Security Affairs

FEBRUARY 17, 2022

Starting in January 2022, security researchers from Avanan observed attackers compromising Microsoft Teams accounts attach malicious executables to chat and infect participants in the conversation. “Compounding this problem is the fact that default Teams protections are lacking, as scanning for malicious links and files is limited.

File names 143

File names Phishing Data breaches Access 143

Security Affairs

JUNE 26, 2021

On June 14th, Altus Group, a commercial real estate software solutions firm, disclosed a security breach, now Hive ransomware gang leaked its files. IT back-office and communications systems, such as email have been taken offline at the time. A week later, they reported “no evidence of impact”. Here’s what we know.

Ransomware 108

Ransomware File names Archiving Encryption 108

Security Affairs

APRIL 18, 2021

“The attack begins with a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth).” ” The attack used a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth). .

File names 82

File names Archiving Passwords Communications 82

eSecurity Planet

JULY 1, 2022

Security researchers have uncovered an unusually sophisticated malware that has been targeting small office/home office (SOHO) routers for nearly two years, taking advantage of the pandemic and rapid shift to remote work. See The Best Wi-Fi 6 Routers Secure and Fast Enough for Business. See the Best Antivirus Software.

File names 117

File names Access Communications Security 117

Security Affairs

JUNE 3, 2023

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. ReadMe file name: README.BlackSuit.txt. New #ransomware #BlackSuit targets Windows, #Linux. Extension: blacksuit.

Ransomware 97

Ransomware Encryption File names Cybersecurity 97

Security Affairs

OCTOBER 18, 2022

. “We also saw Mimikatz being executed on victim networks, as well as a Trojanized ZLib DLL that had multiple malicious exports, one of which appeared to be waiting for communication from a command-and-control (C&C) server, while the other would load a payload from the provided file name in the command-line.”

File names 113

File names Encryption Manufacturing Libraries 113

Security Affairs

MAY 13, 2023

The CheckMate ransomware operators have been targeting the Server Message Block (SMB) communication protocol used for file sharing to compromise their victims’ networks. Once the attacker successfully logs in to a device, they encrypt data in shared folders and leave a ransom note with the file name “!CHECKMATE_DECRYPTION_README”

Ransomware 94

Ransomware Encryption Passwords File names 94

Security Affairs

JANUARY 12, 2022

The new variant discovered by Fortinet has the file name “Omicron Stats.exe,” threat actors are attempting to exploit the enormous interest on a global scale on the COVID-19 Omicron variant. Over the course of the few weeks after this variant was released, we noticed one IP address in particular communicating with this C2 server.”

Manufacturing 137

Manufacturing File names Archiving Encryption 137

Security Affairs

MAY 10, 2023

exe ” and used the icon image associated with docx files. The executable is a self-contained archive that once executed will extract two files. One of the files is the bait document, while the other one is an HTA file named log extension with embedded VBScript code The HTA file contacts the C2 server to fetch a second-stage payload.

File names 93

File names Archiving Phishing Government 93

Security Affairs

MARCH 18, 2022

In February, US and UK cybersecurity and law enforcement agencies published a joint security advisory about the Cyclops Blink bot that has been linked to the Russian-backed Sandworm APT group. For every hard-coded TCP port used to communicate with the C2 servers, the bot creates a rule in the Linux kernel firewall Netfilter.

IoT 98

IoT Military File names Communications 98

Security Affairs

FEBRUARY 26, 2020

Figure 4: Piece of the encrypted file downloaded from “share.]dmca.]gripe”. Inside it, two files named “filename1.vbs” Figure 5: Installed files. The content of the VBScript is straightforward: it simply is the launching point to run executable file. Figure 10: Piece of network communication intercepted.

File names 119

File names Communications Encryption IT 119

Security Affairs

JULY 28, 2021

In the attacks investigated by Palo Alto Networks, the APT group leveraged legitimate executables such as BITSAdmin to download an innocuous file named Aro.dat from a GitHub repository under the control of the threat actors. The analysis of the file revealed that it includes the encrypted and compressed PlugX payload.

Encryption 111

Encryption File names Communications IT 111

Security Affairs

JULY 14, 2021

. “The archive contains two malicious DLL libraries as well as two legitimate executables that sideload the DLL files. We found multiple archives like this with file names of government entities in Myanmar, for example “COVID-19 Case 12-11-2020(MOTC).rar” ” reads the analysis published by Kaspersky.

