Education, Groups and Tools - Information Management Today

Russia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 Windows flaw

Security Affairs

APRIL 22, 2024

Russia-linked APT28 group used a previously unknown tool, dubbed GooseEgg, to exploit Windows Print Spooler service flaw. Since at least June 2020, and possibly earlier, the cyberespionage group has used the tool GooseEgg to exploit the CVE-2022-38028 vulnerability.

Military

Military File names Education Phishing

China-linked APT41 group spotted using open-source red teaming tool GC2

Security Affairs

APRIL 17, 2023

China-linked APT41 group used the open-source red teaming tool GC2 in an attack against a Taiwanese media organization. Google Threat Analysis Group (TAG) team reported that the China-linked APT41 group used the open-source red teaming tool Google Command and Control ( GC2 ) in an attack against an unnamed Taiwanese media organization.

Phishing

Phishing Cloud Government Education

Bl00dy Ransomware Gang actively targets the education sector exploiting PaperCut RCE

Security Affairs

MAY 12, 2023

CISA and FBI warned of attacks conducted by the Bl00dy Ransomware Gang against the education sector in the country. The FBI and CISA issued a joint advisory warning that the Bl00dy Ransomware group is actively targeting the education sector by exploiting the PaperCut remote-code execution vulnerability CVE-2023-27350.

Education

Education Ransomware Encryption Communications

Webinars

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

MORE WEBINARS

CISA adds Microsoft Windows Print Spooler flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

APRIL 25, 2024

Cisa added the flaw to the KEV catalog after Microsoft reported that the Russia-linked APT28 group (aka “ Forest Blizzard ”, “ Fancybear ” or “ Strontium ” used a previously unknown tool, dubbed GooseEgg, to exploit the Windows Print Spooler flaw CVE-2022-38028.

IT

IT Education Cybersecurity Risk

AuKill tool uses BYOVD attack to disable EDR software

Security Affairs

APRIL 24, 2023

Ransomware operators use the AuKill tool to disable EDR software through Bring Your Own Vulnerable Driver (BYOVD) attack. Sophos researchers reported that threat actors are using a previously undocumented defense evasion tool, dubbed AuKill, to disable endpoint detection and response (EDR) software.

Ransomware

Ransomware Education Security Cybersecurity

Vice Society gang is using a custom PowerShell tool for data exfiltration

Security Affairs

APRIL 17, 2023

Vice Society ransomware operators have been spotted using a PowerShell tool to exfiltrate data from compromised networks. Threat actors are using the PowerShell tool to evade software and/or human-based security detection mechanisms. The CreateJobLocal function receives groups of directories, often in groups of five.

Ransomware

Ransomware Education Cybersecurity Security

Ransomware Groups Turn to Intermittent Encryption to Speed Attack Times

eSecurity Planet

SEPTEMBER 22, 2022

To accelerate the ransomware encryption process and make it harder to detect, cybercriminal groups have begun using a new technique: intermittent encryption. Sentinel Labs reported the new trend earlier this month, as ransomware groups have adopted the latest technology. Some are written on Go and can be customized.

Encryption

Encryption Ransomware Cybersecurity Education

Pro-Russia group NoName057(16) targets Ukraine and NATO countries

Security Affairs

JANUARY 13, 2023

A Pro-Russian group named NoName057(16) is targeting organizations in Ukraine and NATO countries with DDoS attacks. A Pro-Russian cybercrime group named NoName057 (16) (aka 05716nnm or Nnm05716) is behind a wave of DDoS attacks against organizations in Ukraine and NATO countries, SentinelOne researchers reported.

Education

Education Government Security IT

What Is TOGAF? The Open Group Architecture Framework

erwin

JULY 16, 2020

The Open Group Architecture Framework (TOGAF) is a type of enterprise architecture (EA) framework. Where enterprise architecture is concerned, an “enterprise” refers to any organization or groups of organizations working toward a common goal. At the heart of The Open Group’s Framework is the Architecture Development Method (ADM).

e-Delivery

e-Delivery Education Communications Government

FBI and CISA warn of attacks by Rhysida ransomware gang

Security Affairs

NOVEMBER 15, 2023

The FBI and CISA warn of attacks carried out by the Rhysida ransomware group against organizations across multiple industry sectors. The report is part of the ongoing #StopRansomware effort that disseminates advisories about tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with ransomware groups.

