Security Affairs

MARCH 21, 2023

Researchers believe that threat actors use spear phishing as an initial attack vector, the messages include an URL pointing to a ZIP archive hosted on a web server under the control of the attackers. The archive contained two files, a decoy document (i.e. pdf.lnk) used to start the infection and deploy the PowerMagic backdoor.

Agriculture 83

Agriculture Archiving Communications Phishing 83

Security Affairs

DECEMBER 20, 2021

The DarkWatchman RAT uses the registry for nearly all temporary and permanent storage, it doesn’t write to disk evading most security tools. . The DarkWatchman has been distributed through phishing emails that use malicious ZIP archives (named ‘????????? ?12-6317-3621.zip’ 12-6317-3621.zip’ ” continues the analysis.

Archiving 122

Archiving Communications Ransomware Phishing 122

Security Affairs

AUGUST 21, 2022

. “Grandoreiro is written in Delphi and utilizes techniques like binary padding to inflate binaries, Captcha implementation for sandbox evasion, and command-and-control (CnC) communication using patterns that are identical to LatentBot.” ” concludes the report. Follow me on Twitter: @securityaffairs and Facebook.

Archiving 91

Archiving Phishing Communications Manufacturing 91

Security Affairs

MAY 25, 2023

According to Microsoft, the campaign aims at building capabilities that could disrupt critical communications infrastructure between the United States and Asia region in the case of future crises. The group also relies on customized versions of open-source tools for C2 communications and stay under the radar. We are in the final!

Communications 77

Communications Manufacturing Access Archiving 77

Security Affairs

MAY 26, 2023

The backdoor uses emails for C2 communications, where the C2 is the victim’s Microsoft Exchange server. The archive contained a malicious.NET executable (Brochure.exe) which is an executable with an Adobe PDF icon. The experts speculate that the backdoor is likely linked to an Iran-linked APT group. We are in the final!

Communications 89

Communications File names Archiving Phishing 89

Security Affairs

FEBRUARY 28, 2022

“UNC3313 initially gained access to this organization through a targeted phishing email and leveraged modified, open-source offensive security tools to identify accessible systems and move laterally.” STARWHALE communicates with the C2 server via HTTP. .” reads the analysis published by Mandiant. Pierluigi Paganini.

Phishing 90

Phishing Archiving Communications Access 90

Security Affairs

MAY 23, 2023

Researchers believe that threat actors use spear phishing as an initial attack vector, the messages include an URL pointing to a ZIP archive hosted on a web server under the control of the attackers. The archive contained two files, a decoy document (i.e. pdf.lnk) used to start the infection and deploy the PowerMagic backdoor.

Communications 79

Communications Agriculture Cloud Archiving 79

IBM Big Data Hub

MAY 28, 2024

To fulfill these principles, data protection strategies generally focus on the following three areas: Data security —protecting digital information from unauthorized access, corruption or theft throughout its entire lifecycle. Cyberattacks that aim to steal sensitive information continue to rise.

Data breaches 82

Data breaches GDPR Compliance Encryption 82

Security Affairs

JUNE 29, 2022

“ “An attacker is able to create files outside of the target extraction directory when an application or victim user extracts an untrusted archive. “The only requirement for this attack is that unrar is installed on the server, which is expected as it is required for RAR archive virus-scanning and spam-checking.”

Archiving 93

Archiving Authentication Communications Security 93

Security Affairs

NOVEMBER 16, 2023

Samsung Electronics disclosed a data breach that exposed customer personal information to an unauthorized individual. Samsung Electronics suffered a data breach that exposed the personal information of some of its customers to an unauthorized individual. “What information was involved? What happened?

Data breaches 124

Data breaches Access Archiving Passwords 124

Security Affairs

DECEMBER 29, 2021

Researchers from NTT Security reported that China-linked BlackTech cyberespionage group targeted Japanese companies using new malware tracked as ‘Flagpro’. Attacks using Flagpro targeted multiple companies in Defense, Media, and Communications industries several times. . The archive contains a weaponized Microsoft Excel file (.XLSM),

Phishing 117

Phishing Passwords Communications Archiving 117

Security Affairs

JUNE 7, 2021

“Specialists of the Security Service of Ukraine established that in early June this year, mass e-mails were sent with the sender’s address changed. The messages use a RAR archive as an attachment and trick victims into opening it. Upon downloading and opening the archive, an EXE file with a double extension, filename.

Phishing 92

Phishing Archiving Government Passwords 92

Security Affairs

APRIL 20, 2022

The researchers pointed out that each variant will communicate with a different command-and-control (C&C) server. The attackers are using multiple different payloads to establish persistence on the infected systems and to be resilient to takedown operations conducted by security firms and government experts. Pierluigi Paganini.

