Security Affairs

MARCH 15, 2023

Top aviation company Safran Group left itself vulnerable to cyberattacks, likely for well over a year, underlining how vulnerable big aviation firms are to threat actors, according to research by Cybernews. According to its own estimates, Safran Group ’s revenue for 2022 was above €19 billion.

Manufacturing 87

Manufacturing Access Risk IT 87

Krebs on Security

NOVEMBER 17, 2022

Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. He’d been on the job less than six months, and because of the way his predecessor architected things, the company’s data backups also were encrypted by Zeppelin. ” they wrote.

Ransomware 300

Ransomware Encryption Manufacturing Phishing 300

Krebs on Security

FEBRUARY 20, 2024

authorities have seized the darknet websites run by LockBit , a prolific and destructive ransomware group that has claimed more than 2,000 victims worldwide and extorted over $120 million in payments. This prompted several XSS members to start posting memes taunting the group about the security failure. ” one denizen quipped.

Ransomware 259

Ransomware Encryption Insurance Manufacturing 259

The Last Watchdog

NOVEMBER 12, 2023

This is precisely what the consortium of software companies and device manufacturers, led Google, Amazon and Apple, set out to achieve when Matter was conceived four years ago. Matter works much the way website authentication and website traffic encryption gets executed. This same approach really could be applied to other industries.

Security 229

Security Manufacturing Authentication Marketing 229

Krebs on Security

OCTOBER 28, 2020

In March 2020, KrebsOnSecurity alerted Swedish security giant Gunnebo Group that hackers had broken into its network and sold the access to a criminal group which specializes in deploying ransomware. The company has operations in 25 countries, more than 4,000 employees, and billions in revenue annually.

Ransomware 337

Ransomware Security Agriculture Cybersecurity 337

Security Affairs

FEBRUARY 3, 2022

A China-linked APT group tracked as Antlion used a custom backdoor called xPack that was undetected for months. A China-linked APT group tracked as Antlion is using a custom backdoor called xPack in attacks aimed at financial organizations and manufacturing companies, Symantec researchers reported. Pierluigi Paganini.

Manufacturing 89

Manufacturing Data collection Encryption Passwords 89

Security Affairs

JANUARY 8, 2024

. “According to this and other leaked documents, the Department of Defence purchased technology for the Air Force’s encrypted communications. The ALPHV/Blackcat group was the second most prolific ransomware-as-a-service operation, it amassed hundreds of millions of dollars in ransom payments.

Communications 109

Communications Ransomware Data breaches Manufacturing 109

Security Affairs

NOVEMBER 24, 2022

RansomExx operation has been active since 2018, the list of its victims includes government agencies, the computer manufacturer and distributor GIGABYTE , and the Italian luxury brand Zegna. The ransomware iterates through the specified directories, enumerating and encrypting files. ” concludes the report. Pierluigi Paganini.

Ransomware 99

Ransomware Encryption Manufacturing Government 99

Security Affairs

SEPTEMBER 23, 2020

Researchers from threat hunting and intelligence firm Group-IB have detected a successful attack by a ransomware gang tracked as OldGremlin. Group-IB , a global threat hunting and intelligence company headquartered in Singapore, has detected a successful attack by a ransomware gang, codenamed OldGremlin. Unsought invoice.

Ransomware 100

Ransomware Phishing Encryption Authentication 100

Security Affairs

JUNE 28, 2023

Researchers warn of a massive spike in May and June 2023 of the activity associated with the ransomware group named 8Base. VMware Carbon Black researchers observed an intensification of the activity associated with a stealthy ransomware group named 8Base. The 8BASE group claims to be composed of honest pentesters. “We

Ransomware 87

Ransomware Encryption Manufacturing Business Services 87

eSecurity Planet

SEPTEMBER 8, 2021

The Ragnar Locker group posted on its darknet leak site a note outlining the warning, putting even more pressure on target companies (which the group calls “clients”) and increasing attention on the already high-profile debate about organizations paying ransoms. To Pay or Not to Pay? Colonial Pipeline paid its DarkSide attackers $4.4

Ransomware 98

Ransomware Manufacturing Risk Encryption 98

Security Affairs

JUNE 15, 2020

The Earth Empusa threat group is distributing new Android spyware, dubbed ActionSpy, through watering hole attacks to targets Turkic minority group. ” The configuration of the ActionSpy is encrypted by DES and the decryption key is generated in native code, it includes the C&C server address. Pierluigi Paganini.