Ransomware

Ransomware Manufacturing Education Passwords

Purple Lambert, a new malware of CIA-linked Lambert APT group

Security Affairs

APRIL 29, 2021

Experts from Kaspersky explained that in February 2019, multiple antivirus companies received a collection of malware samples, some of them cannot be associated with the activity of known APT groups. . These malware strains did not present any similarities with malware associated with other APT groups.

Cybersecurity

Cybersecurity Government Education Security

Iranian Agonizing Serpens APT is targeting Israeli entities with destructive cyber attacks

Security Affairs

NOVEMBER 7, 2023

Iran-linked Agonizing Serpens group has been targeting Israeli organizations with destructive cyber attacks since January. The researchers observed the Unit 42 researchers using three previously unknown wipers named MultiLayer, PartialWasher, and a custom tool named Sqlextractor used to extract information from database servers.

Education

Education Ransomware Access Security

Linux Patch Management: Tools, Issues & Best Practices

eSecurity Planet

JUNE 21, 2023

Here we’ll discuss how patch management works on Linux, best practices, and the best patch management tools for Linux. There are patch management tools that can help manage all those operating systems and more; we’ll get to those later on. Also read: Patch Management vs Vulnerability Management: What’s the Difference?

Cloud

Cloud Security Risk Compliance

Role of Library and Knowledge Specialists in Moving Education and Training Online

CILIP

JULY 30, 2020

Role of Library and Knowledge Specialists in Moving Education and Training Online. This is a statement by the Information Literacy Group, a special interest group of the CILIP, the library and information association. You can find further information on the Information Literacy Group website. Published: 31 July 2020.

Libraries

Libraries Education

China-linked APT41 group exploits Citrix, Cisco, Zoho flaws

Security Affairs

MARCH 25, 2020

The China-linked group tracked as APT41 exploited vulnerabilities in Citrix, Cisco, and ManageEngine in a campaign on a global scale. The China-linked cyberespionage group tracked as APT41 exploited vulnerabilities in Citrix, Cisco, and Zoho ManageEngine in a campaign on a global scale. ” reads the advisory published by FireEye.

Healthcare

Healthcare Education Manufacturing Government

PYSA ransomware gang is the most active group in November

Security Affairs

DECEMBER 22, 2021

PYSA and Lockbit were the most active ransomware gangs in the threat landscape in November 2021, researchers from NCC Group report. Security researchers from NCC Group reported an increase in ransomware attacks in November 2021 over the past month, and PYSA (aka Mespinoza) and Lockbit were the most active ransomware gangs.

Ransomware

Ransomware Encryption Government Retail

Russian cybercrime group likely behind ongoing exploitation of PaperCut flaws

Security Affairs

APRIL 24, 2023

.” The researchers noticed that the domain hosting the tools employed in the attack, windowservicecemter[.]com, Truebot has been active since 2017 and some researchers linked it to the Russian Silence Group , while a recent investigation linked it to threat actor TA505 (aka Evil Corp). com, was registered on April 12, 2023.

Cybersecurity

Cybersecurity Ransomware Education Authentication

Is Gelsemium APT behind a targeted attack in Southeast Asian Government?

Security Affairs

SEPTEMBER 25, 2023

A stealthy APT group tracked as Gelsemium was observed targeting a Southeast Asian government between 2022 and 2023. Palo Alto Unit42 researchers an APT group tracked as Gelsemium targeting a Southeast Asian government. Gelsemium is a group focused on cyberespionage that has been active since at least 2014.

Government

Government Manufacturing Education Access

US cyber and law enforcement agencies warn of Phobos ransomware attacks

Security Affairs

MARCH 2, 2024

The attacks were observed as recently as February 2024, they targeted government, education, emergency services, healthcare, and other critical infrastructure sectors. Phobos intrusions also involved the use of various open-source tools, including Smokeloader, Cobalt Strike , and Bloodhound. ” reads the joint CSA.

Ransomware

Ransomware Education Phishing Authentication

GUEST ESSAY: 5 anti-phishing training tools that can reduce employees’ susceptibility to scams

The Last Watchdog

NOVEMBER 27, 2018

The good news is that companies today have ready access to a wide variety of tools that can simulate common types of attacks and boost employee awareness. This tool, from Cofense, proactively engages employees via simulated attacks based on real-time threats for various phishing tactics. Here’s a guide to five such services.

