Communications, File names, Government and Security

Chinese APT FunnyDream targets a South East Asian government

Security Affairs

NOVEMBER 17, 2020

Security experts at BitDefender have uncovered a new China-linked cyber espionage group, tracked as FunnyDream that has already infected more than 200 systems across Southeast Asia over the past two years. Most of the victims were in Vietnam, the group focuses on foreign government organizations of countries in Southeast Asia. .

Government

Government File names Communications Access

New PowerExchange Backdoor linked to an Iranian APT group

Security Affairs

MAY 26, 2023

Researchers from the Fortinet FortiGuard Labs observed an attack targeting a government entity in the United Arab Emirates with a new PowerShell-based backdoor dubbed PowerExchange. The backdoor uses emails for C2 communications, where the C2 is the victim’s Microsoft Exchange server. ” reads the analysis published by Fortinet.

Communications

Communications File names Archiving Phishing

Medibank Defends its Security Practices as its Ransomware Woes Worsen

IT Governance

NOVEMBER 17, 2022

The organisation’s share price plummeted by almost 19% following the data breach, and despite its claims that it has done the right thing, new details continue to emerge that cast doubt on Medibank’s cyber security practices. Things got worse for Medibank after a second database was leaked , containing a file named “abortions”.

IT

IT Ransomware Security Data breaches

China-linked LuminousMoth APT targets entities from Southeast Asia

Security Affairs

JULY 14, 2021

LuminousMoth: Kaspersky uncovered an ongoing and large-scale APT campaign that targeted government entities in Southeast Asia, including Myanmar and the Philippines. “The archive contains two malicious DLL libraries as well as two legitimate executables that sideload the DLL files. Pierluigi Paganini.

Archiving

Archiving File names Government Libraries

New Linux Ransomware BlackSuit is similar to Royal ransomware

Security Affairs

JUNE 3, 2023

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. ReadMe file name: README.BlackSuit.txt. New #ransomware #BlackSuit targets Windows, #Linux.

Ransomware

Ransomware Encryption File names Cybersecurity

DownEx cyberespionage operation targets Central Asia

Security Affairs

MAY 10, 2023

A new sophisticated malware strain, dubbed DownEx, was involved in attacks aimed at Government organizations in Central Asia. In late 2022, Bitdefender Labs researchers first observed a highly targeted cyberattack targeting foreign government institutions in Kazakhstan that involved a new sophisticated strain of malware dubbed DownEx.

File names

File names Archiving Phishing Government

The previously undocumented GoldenJackal APT targets Middle East, South Asia entities

Security Affairs

MAY 23, 2023

A previously undocumented APT group tracked as GoldenJackal has been targeting government and diplomatic entities in the Middle East and South Asia since 2019. The group focuses on government and diplomatic entities in the Middle East and South Asia. “The fake Skype installer was a.NET executable file named skype32.exe

File names

File names Government Communications IT

China-linked APT41 group targets Hong Kong with Spyder Loader

Security Affairs

OCTOBER 18, 2022

Symantec pointed out that the attacks against government organizations in Hong Kong remained undetected for a year in some cases. The post China-linked APT41 group targets Hong Kong with Spyder Loader appeared first on Security Affairs. ” continues the report. Follow me on Twitter: @securityaffairs and Facebook.

File names

File names Encryption Manufacturing Libraries

Researcher found US ‘No Fly List’ on an unsecured server

Security Affairs

JANUARY 24, 2023

Crimew discovered a file named NoFly.csv which is a legitimate U.S. records (first names, last names, and dates of birth) belonging to people with suspected or known ties to terrorist groups. “three csv files, employee_information.csv, NOFLY.CSV and SELECTEE.CSV. no fly list from 2019 containing over 1.56

Archiving

Archiving File names Access Authentication

Crooks target Healthcare facilities involved in Coronavirus containment with Ransomware

Security Affairs

APRIL 14, 2020

PaloAlto Networks experts warn of malicious Coronavirus themed phishing campaigns targeting government and medical organizations. Recently organizations in healthcare, research, and government facilities have been hit by Coronavirus-themed attacks that deployed multiple malware families, including ransomware and information stealers (i.e.

Ransomware

Ransomware Phishing File names Encryption

Conti ransomware gang also breached Ireland Department of Health (DoH)

Security Affairs

MAY 19, 2021

“The National Cyber Security Centre (NCSC) became aware on Thursday of an attempted cyber attack on the Department of Health. ” reads an update published by the Irish Department of the Environment, Climate and Communications. FEEDC (extension added by Conti Ransomware to filenames of encrypted files) – *.msi

Ransomware

Ransomware Encryption File names IoT

Zeus Sphinx spam campaign attempt to exploit Coronavirus outbreak

Security Affairs

MARCH 30, 2020

Experts from IBM X-Force uncovered a hacking campaign employing the Zeus Sphinx malware, as known as Zloader or Terdot , that focus on government relief payments. . Spam messages sent to the victims claim to provide information related to the Coronavirus outbreak and government relief payments. ” continues the post.”Next,

File names

File names Passwords Sales Authentication

Sofacy APT group used a new tool in latest attacks, the Cannon

Security Affairs

NOVEMBER 20, 2018

The Russia-linked APT group delivers Cannon in a spear-phishing attack that targets government organizations in North America, Europe and in a former USSR state. ” Cannon acts as a downloader and relies on emails to communicate with the C2 server and receive instructions. Security Affairs – Sofacy APT, Cannot tool).