Phishing 66

Phishing Encryption Manufacturing Access 66

Security Affairs

APRIL 3, 2019

The OceanLotus APT group, also known as APT32 or Cobalt Kitty , leverages a steganography-based loader to deliver backdoors on compromised systems. The APT32 group, also known as OceanLotus Group, has been active since at least 2013, according to the experts it is a state-sponsored hacking group.

Libraries 75

Libraries Encryption Communications Manufacturing 75

Security Affairs

DECEMBER 19, 2022

The Qilin ransomware-as-a-service (RaaS) group uses a double-extortion model, with most of the victims in the manufacturing and IT industries. The Rust variant has also been seen using intermittent encryption, one of the emerging tactics that threat actors use today for faster encryption and detection evasion.”

Ransomware 123

Ransomware Encryption Passwords Education 123

Security Affairs

FEBRUARY 20, 2024

Lockbit ransomware group administrative staff has confirmed with us their websites have been seized. pic.twitter.com/SvpbeslrCd — vx-underground (@vxunderground) February 19, 2024 The operation led to the arrest of two members of the ransomware gang in Poland and Ukraine and the seizure of hundreds of crypto wallets used by the group.

Energy and Utilities 98

Energy and Utilities Ransomware Manufacturing Agriculture 98

Security Affairs

JULY 15, 2022

The Microsoft Threat Intelligence Center (MSTIC) researchers linked the activity of the Holy Ghost ransomware (H0lyGh0st) operation to a North Korea-linked group they tracked as DEV-0530. The list of victims includes manufacturing organizations, banks, schools, and event and meeting planning companies.

Ransomware 130

Ransomware Encryption Government Manufacturing 130

Security Affairs

MARCH 3, 2023

Unlike other ransomware operations, Royal doesn’t offer Ransomware-as-a-Service, it appears to be a private group without a network of affiliates. “FBI and CISA believe this variant, which uses its own custom-made file encryption program, evolved from earlier iterations that used “Zeon” as a loader.”

Ransomware 90

Ransomware Encryption Cybersecurity Communications 90

Security Affairs

AUGUST 29, 2021

The name of the sportswear manufacturer Puma appeared on the dark web marketplace of stolen data Marketo, threat actors claim to have stolen 1 GB of data from the company. The ad on Marketo claims to have about 1GB of data stolen from the company that are now auctioned to the highest bidder. .

Manufacturing 121

Manufacturing Data breaches Encryption Ransomware 121

Security Affairs

FEBRUARY 21, 2024

. “The Department of State is announcing reward offers totaling up to $15 million for information leading to the arrest and/or conviction of any individual participating in a LockBit ransomware variant attack and for information leading to the identification and/or location of any key leaders of the LockBit ransomware group.”

Energy and Utilities 89

Energy and Utilities Ransomware Agriculture Manufacturing 89

Security Affairs

SEPTEMBER 23, 2023

MILES/CBS NEWS TEXAS The Royal ransomware group is behind the attack and threatens to publish stolen data if the City will not meet its ransom demand. Once obtained access to the City’s network, the group performed reconnaissance and information-gathering activities using legitimate third-party remote management tools.

Ransomware 103

Ransomware Encryption Systems administration Cybersecurity 103

Security Affairs

MARCH 26, 2021

Accenture’s Cyber Investigation & Forensic Response (CIFR) and Cyber Threat Intelligence (ACTI) teams published an analysis of the latest campaign conducted by financially motivated threat group Hades which have been operating since at least December 2020. . The copy is then deleted and an executable is unpacked in memory.

Ransomware 140

Ransomware Encryption File names Manufacturing 140

Security Affairs

JUNE 3, 2023

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. Another option is that BlackSuit emerged from a splinter group within the original Royal ransomware gang.”

