AIIM

JULY 8, 2021

This strategy can help keep project files organized among team members and aid in the disposition of documents once a project has been completed. Discovering content on an employee’s workstation by examining meta-data criteria such as file name, type, or age. social security numbers, customer information, etc.).

File names 200

File names Data breaches Risk Privacy 200

Security Affairs

MAY 20, 2021

The Java-based STRRAT RAT was distributed in a massive spam campaign, the malware shows ransomware-like behavior of appending the file name extension.crimson to files without actually encrypting them. STRRAT RAT was first spotted in June 2020 by G DATA who documented its features.

Ransomware 134

Ransomware File names Encryption Passwords 134

Security Affairs

OCTOBER 24, 2022

The phishing messages included a link to a third-party website for downloading a document titled ‘?????_309.pdf’ pdf’ The web page was crafted to trick the reader into updating the software (PDF Reader) to read the document.

Ransomware 106

Ransomware Phishing File names IT 106

Security Affairs

DECEMBER 23, 2021

The CVE-2021-40444 is a remote code execution security flaw that affected the MSHTML file format. An attacker looking to exploit the bug needs to trick the indented victim into opening a maliciously crafted document. The spam messages use an archive file named Profile.rar, the characteristic of this archive is that had been malformed.

Archiving 141

Archiving File names Ransomware Security 141

Security Affairs

AUGUST 23, 2023

In September 2022, ESET researchers first documented a malicious update to the Cobra DocGuard Client that was used to compromise a gambling company in Hong Kong. “The update.zip file is a zlib compressed archive file. It decompresses and executes a file named content.dll. This file is not saved on disk.

File names 91

File names Encryption Archiving Information Security 91

Info Source

AUGUST 2, 2018

. – July 31, 2018 – Epson America, a leading provider of digital imaging solutions, today introduced the WorkForce ® ES-300WR and WorkForce ES-500WR document scanners bundled with Epson’s ScanSmart Accounting Edition Software 1 and Nuance ® Power PDF software.

Computer and Electronics 40

Computer and Electronics File names Cloud IT 40

National Archives Records Express

JULY 24, 2023

Scanning and Imaging When scanning documents, agencies should use appropriate hardware and software to ensure high-quality images. Technical attributes, such as resolution, color depth, and file formats, must meet the technical standards in the regulation and the specific needs of the records.

Metadata 97

Metadata Digital preservation Archiving Data migration 97

Security Affairs

MAY 10, 2023

The researchers noticed that the malware does not share any code similarities with previously known malware families, they also reported that the domain and IP addresses involved in the attacks were not involved in any previously documented incidents. ” The threat actors sent spear-phishing messages with diplomat-themed lure documents.

File names 97

File names Archiving Phishing Government 97

Info Source

OCTOBER 21, 2020

Accelerate Digital Transformation with Instant, Enterprise-Wide Document Searching. document management software featuring both document and folder-level indexes, advanced search, DocuSign eSignature integration and other new features for increased productivity, and agility. Instant Document Search & Retrieval.

Digital transformation 52

Digital transformation File names Metadata Access 52

Security Affairs

DECEMBER 26, 2020

The REvil ransomware operators have published some pictures of the hacked systems on their leak site hosted on the Tor Network, they claims to have stolen about 600 GB of documents. TMG OFFICIAL Documents – 50??” Stolen data includes personal data of customers along with intimate photos of these customers.

Ransomware 125

Ransomware Personal data File names Security 125

Security Affairs

MARCH 15, 2020

Researchers from MalwareHunterTeam discovered a suspicious RAR file named “COVID-19-” that was being distributed online, likely through phishing emails. "Important The RAR archive contains a file named “Important – COVID-19” that displays a Word icon. "Important – COVID-19.rar"

Communications 123

Communications File names Archiving Phishing 123

Security Affairs

MARCH 3, 2020

Hash 757dfeacabf4c2f771147159d26117818354af14050e6ba42cc00f4a3d58e51f Threat Kimsuky loader Brief Description Scr file, initial loader Ssdeep 12288:APWcT1z2aKqkP/mANd2JiEWKZ52zfeCkIAYfLeXcj6uuLl:uhT1z4q030JigZUaULeXc3uLl. Figure 2: Written file (AutoUpdate.dll) in the “%AppData%LocalTemp” path. Figure 6: Legit document overview.

