article thumbnail

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Krebs on Security

Both of these qualities make stolen or ill-gotten code-signing certificates attractive to cybercriminal groups, who prize their ability to add stealth and longevity to malicious software. More recently, it appears Megatraffer has been working with ransomware groups to help improve the stealth of their malware. Image: Archive.org.

article thumbnail

China-linked APT10 leverages ZeroLogon exploits in recent attacks

Security Affairs

Symantec’s Threat Hunter Team, a Broadcom division, uncovered a global campaign conducted by a China-linked APT10 cyber-espionage group targeting businesses using the recently-disclosed ZeroLogon vulnerability. . The APT10 is well-resourced cyberespionage group that employed multiple tools and sophisticated techniques in its attacks.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Financially motivated Earth Lusca threat actors targets organizations worldwide

Security Affairs

According to the security firm, the group is financially motivated, its cyberespionage campaign hit high value targets such as government and educational institutions, religious movements, pro-democracy and human rights organisations in Hong Kong, Covid-19 research organisations, gambling and cryptocurrency companies, and the media.

article thumbnail

Preservica appoints new Advisory Council to help steer next stage of growth

Preservica

His career includes serving at the US Department of Justice and as the first Director of Litigation at the US National Archives and Records Administration (NARA). He has worked closely with companies in both Pharmaceutical and Financial Services industries. He has also co-authored several books on information and knowledge management.

article thumbnail

Winnti APT continues to target game developers in Russia and abroad

Security Affairs

Experts attribute the attacks to the China-linked Winnti APT group (aka APT41 ) and reported that the attackers used a previously undocumented backdoor in the attacks. The Winnti group was first spotted by Kaspersky in 2013, but according to the researchers the gang has been active since 2007.

article thumbnail

The Week in Cyber Security and Data Privacy: 26 February – 3 March 2024

IT Governance

Publicly disclosed data breaches and cyber attacks: in the spotlight Millions of Pure Incubation Ventures records listed on hacking forum 183,754,481 records apparently belonging to the venture capital and private equity group Pure Incubation Ventures have been listed for sale on a hacking forum. The claim is yet to be verified.

article thumbnail

Ten Years Later, New Clues in the Target Breach

Krebs on Security

As detailed in my 2014 book Spam Nation , Vrublevsky not-so-secretly ran a pharmacy affiliate spam program called Rx-Promotion , which paid spammers and virus writers to blast out tens of billions of junk emails advertising generic Viagra and controlled pharmaceuticals like pain relief medications.