article thumbnail

Russia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 Windows flaw

Security Affairs

Russia-linked APT28 group used a previously unknown tool, dubbed GooseEgg, to exploit Windows Print Spooler service flaw. Microsoft reported that the Russia-linked APT28 group (aka “ Forest Blizzard ”, “ Fancybear ” or “ Strontium ” used a previously unknown tool, dubbed GooseEgg, to exploit the Windows Print Spooler flaw CVE-2022-38028.

Military 120
article thumbnail

Vice Society ransomware gang is using a custom locker

Security Affairs

The Vice Society ransomware group has adopted new custom ransomware, with a strong encryption scheme, in recent intrusions. This group focuses on public school districts and other educational institutions, like other ransomware gangs it implements a double extortion model and publishes data stolen from the victims on a data leak site.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Iran-linked MERCURY APT behind destructive attacks on hybrid environments

Security Affairs

Iran-linked APT group MERCURY is behind destructive attacks on hybrid environments masquerading as a ransomware operation. The Microsoft Threat Intelligence team observed a series of destructive attacks on hybrid environments that were carried out by MuddyWater APT group (aka MERCURY ). Both groups used MULLVAD VPN.

article thumbnail

New Linux Ransomware BlackSuit is similar to Royal ransomware

Security Affairs

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. ReadMe file name: README.BlackSuit.txt. New #ransomware #BlackSuit targets Windows, #Linux. Extension: blacksuit.

article thumbnail

ToxicEye RAT exploits Telegram communications to steal data from victims

Security Affairs

A Telegram bot account is a special remote account with which users can interact by Telegram chat or by adding them to Telegram groups, or by sending requests directly from the input field by typing the bot’s Telegram username and a query.” ” reads the analysis published by CheckPoint. ” concludes the report.

article thumbnail

Medibank Defends its Security Practices as its Ransomware Woes Worsen

IT Governance

Australia’s Home Affairs Minister Clare O’Neil rushed to Medibank’s defence , praising the organisation for refusing to pay the criminal’s ransom, while calling the group responsible “scumbags” and “disgraceful human beings”. The first was damaging enough, containing patients’ names, addresses and birthdates. From bad to worse.

IT 107
article thumbnail

Break Down Information Silos With Cloud Storage and File Sharing

OneHub

It’s normal to group people by specialty for efficiency’s sake, but a silo forms when those departments become cliquish. Educate them on the issues that information silos are causing within your organization, and lay out the steps you plan to take to heal these divisions by increasing communication and cooperation.

Cloud 52