article thumbnail

Ukraine: Belarusian APT group UNC1151 targets military personnel with spear phishing

Security Affairs

The CERT of Ukraine (CERT-UA) warned of a spear-phishing campaign targeting Ukrainian armed forces personnel. The Computer Emergency Response Team of Ukraine (CERT-UA) is warning of an ongoing spear-phishing campaign targeting private email accounts belonging to Ukrainian armed forces personnel. ua-passport[.]space space and id[.]bigmir[.]space.

Military 107
article thumbnail

The Week in Cyber Security and Data Privacy: 13 – 19 November 2023

IT Governance

According to OPB, the district didn’t provide details, but said that “our student credentials may have been compromised as part of a security incident”. For more information about the SEC cyber security disclosure rules, register for our free webinar on 30 November.)

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Experts warn of an emerging Python-based credential harvester named Legion

Security Affairs

Legion exploits web servers running Content Management Systems (CMS), PHP, or PHP-based frameworks such as Laravel. “From these targeted servers, the tool uses a number of RegEx patterns to extract credentials for various web services. The experts believe that the tool is widely distributed and is likely paid malware.

CMS 86
article thumbnail

Security Affairs newsletter Round 278

Security Affairs

Every week the best security articles from Security Affairs free for you in your email box. The post Security Affairs newsletter Round 278 appeared first on Security Affairs. A new round of the weekly SecurityAffairs newsletter arrived! users Thousands of WordPress WooCommerce stores potentially exposed to hack.

article thumbnail

GhostWriter APT targets state entities of Ukraine with Cobalt Strike Beacon 

Security Affairs

Ukraine CERT-UA uncovered a spear-phishing campaign conducted by Belarus-linked GhostWriter APT group targeting Ukrainian state entities with Cobalt Strike Beacon. The phishing messages use a RAR-archive named “Saboteurs.rar”, which contains RAR-archive “Saboteurs 21.03.rar.” Pierluigi Paganini.

article thumbnail

Security Affairs newsletter Round 309

Security Affairs

Every week the best security articles from Security Affairs free for you in your email box. If you want to receive the weekly Security Affairs Newsletter for free subscribe here. The post Security Affairs newsletter Round 309 appeared first on Security Affairs. Follow me on Twitter: @securityaffairs and Facebook.

article thumbnail

Crooks use hidden directories of compromised HTTPS sites to deliver malware

Security Affairs

Security experts at Zscaler discovered that threat actors are using hidden “well-known” directories of HTTPS sites to store and deliver malicious payloads. of the popular CMS that are affected by a cross-site request forgery (CSRF) flaw that resides in the comment section of WordPress that is enabled by defaul t. “The hidden /.well-known/

CMS 107