Phishing

Phishing Education Ransomware Security awareness

China-linked APT Volt Typhoon remained undetected for years in US infrastructure

Security Affairs

FEBRUARY 8, 2024

The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure. In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.

Energy and Utilities

Energy and Utilities Communications Military Manufacturing

China-linked Flax Typhoon APT targets Taiwan

Security Affairs

AUGUST 25, 2023

China-linked APT group Flax Typhoon targeted dozens of organizations in Taiwan as part of a suspected espionage campaign. The group relies on tools built into the operating system, along with some legitimate software. The group primarily relies on living-off-the-land techniques and hands-on-keyboard activity.

Manufacturing

Manufacturing Education Access Government

Symantec uncovered the link between China-Linked Thrip and Billbug groups

Security Affairs

SEPTEMBER 9, 2019

The China-linked APT group Thrip is continuing to target entities in Southeast Asia even after its activity was uncovered by Symantec. Experts at Symantec first exposed the activity of the Chinese-linked APT Thrip in 2018, now the security firm confirms that cyber espionage group has continued to carry out attacks in South East Asia.

Military

Military Communications Government Education

Russia-Linked Turla APT group Hijacked C2 of the Iranian OilRig

Security Affairs

JUNE 21, 2019

Russia-Linked cyberespionage group Turla uses a new toolset and hijacked command and control infrastructure operated by Iran-Linked OilRig APT. Russia-linked Turla cyberspies used a new set of tools in new attacks and hijacked command and control infrastructure operated by Iran-Linked OilRig APT.

Communications

Communications Government Data collection Education

At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s Email Software

Krebs on Security

MARCH 5, 2021

The espionage group is exploiting four newly-discovered flaws in Microsoft Exchange Server email software, and has seeded hundreds of thousands of victim organizations worldwide with tools that give the attackers total, remote control over affected systems. based Volexity for reporting the vulnerabilities.

Cleanup

Cleanup Cybersecurity Government Cloud

Akira ransomware received $42M in ransom payments from over 250 victims

Security Affairs

APRIL 21, 2024

The Akira ransomware has been active since March 2023, the threat actors behind the malware claim to have already hacked multiple organizations in multiple industries, including education, finance, and real estate. Like other ransomware gangs, the group has developed a Linux encryptor to target VMware ESXi servers.

Ransomware

Ransomware Encryption Education Phishing

National Student Clearinghouse data breach impacted approximately 900 US schools

Security Affairs

SEPTEMBER 24, 2023

educational nonprofit organization National Student Clearinghouse disclosed a data breach that impacted approximately 900 US schools. MOVEit Transfer is a file transfer tool used by many organizations, including the Clearinghouse, to support the transfer of data files.” We have also coordinated with law enforcement.

Data breaches

Data breaches Education Ransomware Cybersecurity

FBI chief says China is preparing to attack US critical infrastructure

Security Affairs

APRIL 19, 2024

The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure. In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.

Energy and Utilities

Energy and Utilities Communications Military Manufacturing

Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability

Krebs on Security

OCTOBER 14, 2021

Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. On Wednesday, the St. In a press conference this morning, Missouri Gov. ” Missouri Gov.

Security

Security Education Computer and Electronics Access

Operation Cronos: law enforcement disrupted the LockBit operation

Security Affairs

FEBRUARY 19, 2024

Lockbit ransomware group administrative staff has confirmed with us their websites have been seized. In 2022, LockBit was one of the most active ransomware groups, and its prevalence continued into 2023. According to a joint report published by US authorities and international peers, the total of U.S. on January 5, 2020.

Energy and Utilities

Energy and Utilities Ransomware Agriculture Financial Services

Episode 253: DevSecOps Worst Practices With Tanya Janca of We Hack Purple

The Security Ledger

OCTOBER 4, 2023

Tanya Janca of the group We Hack Purple, talks with Security Ledger host Paul Roberts about the biggest security mistakes that DevSecOps teams make, and application development’s “tragedy of the commons,” as more and more development teams lean on open source code. The post Episode 253: DevSecOps Worst Practices With Tanya Janca of We Hack.