Archiving 111

Archiving Phishing Communications Cybersecurity 111

Security Affairs

JANUARY 19, 2022

Researchers from AhnLab’s Security Emergency-response Center (ASEC) spotted an IRC bot written in GoLang that is being used to carry out DDoS attacks targeting users in Korea. The malicious code is hosted on a web hard drive or a remote file hosting service in the form of compressed ZIP archives. Pierluigi Paganini.

Archiving 86

Archiving Communications Security IT 86

Security Affairs

APRIL 18, 2021

“The.zip file is not a compressed archive, but a batch script that then invokes the built-into-Windows certutil.exe program to download two additional files, win_s.zip and win_d.zip.” “Among the files contained in the QuickCPU.dat archive are the configurator for the miner, which appears to be xmr-stak.

File names 78

File names Archiving Passwords Communications 78

Security Affairs

JULY 14, 2021

The Dropbox link leads to a RAR archive that masquerades as a Word document by setting the “file_subpath” parameter to point to a filename with a.DOCX extension. “The archive contains two malicious DLL libraries as well as two legitimate executables that sideload the DLL files. ” reads the analysis published by Kaspersky.

Archiving 98

Archiving File names Government Libraries 98

Security Affairs

MARCH 2, 2022

The researchers who leaked the data belonging to Conti’s communications announced more dumps are coming, and now he is leaking the source for their ransomware, including the administrative console. The post Ukrainian researcher leaked the source code of Conti Ransomware appeared first on Security Affairs. Pierluigi Paganini.

Ransomware 94

Ransomware Passwords Archiving Communications 94

Security Affairs

OCTOBER 8, 2020

The loader allows to deliver the main payload, experts noticed that it is hidden inside a self-extracting RAR archive. In order to trick the victims into opening it, the archive references phone lists, medical test results or technical documentation in order to convince the employees of the targeted organization to download the file.

Encryption 101

Encryption Archiving Communications Cloud 101

Security Affairs

JUNE 26, 2021

On June 14th, Altus Group, a commercial real estate software solutions firm, disclosed a security breach, now Hive ransomware gang leaked its files. Now, we have information that their data may have possibly been leaked by Hive – a new ransomware group. Altus Group has been informed about the new development. Pierluigi Paganini.

Ransomware 102

Ransomware File names Archiving Encryption 102

Security Affairs

FEBRUARY 23, 2022

National Security Agency (NSA) Equation Group. The Bvp47 backdoor was first discovered in 2013 while conducting a forensic investigation into a security breach suffered by a Chinese government organization. . Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini. SecurityAffairs – hacking, backdoor).

Encryption 114

Encryption Military Archiving Government 114

Security Affairs

SEPTEMBER 18, 2019

Greenbone Networks researchers analyzed about 2,300 Picture Archiving and Communication System (PACS) systems exposed online. PACS servers are used in the healthcare industry to archive images created by radiological processes and to make them available to medical staff for analysis and diagnosis. million patient records.

Archiving 93

Archiving Communications Access Phishing 93

Security Affairs

DECEMBER 1, 2020

An archive of 25,000+ partner and client organizations, such as pharmaceutical laboratories and pharmacies, serviced by the Apodis Pharma distribution platform. An archive of 25,000+ partner and client organizations, such as pharmaceutical laboratories and pharmacies, serviced by the Apodis Pharma distribution platform.

Healthcare 91

Healthcare Archiving Sales Access 91

Krebs on Security

MARCH 1, 2022

A Ukrainian security researcher this week leaked several years of internal chat logs and other sensitive data tied to Conti , an aggressive and ruthless Russian cybercrime group that focuses on deploying its ransomware to companies with more than $100 million in annual revenue. On Sunday, Feb. ” GAP #1. 22, 2020, the U.S.

Ransomware 276

Ransomware Government Security IT 276

Security Affairs

MAY 2, 2020

French daily Le Figaro database accidentally exposed online, the archive included roughly 7.4 billion records containing personal information of employees and users. billion records containing personally identifiable information (PII) of employees, reporters, and at least 42,000 users. billion records.” billion records.”

Passwords 113

Passwords Archiving Phishing Access 113

Security Affairs

OCTOBER 13, 2023

The threat actors leverage spear-phishing emails to deliver archive files utilizing DLL side-loading schemes. report – CurKeep collects information about the infected machine. The backdoor uses HTTP for its communications. appeared first on Security Affairs. In turn, the C2 responds with strings of commands.