IT 138

IT File names Libraries Communications 138

OneHub

DECEMBER 17, 2020

Tired of digging through an endless sea of folders and files to find that one document you need? In addition to costing your company money and stressing out your employees, a poor file structure can jeopardize the security of your files and make onboarding new hires a messy process. Establish file-naming conventions.

File names 52

File names Archiving Marketing Cloud 52

Security Affairs

JUNE 26, 2021

The provided sample of exfiltrated files includes business data and documents, as well as Argus certificates and development files. The sample archive is password protected – but the file names and types are clearly visible. Altus Group has been informed about the new development.

Ransomware 115

Ransomware File names Archiving Encryption 115

Security Affairs

JUNE 5, 2021

“The WHOIS information for the domain reveals that the domain of the BlackCocaine ransomware was registered on May 28, 2021” The researchers reported that a file named a.BlackCocaine was recently submitted to different public sandboxes. BlackCocaine ” to the filenames of encrypted files. . Pierluigi Paganini.

Ransomware 137

Ransomware Encryption File names Financial Services 137

Security Affairs

FEBRUARY 13, 2023

“The other file Interview conditions.word.exe contains the first stage Enigma loader. This file, which also masquerades as a legitimate word document, is designed to lure unsuspecting victims into executing the loader. This approach allows the attacker to continuously update and eliminates reliance on fixed file names.”

Archiving 93

Archiving File names Libraries Phishing 93

Security Affairs

FEBRUARY 23, 2020

The threat actor uses phishing messages with weaponized Microsoft Office documents to deliver the RAT. The malicious documents trick victims into inserting a password contained in the message to view their contents. The maldocs used in this campaign have benign file names such as “Company-Terms.doc”, “DOT_JD_GM.doc.”

Government 128

Government File names Passwords Phishing 128

Security Affairs

MAY 26, 2019

The company was hacked and attackers stole data and offered business plans, financial documents, and personal information for free on the dark web. The name ‘Boris’ is not new for the cyber security industry, it is the name of the hacker who breached the IT provider CityComp at the end of April.

File names 77

File names Data breaches Manufacturing Cybersecurity 77

Security Affairs

MARCH 28, 2022

” This second archive contains SFX-archive “Saboteurs filercs.rar,” experts reported that the file name contains the right-to-left override (RTLO) character to mask the real extension. ” reads the advisory published by CERT-UA.

Archiving 98

Archiving CMS File names Phishing 98

Security Affairs

JULY 8, 2023

TA453 in May 2023 started using LNK infection chains instead of Microsoft Word documents with macros. At the provided URL, a password-encrypted.rar file named “Abraham Accords & MENA.rar” was hosted. The.rar archive contained a dropper named “Abraham Accords & MENA.pdf.lnk.”

Archiving 98

Archiving Cloud File names Metadata 98

Security Affairs

MAY 29, 2020

The sample used in this campaign first uses word document which refers to an executable, then it drops another executable and does a renaming operations to evade controls. Table 1: Static information about the Malicious document. Thus, once clicked, it allows this malicious document to execute a malicious file named HimeraLoader.exe.

File names 91

File names Phishing IT Marketing 91

Security Affairs

JANUARY 12, 2022

The new variant discovered by Fortinet has the file name “Omicron Stats.exe,” threat actors are attempting to exploit the enormous interest on a global scale on the COVID-19 Omicron variant. Like other COVID-19 themed malspam campaigns, the infection chain starts by opening a weaponized document used as an attachment.

Manufacturing 143

Manufacturing File names Archiving Encryption 143

Security Affairs

OCTOBER 31, 2020

Recent spam campaigns used messages with malicious Word documents, or links to them, pretending to be an invoice, shipping information, COVID-19 information , resumes, financial documents, or scanned documents. doc) attachments or include links to download the bait document. The spam messages come with malicious Word (.doc)

File names 106

File names Libraries Ransomware Security 106

Security Affairs

JUNE 15, 2023

Researchers from Symantec, part of Broadcom, blogged about Backdoor.Pterodo in April 2022 , documenting how we had found four variants of the backdoor with similar functionality.” ” The PowerShell script is used in recent attacks first copy itself onto the infected systems and create a shortcut file using an rtk.lnk extension. .”