Education

Education IoT Security IT

City of Dallas has set a budget of $8.5 million to mitigate the May Royal ransomware attack

Security Affairs

SEPTEMBER 23, 2023

MILES/CBS NEWS TEXAS The Royal ransomware group is behind the attack and threatens to publish stolen data if the City will not meet its ransom demand. Once obtained access to the City’s network, the group performed reconnaissance and information-gathering activities using legitimate third-party remote management tools.

Ransomware

Ransomware Encryption Systems administration Cybersecurity

DarkSide Ransomware Gang Quits After Servers, Bitcoin Stash Seized

Krebs on Security

MAY 14, 2021

The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from an account the group uses to pay affiliates. ” DarkSide organizers also said they were releasing decryption tools for all of the companies that have been ransomed but which haven’t yet paid.

Ransomware

Ransomware Education Communications Access

News alert: SandboxAQ launches new open source framework to simplify cryptography management

The Last Watchdog

AUGUST 8, 2023

Steel “Modern cryptography management and cryptographic agility are essential for organizations of all sizes; however, there has been a distinct lack of open-source tools for developers to support these features,” said Graham Steel, Head of Product for SandboxAQ’s security group. SandboxAQ is backed by T.

Libraries

Libraries Encryption Access Cybersecurity

Researchers Quietly Cracked Zeppelin Ransomware Keys

Krebs on Security

NOVEMBER 17, 2022

There are multiple examples of ransomware groups doing just that after security researchers crowed about finding vulnerabilities in their ransomware code. “These senseless acts of targeting those who are unable to respond are the motivation for this research, analysis, tools, and blog post.

Ransomware

Ransomware Encryption Manufacturing Phishing

LW ROUNDTABLE: Cybersecurity takeaways of 2023 — and what’s ahead in 2024 ( part 3)

The Last Watchdog

DECEMBER 14, 2023

Mehran Farimani , CEO, RapidFort Farimani A wide range of vulnerabilities are being introduced by AI development tools. In 2024, security teams will need to focus on developing automated tooling to shrink the range of issues that they need to address. Educate your workforce. Encourage them to share information.

Cybersecurity

Cybersecurity Encryption Marketing Risk

Akira ransomware gang spotted targeting Cisco VPN products to hack organizations

Security Affairs

AUGUST 22, 2023

The Akira ransomware has been active since March 2023, the threat actors behind the malware claim to have already hacked multiple organizations in multiple industries, including education, finance, and real estate. Like other ransomware gangs, the group has developed a Linux encryptor to target VMware ESXi servers.

Ransomware

Ransomware Education Encryption Authentication

The State of Maine disclosed a data breach that impacted 1.3M people

Security Affairs

NOVEMBER 12, 2023

The State of Maine was the victim of the large-scale hacking campaign that targeted organizations using the MOVEit file transfer tool. The software vulnerability was exploited by a group of cybercriminals and allowed them to access and download files belonging to certain agencies in the State of Maine between May 28, 2023, and May 29, 2023.”

Data breaches

Data breaches Insurance Education Cybersecurity

Cybersecurity agencies published a joint LockBit ransomware advisory

Security Affairs

JUNE 15, 2023

The LockBit ransomware group successfully extorted roughly $91 million from approximately 1,700 U.S. According to a joint advisory published by cybersecurity agencies, the LockBit ransomware group has successfully extorted roughly $91 million in about 1,700 attacks against U.S. organizations since 2020. organizations since 2020.

Ransomware

Ransomware Cybersecurity Agriculture Education

China-linked APT Volt Typhoon linked to KV-Botnet

Security Affairs

DECEMBER 13, 2023

The group managed to maintain access without being detected for as long as possible. The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure. The APT group is using almost exclusively living-off-the-land techniques and hands-on-keyboard activity to evade detection.

Communications

Communications Manufacturing Education Government

Connecting the Bots – Hancitor fuels Cuba Ransomware Operations

Security Affairs

MAY 7, 2021

Hancitor became another commodity malware which partnered with ransomware gangs to help them gain initial access to target networks – the increasing trend outlined by Group-IB researchers in the recent Ransomware Uncovered 2020/2021 report. In addition, the group leveraged some custom tools for network reconnaissance.