File names

File names Phishing Communications Government

6 Best Threat Intelligence Feeds to Use in 2023

eSecurity Planet

AUGUST 10, 2023

Here are our picks for the top threat intelligence feeds that security teams should consider adding to their defensive arsenal: AlienVault Open Threat Exchange: Best for community-driven threat feeds FBI InfraGard: Best for critical infrastructure security abuse.ch

Cybersecurity

Cybersecurity Access Metadata Energy and Utilities

Guarding Against Solorigate TTPs

eSecurity Planet

FEBRUARY 3, 2021

A March 2020 software update of the SolarWinds Orion management platform gave malicious actors unhindered access to key government and enterprise networks. Since then, much has been learned about the tactics, techniques, and procedures (TTPs) deployed and what steps organizations are taking to harden their network and application security.

Cybersecurity

Cybersecurity Access Authentication Cloud

A new trojan Lampion targets Portugal

Security Affairs

DECEMBER 29, 2019

New trojan called ‘Lampion’ has spread using template emails from the Portuguese Government Finance & Tax during the last days of 2019. Last days of 2019 were the perfect time to spread phishing campaigns using email templates based on the Portuguese Government Finance & Tax. Two files are obtained from 2 AWS S3 buckets.

Passwords

Passwords e-Discovery IT Cleanup

APT34: Glimpse project

Security Affairs

MAY 2, 2019

The group conducts operations primarily in the Middle East, targeting financial, government, energy, chemical, telecommunications and other industries. Repeated targeting of Middle Eastern financial, energy and government organisations leads FireEye to assess that those sectors are a primary concern of APT34. Source: MISP Project ).

Computer and Electronics

Computer and Electronics Communications Government File names

Redfly group infiltrated an Asian national grid as long as six months?

Security Affairs

SEPTEMBER 13, 2023

UK, Australian, Canadian, and New Zealand governments issued a joint alert about China-linked threat actors targeting CNI organizations and using living off the land to evade detection. “On May 29, the attackers returned and used a renamed version of ProcDump (file name: alg.exe) to dump credentials from LSASS.”

File names

File names Access Encryption Communications

New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader

Security Affairs

JULY 7, 2020

Lampion was first documented in December 2019 , and it was distributed in Portugal via phishing emails using templates based on the Portuguese Government Finance & Tax. Here, it was distributed using fake webpages, where the victim downloaded an MSI file, which then held the remaining Lampion infection chain.

Communications

Communications Cloud Phishing Encryption

Creating Records At Home, Part III: Various Devices

The Texas Record

JUNE 1, 2021

Records created and stored outside the business network are in contravention of the government records accessibility requirement —this negatively affects that government’s ability to perform regular business operations efficiently. Create a safe communication channel with the employee. What is the risk?

Records Management

Records Management File names Risk Government

New APT34 campaign uses LinkedIn to deliver fresh malware

Security Affairs

JULY 22, 2019

APT34 is an Iran-linked APT group that has been around since at least 2014, it targeted mainly organizations in the financial, government, energy, telecoms and chemical sectors in the United States and Middle Eastern countries. The fake profiles asked the victims to open the weaponized excel file named ERFT-Details.

File names

File names Phishing Passwords Government

New PowerShell-based Backdoor points to MuddyWater

Security Affairs

NOVEMBER 30, 2018

Security researchers at Trend Micro recently discovered PowerShell-based backdoor that resembles a malware used by MuddyWater threat actor. But, unlike previous incidents using POWERSTATS, the command and control (C&C) communication and data exfiltration in this case is done by using the API of a cloud file hosting provider.”

Communications

Communications File names Cloud Government

Hacking The Hacker. Stopping a big botnet targeting USA, Canada and Italy

Security Affairs

AUGUST 31, 2018

Since blogging is not my business, I do write on my personal blog to share knowledge on Cyber Security, I will describe some of the main steps that took me to own the attacker infrastructure. My entire “Cyber adventure” began with a simple email within a.ZIP file named “Nuovo Documento1.zip” Obfuscation.

Computer and Electronics

Computer and Electronics File names Security Access

Information Management Today

Chinese APT FunnyDream targets a South East Asian government

New PowerExchange Backdoor linked to an Iranian APT group

Trending Sources

Medibank Defends its Security Practices as its Ransomware Woes Worsen

China-linked LuminousMoth APT targets entities from Southeast Asia

New Linux Ransomware BlackSuit is similar to Royal ransomware

DownEx cyberespionage operation targets Central Asia

The previously undocumented GoldenJackal APT targets Middle East, South Asia entities

China-linked APT41 group targets Hong Kong with Spyder Loader

Researcher found US ‘No Fly List’ on an unsecured server

Crooks target Healthcare facilities involved in Coronavirus containment with Ransomware

Conti ransomware gang also breached Ireland Department of Health (DoH)

Zeus Sphinx spam campaign attempt to exploit Coronavirus outbreak

Sofacy APT group used a new tool in latest attacks, the Cannon

6 Best Threat Intelligence Feeds to Use in 2023

Guarding Against Solorigate TTPs

A new trojan Lampion targets Portugal

APT34: Glimpse project

Redfly group infiltrated an Asian national grid as long as six months?

New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader

Creating Records At Home, Part III: Various Devices

New APT34 campaign uses LinkedIn to deliver fresh malware

New PowerShell-based Backdoor points to MuddyWater

Hacking The Hacker. Stopping a big botnet targeting USA, Canada and Italy

Stay Connected