eSecurity Planet

FEBRUARY 11, 2022

Statistical analysis on large datasets allows the ability to predict a computer’s behavior and anticipate actions that haven’t even been programmed. Logs analysis to find trends and patterns. Defenders can no longer fight attacks with classic defenses, and it’s especially true with phishing campaigns.

Cybersecurity 144

Cybersecurity Phishing Analytics Risk 144

Security Affairs

MARCH 15, 2023

The attack chain commences with a spear-phishing email containing a weaponized document, which contains a link leading to the download of an HTML file. The HTLM files are hosted on a legitimate online library website that was likely compromised by the threat actors sometime between the end of January 2023 and the beginning of February 2023.

Metadata 85

Metadata Government Libraries Phishing 85

IT Governance

NOVEMBER 6, 2023

At the end of each month, these incidents – and any others that we find – will be used to inform our monthly analysis of data breaches and cyber attacks. Library branches remain open, Wi-Fi is still available and materials can still be borrowed. As of the publication of this blog post, the Library’s website remains offline.

Data Privacy 97

Data Privacy Privacy Libraries Security 97

Security Affairs

APRIL 14, 2020

PaloAlto Networks experts warn of malicious Coronavirus themed phishing campaigns targeting government and medical organizations. The attacks against the Canadian healthcare organizations were discovered between March 24 and March 26, they started with coronavirus -themed phishing campaigns that were carried out in the last months.

Ransomware 113

Ransomware Phishing File names Encryption 113

Security Affairs

SEPTEMBER 12, 2019

Iran-linked Cobalt Dickens APT group carried out a spear-phishing campaign aimed at tens of universities worldwide. “In July and August 2019, CTU researchers discovered a new large global phishing operation launched by COBALT DICKENS. ” reads the analysis published by Secureworks. ” continues the report.

Phishing 79

Phishing Libraries File names Metadata 79

Security Affairs

JULY 8, 2023

The spear-phishing message appears as a benign conversation lure masquerading as a senior fellow with the Royal United Services Institute (RUSI) to the public media contact for a nuclear security expert at a US-based think tank focused on foreign affairs. ” reads the analysis published by Proofpoint.

Archiving 92

Archiving Cloud File names Metadata 92

Security Affairs

JUNE 22, 2022

Malwarebytes researchers observed the use of 3 different themes by the threat actor to hide their skimmer, named after JavaScript libraries: hal-data[.]org/gre/code.js ” concludes the analysis. The discovery of additional domains linked to the same infrastructure suggests the campaign dates back to at least May 2020. livestatic[.]com/theme/main.js

Cleanup 97

Cleanup CMS Libraries Phishing 97

Security Affairs

FEBRUARY 13, 2023

The attack chain starts with phishing emails or social media messages distributing a RAR archive. ” reads the analysis published by Trend Micro. The second-stage malware, UpdatTask.dll , is a dynamic-link library (DLL) written in C++ that includes two export functions, DllEntryPoint and Entry. ” continues the report.

Archiving 79

Archiving File names Libraries Phishing 79

Security Affairs

NOVEMBER 24, 2019

The analysis of the logs for sale in the underground community allowed the experts to estimate that Raccoon infected over 100,000 users worldwide at the time of its discovery. ” reads the analysis published by Cofense. “Users of the malware can distribute it in any way they deem fit. ” concludes Cofense.

Libraries 82

Libraries Sales Phishing IT 82

eSecurity Planet

MARCH 15, 2024

Step 3: Database Check After confirming the query, HackerGPT explores its extensive library of cybersecurity expertise and resources to find information and resources relevant to the user’s inquiry. It also teaches users about social engineering, phishing , and brute force attacks.

Cybersecurity 112

Cybersecurity Education Privacy Access 112

Security Affairs

JULY 14, 2021

Kaspersky experts identified two infection vectors used by LuminousMoth, one leverages spear-phishing messages containing a Dropbox download link, the second one used once gained access to the target network, leverages on removable USB drives. ” reads the analysis published by Kaspersky.

Archiving 98

Archiving File names Government Libraries 98

Security Affairs

OCTOBER 6, 2020

Emotet is a modular malware, its operators could develop new Dynamic Link Libraries to update its capabilities. The alert published by CISA was based on data provided by the Multi-State Information Sharing & Analysis Center (MS-ISAC) and the CISA itself since July 2020. ” reads that alert published by CISA.

Government 134

Government Libraries Cybersecurity Phishing 134

Security Affairs

OCTOBER 2, 2020

In February 2020 Belarussian CERT published a security advisory about an ongoing spear-phishing campaign, linked by ESET to XDSpy, targeting several Belarussian ministries and agencies. The malware samples analyzed by the researchers are slightly obfuscated using string obfuscation and dynamic Windows API library loading.

