Security Affairs

SEPTEMBER 3, 2020

Attackers carried out spear-phishing emails using the Know Your Customer regulations (KYC) as a lure. The malware communicates with the C2 communications via POST HTTP requests and uses RC4 encryption with a hardcoded key encoded with Base64. The PyVil RAT was recently employed in attacks against FinTech companies across the U.K.

Phishing 139

Phishing Encryption File names Metadata 139

Security Affairs

JULY 8, 2023

The spear-phishing message appears as a benign conversation lure masquerading as a senior fellow with the Royal United Services Institute (RUSI) to the public media contact for a nuclear security expert at a US-based think tank focused on foreign affairs. The.rar archive contained a dropper named “Abraham Accords & MENA.pdf.lnk.”

Archiving 95

Archiving Cloud File names Metadata 95

Security Affairs

SEPTEMBER 12, 2019

Iran-linked Cobalt Dickens APT group carried out a spear-phishing campaign aimed at tens of universities worldwide. This operation is similar to the threat group’s August 2018 campaign , using compromised university resources to send library-themed phishing emails.” ” reads the analysis published by Secureworks.

Phishing 80

Phishing Libraries File names Metadata 80

Security Affairs

FEBRUARY 26, 2020

During our Threat Intelligence activities we noticed a suspicions artifact named “ CoronaVirusSafetyMeasures_pdf ”, so, intrigued by its name and by its recent submission on Yomi Hunter ( LINK ), we decided to deep dive into it. Probably, the infection vector was a phishing mail containing a specific attachment. exe” appeared.

File names 117

File names Communications Encryption IT 117

Security Affairs

AUGUST 5, 2019

Recently a data-wiping malware tracked as GermanWiper has been targeting German organizations, the malicious code is pushed via phishing messages. GermanWiper is being distributed in Germany through spam messages that pretend to be emails sent by a job applicant named Lena Kretschmer that is submitting her resume.

Ransomware 70

Ransomware Encryption File names Archiving 70

Security Affairs

FEBRUARY 19, 2019

The phishing email contains a.zip file named “slavneft.zakaz.zip”, which means something like “slavneft order” in English, showing a direct reference to “Slavneft”. It contains a russian speaking JavaScript file named “«??? «??? «?????????» ??????????? ??????”, Content of README.txt file.

Ransomware 76

Ransomware Mining File names Encryption 76

Security Affairs

APRIL 18, 2021

The phishing messages include links pointing to Slack or BaseCamp cloud storage, for this reason, they don’t raise suspicion when are received by employees working at an organization that uses the above services. Some of the files’ names observed by the experts are presentation-document.exe, preview-document-[number].exe

File names 109

File names Ransomware Phishing Encryption 109

Security Affairs

AUGUST 23, 2019

Trend Micro researchers discovered the new Asruex variant in malicious.PDF files that was spread via phishing messages. Researchers reported that attackers also used weaponized Word files to deliver the Asruex Trojan, in other cases the malicious code is delivered as a standard executable.

File names 85

File names Phishing Encryption Security 85

Security Affairs

JULY 8, 2019

Phishing email content. The phishing email (Figure 1) has a well-designed body containing the enterprise logo and references about the impersonated company: its international reputation has been abused by attackers to lure the victim to open up the embedded attachment. Encrypted payload, stored in Resource section. The Loader.

File names 70

File names Encryption Archiving Phishing 70

Security Affairs

MAY 7, 2021

Such lapses in database security can (and often do) lead to hundreds of millions of people having their personal information exposed on the internet, allowing threat actors to use that data for a variety of malicious purposes, including phishing and other types of social engineering attacks , as well as identity theft.

Passwords 133

Passwords Authentication Access File names 133

Security Affairs

MAY 29, 2019

Hash 0c88e285b6fc183c96b6f03ca5700cc9ca7c83dfccc6ad14a946d1868d1cc273 Threat Dropper Brief Description Excel file with malicious macro Ssdeep 3072:Mc38TehYTdeHVhjqabWHLtyeGxml8/dgzxXYhh3vVYwrq 8/P5HKuPF1+bkm13Kkf:B38TehYTdeHVhjqabWHLty/xml8/dgNr. The intercepted attack starts with a spear-phishing email embedding a spreadsheet.

IT 69

IT Retail Archiving File names 69

Security Affairs

MARCH 2, 2019

In February 2019, SI-LAB captured multiple samples of phishing campaigns using an Office Excel document carrying a malicious Excel 4.0 File name: patent-2019-02-20T093A283A05-1.xls Figure 1: Malicious xls file with an embedded XLM macro not detected by Virus Total. File name : 68131_46_20190219.doc

File names 87

File names Phishing Libraries IT 87

eSecurity Planet

APRIL 6, 2023

Ransomware is a type of malicious program, or malware, that encrypts files, documents and images on a computer or server so that users cannot access the data. These keys are available to the attacker, and the encryption can only be decrypted using a private key. How Does Ransomware Work?

Ransomware 98

Ransomware Encryption Cybersecurity Risk 98

Security Affairs

JULY 7, 2020

Lampion was first documented in December 2019 , and it was distributed in Portugal via phishing emails using templates based on the Portuguese Government Finance & Tax. Here, it was distributed using fake webpages, where the victim downloaded an MSI file, which then held the remaining Lampion infection chain. zipEncrypted: r?

Communications 98

Communications Cloud Phishing Encryption 98

Security Affairs

FEBRUARY 16, 2021

The malicious activity starts with a phishing email sent to the target victims in Latin American – Brazil, Mexico, Chile, and Peru – and Europe – Spain and Portugal. The initial stage of these trojans is generally the execution of a dropper in a form of a VBS, JScript, or MSI file that downloads from the Cloud (AWS, Google, etc.)

Libraries 120

Libraries Communications Phishing Encryption 120

Security Affairs

NOVEMBER 10, 2022

Mandiant researchers in early 2022 responded to an incident where the Russia-linked APT29 group (aka SVR group , Cozy Bear , Nobelium , and The Dukes ) successfully phished a European diplomatic entity. Then the attacker can write an arbitrary number of bytes to any file on the file system, posing as the victim account.

File names 114

File names Passwords Phishing Encryption 114