530. The list of victims includes manufacturing organizations, banks, schools, and event and meeting planning companies.

Ransomware 138

Ransomware Encryption Government Manufacturing 138

Security Affairs

MAY 5, 2021

The group targeted the organization with phishing attacks aimed at spreading at least three new sophisticated malware strains. FireEye’s Mandiant unit observed two distinct waves of attacks carried out by the cybercrime group in December 2020. ” states the analysis published by FireEye.

Manufacturing 110

Manufacturing Phishing Military Retail 110

Security Affairs

NOVEMBER 24, 2022

RansomExx operation has been active since 2018, the list of its victims includes government agencies, the computer manufacturer and distributor GIGABYTE , and the Italian luxury brand Zegna. ” reads the analysis published by IBM Security X-Force. ” Follow me on Twitter: @securityaffairs and Facebook and Mastodon.

Ransomware 99

Ransomware Encryption Manufacturing Government 99

Security Affairs

MARCH 27, 2020

Researchers at Group-IB observed new financially motivated attacks in Western Europe traced to Russian-speaking threat actors. At least two companies operating in pharmaceutical and manufacturing sectors have been affected. At least two companies operating in pharmaceutical and manufacturing sectors have been affected.

Healthcare 103

Healthcare Manufacturing Cybersecurity Retail 103

Security Affairs

SEPTEMBER 23, 2023

MILES/CBS NEWS TEXAS The Royal ransomware group is behind the attack and threatens to publish stolen data if the City will not meet its ransom demand. Once obtained access to the City’s network, the group performed reconnaissance and information-gathering activities using legitimate third-party remote management tools.

Ransomware 114

Ransomware Encryption Systems administration Cybersecurity 114

Security Affairs

AUGUST 5, 2022

The attack took place in May and lasted seven days, the analysis of the network logs suggests TAC-040 exfiltrated around 700MBs of data from the victim system. “ATI’s thorough analysis determined that the attack occurred during the end of May over a seven day period. ” reads the analysis published by Deepwatch.

Manufacturing 138

Manufacturing Cybersecurity IT Access 138

Security Affairs

OCTOBER 7, 2020

An unidentified group of hackers is using a new fileless attack technique, dubbed Kraken, that abuses the Microsoft Windows Error Reporting (WER). The hacking technique was employed by an unidentified hacking group to avoid detection. The hacking technique was employed by an unidentified hacking group to avoid detection.

Phishing 129

Phishing Manufacturing Archiving Government 129