Military 94

Military File names Archiving Phishing 94

Security Affairs

APRIL 18, 2021

When a target was convinced to open the documents tied to the spam email, their computer quickly became infected with BazarLoader, which itself acts primarily as a delivery mechanism for other malware.” Some of the files’ names observed by the experts are presentation-document.exe, preview-document-[number].exe

File names 117

File names Ransomware Phishing Encryption 117

Security Affairs

MARCH 3, 2020

Nemty ransomware first appeared on the threat landscape in August 2019, the name of the malware comes after the extension it adds to the encrypted file names. The ransomware deletes shadow copies of encrypted files to make in impossible any recovery procedure. they also announced a working tool for version 1.5.

Ransomware 109

Ransomware File names Encryption Archiving 109

Security Affairs

SEPTEMBER 12, 2022

“On September 11, 2022, the bad actors who previously published a list of file names from this security incident to the dark web, posted the actual contents of the same files to the same location on the dark web. The content of these files match what we already identified and disclosed.”

Ransomware 106

Ransomware IT Authentication File names 106

Security Affairs

DECEMBER 20, 2018

. “Even without an enumeration vector, this is still bad news, because a lot of document software, like office, will actually keep files in static locations that contain the full path and file names of recently opened documents.,” ” explained the expert.

File names 99

File names Security IT 99

Security Affairs

MAY 23, 2023

“The fake Skype installer was a.NET executable file named skype32.exe “The other known infection vector was a malicious document that uses the remote template injection technique to download a malicious HTML page, which exploits the Follina vulnerability.” exe that was approximately 400 MB in size.

File names 93

File names Government Communications IT 93

Security Affairs

MARCH 30, 2020

“Current malspam campaigns feature booby-trapped document files named “COVID 19 relief” and subject lines relying on the same theme. Sphinx’s targets have not changed from its past configuration files as it continues to focus on banks in the US, Canada, and Australia.” ” continues the post.”Next,

File names 109

File names Passwords Sales Authentication 109

Security Affairs

FEBRUARY 26, 2020

Threat actors are using fear and panic caused by the spread of the virus to deliver their malicious artifacts and increase the number of infected victims, making it look like a “Coronavirus countermeasures” document. then delivered in China regions spread via a malicious decoy document, emphasizing the opportunistic nature of these attacks.

File names 125

File names Communications Encryption IT 125

eSecurity Planet

JULY 19, 2022

According to Cyble, “The ransomware searches for files to encrypt on the local system by enumerating the file directories […] It ignores the file extensions such as EXE, DLL, and SYS and excludes a list of directory and file names from the encryption process.”.

Ransomware 109

Ransomware Encryption File names Government 109

Security Affairs

JULY 1, 2019

In attacks observed on June 17, the malware was using 64-bit DLLs with file names loaded by legitimate Windows system executables. Duncan pointed out that file paths, file names, and associated hashes would change at every computer login. com domain to download the Dridex installer.

File names 83

File names Encryption Security Access 83

Security Affairs

JULY 14, 2021

The Dropbox link leads to a RAR archive that masquerades as a Word document by setting the “file_subpath” parameter to point to a filename with a.DOCX extension. “The archive contains two malicious DLL libraries as well as two legitimate executables that sideload the DLL files.

Archiving 98

Archiving File names Government Libraries 98

Security Affairs

APRIL 24, 2021

. “The bot is embedded into the ToxicEye RAT configuration file and compiled into an executable file (an example of a file name we found was ‘paypal checker by saint.exe’).

Communications 121

Communications File names Encryption Education 121

IT Governance

AUGUST 10, 2021

A few months ago, we reported on a phishing scam that purportedly asked recipients to provide a signature on a SharePoint document. The scam campaign can be identified by its repeated reference to email “referrals” and the fact that they appear to contain a document that has been shared by a colleague.

Phishing 111

Phishing File names Security Risk 111

Security Affairs

NOVEMBER 20, 2018

Experts at Palo Alto Networks spotted a new campaign in late October and early November, spear-phishing messages used Word documents that loaded remote templates embedded with a malicious macro code. The macros used for these delivery documents use a less common method of using the AutoClose function. docx’ for their campaigns.

File names 84

File names Phishing Communications Government 84