Archiving 98

Archiving File names Government Libraries 98

Security Affairs

MAY 23, 2023

“The fake Skype installer was a.NET executable file named skype32.exe This may indicate that the actor is trying to protect some of its tools and avoid specific security solutions.” exe that was approximately 400 MB in size. ” The JackalControl Trojan allows threat actors to remotely control the target machine.

File names 86

File names Government Communications IT 86

Security Affairs

JANUARY 24, 2023

Crimew discovered a file named NoFly.csv which is a legitimate U.S. records (first names, last names, and dates of birth) belonging to people with suspected or known ties to terrorist groups. “three csv files, employee_information.csv, NOFLY.CSV and SELECTEE.CSV. no fly list from 2019 containing over 1.56

Archiving 94

Archiving File names Access Authentication 94

Security Affairs

SEPTEMBER 3, 2020

The malware communicates with the C2 communications via POST HTTP requests and uses RC4 encryption with a hardcoded key encoded with Base64. The new infection chain starts by including just one LNK file in the ZIP archive attached to spear-phishing messages. The PyVil RAT stores the malware settings (i.e. Pierluigi Paganini.

Phishing 139

Phishing Encryption File names Metadata 139

Security Affairs

NOVEMBER 17, 2020

Security experts at BitDefender have uncovered a new China-linked cyber espionage group, tracked as FunnyDream that has already infected more than 200 systems across Southeast Asia over the past two years. ” The name of the group comes from a powerful backdoor employed in the attacks of the APT group. ” Pierluigi Paganini.

Government 110

Government File names Communications Access 110

Security Affairs

MAY 19, 2021

“The National Cyber Security Centre (NCSC) became aware on Thursday of an attempted cyber attack on the Department of Health. ” reads an update published by the Irish Department of the Environment, Climate and Communications. FEEDC (extension added by Conti Ransomware to filenames of encrypted files) – *.msi

Ransomware 87

Ransomware Encryption File names IoT 87

Security Affairs

MARCH 3, 2020

The Kimsuky APT group has been analyzed by several security teams. Hash 757dfeacabf4c2f771147159d26117818354af14050e6ba42cc00f4a3d58e51f Threat Kimsuky loader Brief Description Scr file, initial loader Ssdeep 12288:APWcT1z2aKqkP/mANd2JiEWKZ52zfeCkIAYfLeXcj6uuLl:uhT1z4q030JigZUaULeXc3uLl. Figure 1: tweet on 28 February 2020.

IT 131

IT File names Libraries Communications 131

Security Affairs

MARCH 30, 2020

“Current malspam campaigns feature booby-trapped document files named “COVID 19 relief” and subject lines relying on the same theme. Sphinx’s targets have not changed from its past configuration files as it continues to focus on banks in the US, Canada, and Australia.” ” continues the post.”Next,

File names 104

File names Passwords Sales Authentication 104

Security Affairs

JUNE 15, 2019

“In this new attack, the threat actor first externally scans a given IP range by sending a TCP SYN packet to port 2375, the default port used for communicating with the Docker daemon.” “The output of this command is saved into a file named ips.txt, which is then fed into the Docker.exe file.

File names 96

File names Mining Access Communications 96

Security Affairs

MARCH 11, 2019

. “These tasks include showing a fake Windows Update screen, disabling Windows Defender, and blocking access to security sites by adding entries to Windows’s HOSTS file.” The Promorad Ransomware variant samples tested by the experts also download a file named 5.exe exe and executed it.

Encryption 87

Encryption Ransomware Passwords File names 87

Security Affairs

MAY 18, 2021

On execution of the Simps binary, it drops a log file containing that the device has been infected with malware by Simps Botnet (see Figure 2). Figure 2: Dropped log file. Figure 3: C2 communication. Figure 10: keksec.infected.you.log file. The binary also connects to the C2 23.95.80[.]200 200 (see figure 3).

IoT 129

IoT File names Communications Security 129

Security Affairs

APRIL 14, 2020

a United States defense research entity, a Turkish government agency managing public works, several large technology and communications firms headquartered in Canada, Germany, and the United Kingdom, and medical organizations/medical research facilities located in Japan and Canada). ” reads the analysis published by PaloAlto Networks.

Ransomware 119

Ransomware Phishing File names Encryption 119

Security Affairs

NOVEMBER 20, 2018

” Cannon acts as a downloader and relies on emails to communicate with the C2 server and receive instructions. Hackers used weaponized files named ‘crash list (Lion Air Boeing 737).docx’ Security Affairs – Sofacy APT, Cannot tool). docx’ for their campaigns. Pierluigi Paganini.

