Remove Encryption Remove File names Remove Government Remove Libraries
article thumbnail

China-linked APT41 group targets Hong Kong with Spyder Loader

Security Affairs

Symantec pointed out that the attacks against government organizations in Hong Kong remained undetected for a year in some cases. Spyder Loader loads AES-encrypted blobs to create the wlbsctrl.dll which acts as a next-stage loader that executes the content. ” continues the report.

article thumbnail

China-linked Budworm APT returns to target a US entity

Security Affairs

The Budworm cyber espionage group (aka APT27 , Bronze Union , Emissary Panda , Lucky Mouse , TG-3390 , and Red Phoenix) is behind a series attacks conducted over the past six months against a number of high-profile targets, including the government of a Middle Eastern country, a multinational electronics manufacturer, and a U.S.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Crooks target Healthcare facilities involved in Coronavirus containment with Ransomware

Security Affairs

PaloAlto Networks experts warn of malicious Coronavirus themed phishing campaigns targeting government and medical organizations. Recently organizations in healthcare, research, and government facilities have been hit by Coronavirus-themed attacks that deployed multiple malware families, including ransomware and information stealers (i.e.

article thumbnail

Guarding Against Solorigate TTPs

eSecurity Planet

A March 2020 software update of the SolarWinds Orion management platform gave malicious actors unhindered access to key government and enterprise networks. Presenting itself as a JPG file named “gracious_truth.jpg,” Teardrop is a memory-only dropper built to enter a network seamlessly and replace the embedded payload.

article thumbnail

New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader

Security Affairs

Lampion was first documented in December 2019 , and it was distributed in Portugal via phishing emails using templates based on the Portuguese Government Finance & Tax. Here, it was distributed using fake webpages, where the victim downloaded an MSI file, which then held the remaining Lampion infection chain. zipEncrypted: r?