Ransomware

Ransomware Education Manufacturing Healthcare

Iran-linked Mint Sandstorm APT targeted US critical infrastructure

Security Affairs

APRIL 19, 2023

An Iran-linked APT group tracked as Mint Sandstorm is behind a string of attacks aimed at US critical infrastructure between late 2021 to mid-2022. The group rapidly weaponized N-day vulnerabilities in popular enterprise applications by using publicly disclosed POCs. ” reads the report published by Microsoft.

Energy and Utilities

Energy and Utilities Military Education Phishing

More details about Operation Cronos that disrupted Lockbit operation

Security Affairs

FEBRUARY 20, 2024

Lockbit ransomware group administrative staff has confirmed with us their websites have been seized. pic.twitter.com/SvpbeslrCd — vx-underground (@vxunderground) February 19, 2024 The operation led to the arrest of two members of the ransomware gang in Poland and Ukraine and the seizure of hundreds of crypto wallets used by the group.

Energy and Utilities

Energy and Utilities Ransomware Manufacturing Agriculture

Hunters International ransomware gang claims to have hacked the Fred Hutch Cancer Center

Security Affairs

DECEMBER 16, 2023

Its mission is to improve the lives of people worldwide through research, clinical care and education. ” The company implemented additional information technology security measures and deployed additional defensive tools and increased monitoring activities. Who is Hunters International?

Ransomware

Ransomware Insurance Education Marketing

Russia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 Windows flaw

China-linked APT41 group spotted using open-source red teaming tool GC2

Webinars

Trending Sources

Bl00dy Ransomware Gang actively targets the education sector exploiting PaperCut RCE

Webinars

CISA adds Microsoft Windows Print Spooler flaw to its Known Exploited Vulnerabilities catalog

AuKill tool uses BYOVD attack to disable EDR software

Vice Society gang is using a custom PowerShell tool for data exfiltration

Ransomware Groups Turn to Intermittent Encryption to Speed Attack Times

Pro-Russia group NoName057(16) targets Ukraine and NATO countries

What Is TOGAF? The Open Group Architecture Framework

FBI and CISA warn of attacks by Rhysida ransomware gang

Purple Lambert, a new malware of CIA-linked Lambert APT group

Iranian Agonizing Serpens APT is targeting Israeli entities with destructive cyber attacks

Linux Patch Management: Tools, Issues & Best Practices

Role of Library and Knowledge Specialists in Moving Education and Training Online

China-linked APT41 group exploits Citrix, Cisco, Zoho flaws

PYSA ransomware gang is the most active group in November

Russian cybercrime group likely behind ongoing exploitation of PaperCut flaws

Is Gelsemium APT behind a targeted attack in Southeast Asian Government?

US cyber and law enforcement agencies warn of Phobos ransomware attacks

GUEST ESSAY: 5 anti-phishing training tools that can reduce employees’ susceptibility to scams

China-linked APT Volt Typhoon remained undetected for years in US infrastructure

China-linked Flax Typhoon APT targets Taiwan

Symantec uncovered the link between China-Linked Thrip and Billbug groups

Russia-Linked Turla APT group Hijacked C2 of the Iranian OilRig

At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s Email Software

Akira ransomware received $42M in ransom payments from over 250 victims

National Student Clearinghouse data breach impacted approximately 900 US schools

FBI chief says China is preparing to attack US critical infrastructure

Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability

Operation Cronos: law enforcement disrupted the LockBit operation

Episode 253: DevSecOps Worst Practices With Tanya Janca of We Hack Purple

City of Dallas has set a budget of $8.5 million to mitigate the May Royal ransomware attack

DarkSide Ransomware Gang Quits After Servers, Bitcoin Stash Seized

News alert: SandboxAQ launches new open source framework to simplify cryptography management

Researchers Quietly Cracked Zeppelin Ransomware Keys

LW ROUNDTABLE: Cybersecurity takeaways of 2023 — and what’s ahead in 2024 ( part 3)

Akira ransomware gang spotted targeting Cisco VPN products to hack organizations

The State of Maine disclosed a data breach that impacted 1.3M people

Cybersecurity agencies published a joint LockBit ransomware advisory

China-linked APT Volt Typhoon linked to KV-Botnet

Connecting the Bots – Hancitor fuels Cuba Ransomware Operations

Iran-linked Mint Sandstorm APT targeted US critical infrastructure

More details about Operation Cronos that disrupted Lockbit operation

Hunters International ransomware gang claims to have hacked the Fred Hutch Cancer Center

Stay Connected