Military 136

Military Phishing Passwords Government 136

KnowBe4

JUNE 20, 2023

According to Chainalysis, a blockchain analysis firm, there has been a significant increase in the amount of stolen assets by North Korea-backed hackers. You need to know what happens when your employees receive phishing emails: are they likely to click the link? million simulated phishing security tests.

Data breaches 74

Data breaches Phishing Security awareness Ransomware 74

Security Affairs

FEBRUARY 1, 2019

Technical analysis. The analysis of this binary is reported in the next paragraph (see “DLL Analysis”). It’s interesting to notice it calls some “non-library” functions; functions loaded from the previously referenced dll file. DLL Analysis. Figure 11 – Static analysis on DLL. Table 3 – DLL information.

Libraries 84

Libraries Phishing Security IT 84

Security Affairs

APRIL 1, 2020

According to an analysis of the logs for sale in the underground community dated February 2020, Raccoon infected over 100,000 users worldwide at the time of its discovery. The malware is currently distributed via exploit kits, phishing campaigns, and bundled with other malware. ” reads the analysis published by Trend Micro.

Cloud 100

Cloud Sales Libraries Phishing 100

Security Affairs

AUGUST 31, 2019

” reads the analysis published by IRIS. “ we believe ITG08 is actively attacking multinational organizations, targeting specific employees with spear phishing emails advertising fake job advertisements and repeatedly deploying the More_eggs JScript backdoor malware (aka Terra Loader, SpicyOmelette ).”

Retail 83

Retail Libraries Sales Phishing 83

Security Affairs

MAY 27, 2019

In July 2018, FireEye observed a series of new attacks of the group leveraging spear-phishing emails using weaponized Word documents that attempt to deliver the UPPERCUT backdoor, also tracked as ANEL. ” reads the analysis published by enSilo. jli.dll – malicious DLL msvcrt100.dll ” concludes the experts.

Libraries 82

Libraries Phishing Government Cloud 82

The Last Watchdog

MAY 11, 2021

Spear phishing, or even bribery of an insider, are tried-and-true ways to gain initial access; and then living-off-the-land techniques work very well for stealthily mapping network resources and escalating privileges.

Cybersecurity 202

Cybersecurity Data collection Libraries Analytics 202

Security Affairs

FEBRUARY 19, 2020

” reads the analysis published by Trend Micro. The group was also observed using modified versions of common malware such as PlugX RAT , Trochilus RAT, keyloggers using the Microsoft Foundation Class (MFC) library, the custom in-memory HyperBro backdoor, and a Cobalt Strike sample. is dated October, 2019.

Libraries 98

Libraries Phishing Passwords IT 98

Security Affairs

SEPTEMBER 20, 2019

Technical Analysis. The document uses a common phishing schema, it invites the user to enable the macro execution due to compatibility reasons with older Microsoft Office versions. The dropped file payload is a.NET executable embedding some anti-analysis tricks. Static information about the doc macro. Load()” method.

Libraries 80

Libraries Passwords IT Phishing 80

Security Affairs

SEPTEMBER 5, 2018

The group is back and is targeting once again Vietnam running a spear phishing campaign that uses weaponized documents featuring Vietnamese-language lures and themes. ” reads the analysis published by CrowdStrike. The analysis of command and control servers suggests that GOBLIN PANDA hackers are also targeting entities in Laos.

Metadata 45

Metadata File names Libraries Government 45

Security Affairs

OCTOBER 10, 2018

. “This group eschews custom malware and uses living off the land (LotL) tactics and publicly available hack tools to carry out activities that bear all the hallmarks of a cyber espionage campaign,” reads the analysis published by Symantec.

Military 81

Military File names Libraries Government 81

Security Affairs

NOVEMBER 5, 2019

The analysis of the script revealed the existence of a mysterious APT group tracked by Kaspersky Lab as ‘ DarkUniverse ’. The DarkUniverse APT carried spear-phishing attacks using weaponized Microsoft Office document, each email was prepared separately for each victim. ” reads the analysis published by Kaspersky.

Libraries 48

Libraries Phishing Communications Cloud 48

Security Affairs

AUGUST 25, 2019

5 Common Phishing Attacks and How to Avoid Them? Malware Analysis Sandboxes could expose sensitive data of your organization. Malware Analysis Sandboxes could expose sensitive data of your organization. A backdoor mechanism found in tens of Ruby libraries. Capital One hacker suspected to have breached other 30 companies.

