article thumbnail

Attackers Increasingly Adopting Regsvr32 Utility Execution Via Office Documents

Security Affairs

exe heavily via various types of Microsoft Office documents. Regsvr32 is a Microsoft-signed command line utility in Windows which allows users to register and unregister DLLs (Dynamic Link Library). Microsoft Word/Rich Text Format data/Composite Document —. SecurityAffairs – hacking, REvil ransomware). Pierluigi Paganini.

article thumbnail

Hive ransomware gang starts leaking data allegedly stolen from Tata Power

Security Affairs

The Hive ransomware gang, which claimed the responsibility for the Tata Power data breach, started leaking data. Now the ransomware gang Hive started leaking the alleged stolen files on its Tor leak site. The main difference between the new variant of the Hive ransomware and old ones is the programming language used by the operators.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Patch Tuesday, May 2024 Edition

Krebs on Security

CVE-2024-30051 is an “elevation of privilege” bug in a core Windows library. Qbot and Pinkslipbot ) has morphed into an advanced malware strain now used by multiple cybercriminal groups to prepare newly compromised networks for ransomware infestations. First, the zero-days.

Libraries 212
article thumbnail

Raspberry Robin operators are selling initial access to compromised enterprise networks to ransomware gangs

Security Affairs

DEV-0950 group used Clop ransomware to encrypt the network of organizations previously infected with the Raspberry Robin worm. Microsoft has discovered recent activity that links the Raspberry Robin worm to human-operated ransomware attacks. . The final-stage malware was the Clop ransomware. exe to execute a malicious command.

article thumbnail

Cyber Authorities Sound The Alarm On Critical Vulnerability In Java Library

Data Protection Report

Exploited systems are at risk for ransomware, data exfiltration, cryptomining, and other malicious activities perpetrated by criminal organizations and nation-state actors. Knowledgeable counsel should be involved through all steps of the company’s assessments, containment, remediation, and documentation.

article thumbnail

A Microsoft 365 feature can ransom files on SharePoint and OneDriveCould

Security Affairs

“Proofpoint has discovered a potentially dangerous piece of functionality in Office 365 or Microsoft 365 that allows ransomware to encrypt files stored on SharePoint and OneDrive in a way that makes them unrecoverable without dedicated backups or a decryption key from the attacker.” ” reads the post published by Proofpoint.

article thumbnail

CERT France – Pysa ransomware is targeting local governments

Security Affairs

CERT France is warning of a new wave of attacks using Pysa ransomware (Mespinoza) that is targeting local governments. CERT France cyber-security agency is warning about a new wave of ransomware attack that is targeting the networks of local government authorities. pysa file extension that gives the name to this piece ransomware.