Security Affairs

JUNE 15, 2023

The Gamaredon APT group (aka Shuckworm, Actinium, Armageddon, Primitive Bear, UAC-0010, and Trident Ursa) continues to carry out attacks against entities in Ukraine, including security services, military, and government organizations. ” reads the report published by Symantec.

Military 88

Military File names Archiving Phishing 88

Security Affairs

MARCH 28, 2022

” This second archive contains SFX-archive “Saboteurs filercs.rar,” experts reported that the file name contains the right-to-left override (RTLO) character to mask the real extension. ” reads the advisory published by CERT-UA. CERT-UA also published Indicators of Compromise for the recent campaign.

Archiving 95

Archiving CMS File names Phishing 95

Security Affairs

OCTOBER 10, 2018

A previously unknown cyber espionage group, tracked as Gallmaker, has been targeting entities in the government, military and defense sectors since at least 2017. Gallmaker is a politically motivated APT group that focused its surgical operations on the government, military or defense sectors. ” continues Symantec.

Military 83

Military File names Libraries Government 83

Security Affairs

OCTOBER 28, 2019

Precision engineering is a very important business market in Europe, it includes developing mechanical equipment for: automotive, railways, heavy industries and military grade technology. Basically the attacker asks to the victims to quote the entire list of spear-parts included in an attached Excel document. Technical Analysis.

Passwords 46

Passwords Encryption File names Military 46

Security Affairs

MARCH 28, 2019

The attackers used decoy documents apparently coming from the Council on Social Work Education (CSWE), a US association representing social work education. “To avoid user suspicion, the ACE file contains a decoy document, “Letter of Approval.pdf”, which purports to be from CSWE, the Council on Social Work Education as shown in Figure 1.

Archiving 84

Archiving File names Education Libraries 84

Security Affairs

JUNE 4, 2019

During recent times, Gamaredon is targeting the Ukrainian military and law enforcement sectors too, as officially stated by the CERT-UA. cmd ” file. At the same time, the extracted document will be shown in order to divert the user attention and to continue the infection unnoticed. However, the file named “ win32.sys

Archiving 64

Archiving Passwords File names Military 64