File names 79

File names Phishing Communications Government 79

Security Affairs

MARCH 1, 2019

“This Gh0st RAT sample communicated with IP address 43 [. ] In all the cases, attackers deliver a WinRAR self-extracting (SFX) file that installs the SysUpdate stage 1 payload, that gains persistence and downloads and executes the second stage payload, SysUpdate Main. Windows NT 6.3; ” continues the analysis.

IT 79

IT File names Financial Services Communications 79

Security Affairs

DECEMBER 17, 2019

The name Dacls comes from its file name and the hard-coded strings, the malware has a modular structure that could extend its capabilities by loading plugins. “With connection proxy, the number of target host connections can be reduced, and the communication between the target and the real C2 can be hidden.”

CMS 78

CMS File names Encryption Access 78

Security Affairs

APRIL 28, 2020

The executed crypto miner is the file named “” kswapd0 ” based on the famous XMRIG monero crypto miner. It is composed only by three files: “ a”, “run”, “stop ”. They are three bash scripts, which we start to analyze: Figure 10: Content of the “a” script file. The initial script is the file named “ a ”.

Mining 102

Mining File names Honeypots IT 102

Security Affairs

MARCH 2, 2019

This is part of a giant list of Living off the Land (LOL) techniques that attackers employ to mask their activities from runtime endpoint security monitoring tools such as AVs. The first port is used to maintain communications between C2 and clients. File name: patent-2019-02-20T093A283A05-1.xls Technical Analysis.

File names 87

File names Phishing Libraries IT 87

Security Affairs

JANUARY 9, 2020

The malware did not have an encryption/decryption routine for network communication a circumstance that suggest it was still under development. One victim was compromised by Windows AppleJeus malware in March 2019, experts determined that the infection started from a malicious file named WFCUpdater.exe. Pierluigi Paganini.

File names 63

File names Encryption Authentication Communications 63

Security Affairs

MAY 29, 2019

Once the macro is executed, the malware downloads two files from “kentona[.su”, su”, using an SSL encrypted communication, and stores them in “C:UsersPublic” path: “ rtegre.exe ” and “ wprgxyeqd79.exe The post TA505 is expanding its operations appeared first on Security Affairs. Example of junk instructions used in macro.

IT 70

IT Retail Archiving File names 70

Security Affairs

MAY 7, 2019

The recent, unattended discovery of such kind of sample within the Info-Sec community led us to a deep dive into this particular malware tool, spearhead of a sophisticated cyber arsenal. The executable sample is a PE32 x86 file named “tester.exe”. Figure 5: “msxfs.dll”, library required by malware to communicate with ATM device.

Libraries 62

Libraries e-Discovery Communications File names 62

OneHub

AUGUST 17, 2021

Educate them on the issues that information silos are causing within your organization, and lay out the steps you plan to take to heal these divisions by increasing communication and cooperation. Online storage and file sharing. If your company isn’t already using online file storage, now is the perfect time to start.

Cloud 52

Cloud File names Access Education 52

eSecurity Planet

AUGUST 10, 2023

Here are our picks for the top threat intelligence feeds that security teams should consider adding to their defensive arsenal: AlienVault Open Threat Exchange: Best for community-driven threat feeds FBI InfraGard: Best for critical infrastructure security abuse.ch

Cybersecurity 95

Cybersecurity Access Metadata Energy and Utilities 95

Security Affairs

MARCH 17, 2020

The script creates a new file named “ pinumber.vbs ” and starts filling it with the instructions through the “echo” function appending the strings to the next vbs stage. An evidence about the presence of the malicious file hosted on the legit website is shown in the following figure: Figure 5: Communication with the DropUrl.

Archiving 131

Archiving Passwords Encryption IT 131

Security Affairs

DECEMBER 4, 2018

Security experts at Yoroi – Cybaze Z-Lab discovered a new variant of the infamous Ursnif malware targeted Italian users through a malspam campaign. The beaconing pattern recognized in the C2 communication is consistent with Gozi/Ursnif/IFSB/Dreambot malware variants. Introduction. Figure 6: C2 network traffic.

Archiving 76

Archiving File names Libraries Communications 76

Security Affairs

JULY 8, 2019

Surely the presence of an ISO file as attachment is suspicious, but for an unaware user it could go unnoticed, also thanks to the new Windows versions which natively support the filetype. Extracting the content of the ISO image, we encounter an EXE file named “po-ima0948436.exe”. Malware attempt to communicate.

File names 70

File names Encryption Archiving Phishing 70