Government 102

Government IT Encryption Libraries 102

Security Affairs

MARCH 6, 2024

s March 2nd update to analyze P2P communications related to leaked data and TOR network connections. In fact, the cybersecurity community often overlooks the fact that LockBit 3.0 was one of the first ransomware groups to start embedding leaked data into torrent files for download and uploading these archives to TOR.

Risk 116

Risk Ransomware Access Cybersecurity 116

Security Affairs

MARCH 17, 2020

An evidence about the presence of the malicious file hosted on the legit website is shown in the following figure: Figure 5: Communication with the DropUrl. The downloaded file, as previously mentioned, is a Self Extracting Archive (SFX/SEA). Sample information about the ursnif SFX Packer. The “plugin.rar” archive content.

Archiving 127

Archiving Passwords Encryption IT 127

Security Affairs

JUNE 17, 2020

Security experts from ESET uncovered a new sophisticated cyber-espionage campaign, dubbed “ Operation In(ter)recepti on ,” aimed at aerospace and military organizations in Europe and the Middle East. “a password-protected RAR archive containing a LNK file. Attackers used documents related to the job offer as a lure.

Military 74

Military Archiving Passwords Communications 74

Security Affairs

MAY 10, 2023

The executable is a self-contained archive that once executed will extract two files. The experts noticed that the attachment was simply named “ ! to embassy kazakh 2022.exe exe ” and used the icon image associated with docx files. “During our investigation, we have identified multiple samples of new malware written in C++.

File names 89

File names Archiving Phishing Government 89

Security Affairs

JANUARY 12, 2022

The RedLine malware allows operators to steal several information, including credentials, credit card data, cookies, autocomplete information stored in browsers, cryptocurrency wallets, credentials stored in VPN clients and FTP clients. The malicious code can also act as a first-stage malware. This variant uses 207[.]32.217.89

Manufacturing 133

Manufacturing File names Archiving Encryption 133

Security Affairs

SEPTEMBER 2, 2019

The malware attempt to connect via SSH on Port 22 and deliver itself as a gzip archive. “The malware is uploaded as gzip compressed tarball archives of binaries, scripts, and libraries. ” The expert discovered that the script executes init2, that is one of the files in the gzip archive, if the directory.

IoT 89

IoT Honeypots Libraries Archiving 89

Security Affairs

MARCH 13, 2020

.” As part of this campaign, state-sponsored hackers compromised the websites of the Embassy of Armenia in Russia, the Ministry of Nature Protection and Natural Resources of the Republic of Artsakh, the Armenian Institute of International and Security Affairs, and the Armenian Deposit Guarantee Fund. Pierluigi Paganini.

Archiving 120

Archiving Government Communications IT 120

Security Affairs

DECEMBER 15, 2022

” One of the spear-phishing messages analyzed by the researchers posed as an official communication from the PR department of a specific Japanese political party. The attachment was a self-extracting WinRAR archive, upon opening it it will start LODEINFO infection. Pierluigi Paganini. SecurityAffairs – hacking, MirrorFace).

Phishing 90

Phishing Archiving Communications IT 90

Security Affairs

MAY 7, 2022

The attack chain aims at distributing.RAR archive from the legitimate site file.io Last stagers use two communication mechanisms, over HTTP with RC4 encryption and unencrypted with named pipes. The post Malware campaign hides a shellcode into Windows event logs appeared first on Security Affairs. ” concludes the report.

Encryption 87

Encryption Libraries Archiving Communications 87

Security Affairs

AUGUST 9, 2022

The attackers breached dozens of enterprises and in some cases compromised their IT infrastructure, taking over systems used to manage security solutions. The threat actors deploy multiple backdoors on the target systems, experts believe the attackers used them to create redundant channels of communication. Pierluigi Paganini.

Encryption 98

Encryption Military Archiving Phishing 98

Security Affairs

JULY 7, 2019

. “Here is what happens after the PE file is run (although the intermediate link does not necessarily have to be a PE file): Contact is made with the C2 server to download a ZIP archive with necessary dependencies and main Python script. The archive contents are extracted, without being saved to disk. Pierluigi Paganini.

Government 81

Government Computer and Electronics Archiving Phishing 81

Security Affairs

JULY 24, 2022

The attachment used in this campaign is an archive containing a Word document (missile.docx) and a Windows Shortcut file (_weapons.doc.lnk.lnk). At this point, C2 communications are once again established allowing the attackers to access the system. appeared first on Security Affairs. Pierluigi Paganini.

Archiving 93

Archiving Phishing Encryption Communications 93