Security 50

Security Mining Data breaches Libraries 50

Security Affairs

FEBRUARY 19, 2019

Technical analysis. The phishing email contains a.zip file named “slavneft.zakaz.zip”, which means something like “slavneft order” in English, showing a direct reference to “Slavneft”. The behavioural analysis session recorded the executions of the ZCash miner, stored in the “C:ProgramDataSoftwareDistribution” folder.

Ransomware 75

Ransomware Mining File names Encryption 75

Security Affairs

APRIL 18, 2019

The uncertain attribution of the Ukrainian themed malicious document discussed in our past article “ APT28 and Upcoming Elections: Possible Interference Signals ”, led us to a review of Sofacy’s phishing techniques to confirm or deny the possible involvement of Russian state-sponsored actors in the election interference. Technical Analysis.

Passwords 65

Passwords Libraries Phishing IT 65

IT Governance

APRIL 22, 2024

At the end of each month, these incidents – and any others that we find – will be used to inform our monthly analysis of data breaches and cyber attacks. 16,482,365 known records breached in 240 newly disclosed incidents Welcome to this week’s global round-up of the biggest and most interesting news stories.

Data Privacy 52

Data Privacy Privacy Manufacturing Security 52

IT Governance

JANUARY 10, 2022

Analysis from its real-time anti-phishing protection system found that cyber criminals increasingly targeted people who were searching for holidays and weekend breaks. A report emerged in October that criminal hackers had been hijacking high-profile YouTube channels in phishing scams designed to capture their cookies.

Security 115

Security Data breaches Ransomware Phishing 115

Security Affairs

DECEMBER 29, 2019

Last days of 2019 were the perfect time to spread phishing campaigns using email templates based on the Portuguese Government Finance & Tax. Regarding a broad analysis, it looks like the Trojan-Banker.Win32.ChePro ChePro family, but with improvements that make hard its detection and analysis. Technical Analysis.

Passwords 94

Passwords e-Discovery IT Cleanup 94

Security Affairs

DECEMBER 20, 2018

The Cybaze -Yoroi ZLab dissected one of these recent Danabot variants spread across the Italian cyberspace leveraging “ Fattura ” themed phishing emails (e.g. Technical Analysis. These registry keys are responsible of the loading of dynamically linked libraries in the “read only ” and “ hidden ” “ C:ProgramDataD93C2DAC ”.

Libraries 72

Libraries Phishing Encryption Authentication 72

Security Affairs

MARCH 2, 2019

In February 2019, SI-LAB captured multiple samples of phishing campaigns using an Office Excel document carrying a malicious Excel 4.0 For more details on this finding see the Technical Analysis below. Technical Analysis. Phishing is, in fact, the major attack vector to distribute threats this nature in-the-wild.

File names 84

File names Phishing Libraries IT 84

Security Affairs

FEBRUARY 21, 2020

At that time, the researchers tracked the sources IP in Pakistan, the attacks were part of a wider operation that relies on multi vector such as watering hole websites and phishing email campaigns delivering custom RATs dubbed Crimson and Peppy. So, Cybaze-Yoroi ZLab team decided to dive deep into technical analysis.

Military 111

Military Communications Encryption IT 111

Security Affairs

SEPTEMBER 7, 2020

Security experts from NVISO Labs recently spotted the activity of a new malware gang, tracked as Epic Manchego, that is actively targeting companies across the world with phishing emails since June. The phishing messages carry weaponized Excel documents that are able to bypass security checks and that had low detection rates.

Libraries 94

Libraries Phishing Passwords Security 94

Security Affairs

FEBRUARY 16, 2021

Latin American trojans share the same modus operandi and even modules and blocks of code observed during the analysis of several malware samples. The malicious activity starts with a phishing email sent to the target victims in Latin American – Brazil, Mexico, Chile, and Peru – and Europe – Spain and Portugal.

Libraries 117

Libraries Communications Phishing Encryption 117

Security Affairs

OCTOBER 6, 2020

The e-skimmer was first spotted by researchers at Malwarebytes’ Threat Intelligence Team, the researchers noticed a single line of code that is used to load an external JavaScript library from paypal-debit[.]com/cdn/ga.js. us, had been injected with a one-liner that contains a Base64 encoded URL loading an external JavaScript library.”

Libraries 83

Libraries Phishing Analytics Security 83

Security Affairs

AUGUST 28, 2018

Experts from SecureWorks discovered a large phishing campaign targeting universities carried out by an Iran-linked threat actor COBALT DICKENS. Most of the websites spoofed universities’ online library systems, the attackers were interested in accessing those resources and gather intelligence. ” concludes the report.

Phishing 73

Phishing Libraries Security Access 73