Ransomware 94

Ransomware Encryption File names Cybersecurity 94

Security Affairs

JULY 23, 2019

ESET researchers reported that China-linked cyberespionage group APT15 has been using a previously undocumented backdoor for more than two years. Experts discovered that since December 2016, the APT15 group has been using the previously undocumented backdoor dubbed Okrum. ” reads the report published by ESET.

Communications 86

Communications Manufacturing Encryption Security 86

Security Affairs

AUGUST 9, 2021

In addition to the encryption of data, victims have received threats that data stolen during the incidents will be published.” Most of the attacks have been reported in July, the organizations hit by the ransomware gang operate in professional services, construction, manufacturing, retail, and food industries. ransomware.

Ransomware 110

Ransomware Retail Security Manufacturing 110

Security Affairs

NOVEMBER 1, 2021

“According to Vladimir Kononovich, some manufacturers rely on security through obscurity, with proprietary protocols that are poorly studied and the goal of making it difficult for attackers to procure equipment to find vulnerabilities in such devices. . Wincor is currently owned by ATM manufacturer giant Diebold Nixdorf.

Encryption 113

Encryption Manufacturing Authentication Security 113

Security Affairs

OCTOBER 13, 2022

The Budworm espionage group resurfaced targeting a U.S.-based This is the first time that Symantec researchers have observed the Budworm group targeting a U.S-based The group also targeted a hospital in South East Asia. The China-linked APT27 group has been active since 2010, it targeted organizations worldwide, including U.S.

File names 127

File names Financial Services Manufacturing Libraries 127

The Last Watchdog

NOVEMBER 14, 2022

What they came up with is an open-source standard designed to ensure that smart home devices from different manufacturers can communicate simply and securely via an advanced type of mesh network. . PKI also keeps data encrypted as it moves between endpoints. I’ll keep watch and keep reporting.

IoT 183

IoT Manufacturing Encryption Authentication 183

Security Affairs

NOVEMBER 16, 2022

DTrack is a modular backdoor used by the Lazarus group since 2019 , it was employed in attacks against a wide variety of targets, from financial environments to a nuclear power plan. The second stage payload is a heavily obfuscated shellcode, the APT group used an encryption method different for each sample.

Manufacturing 122

Manufacturing Education Encryption IT 122

Security Affairs

JANUARY 28, 2022

Taiwanese electronics manufacturing company Delta Electronics was hit by the Conti ransomware that took place this week. According to CTWANT , which cited an undisclosed information security company, Delta Electronics was hit by Conti ransomware that asked Delta to pay a $15 million ransom to restore encrypted files and avoid their leak.

Ransomware 89

Ransomware Computer and Electronics Manufacturing Encryption 89

Security Affairs

MAY 11, 2021

The Federal Bureau of Investigation (FBI) and the Australian Cyber Security Centre (ACSC) are warning of an ongoing Avaddon ransomware campaign targeting organizations worldwide in multiple industries, including government, finance, energy, manufacturing, and healthcare. Follow me on Twitter: @securityaffairs and Facebook.

Ransomware 126

Ransomware Manufacturing Phishing Encryption 126

Security Affairs

DECEMBER 27, 2021

The attackers first create a user in the administrator group, then use it to encrypt the content of the NAS. The ransomware, tracked by Intezer as “ QNAPCrypt ” and “ eCh0raix ” by Anomali, is written in the Go programming language and uses AES encryption to encrypt files. TXTT” extension. 024 ($1,200) up to.06

Ransomware 122

Ransomware Encryption Manufacturing Passwords 122

Security Affairs

SEPTEMBER 13, 2021

A ransom note that was found on the infected systems claimed that the company was hit by the BlackMatter ransomware group. The BlackMatter group launched its operations at at the end of July, the gang claims to be the successor of Darkside and REvil groups.

Ransomware 114

Ransomware Computer and Electronics Manufacturing Encryption 114

Security Affairs

JANUARY 12, 2022

Upon executing the Omicron Stats.exe, it unpacks resources encrypted with triple DES using ciphermode ECB and padding mode PKCS7. This conclusion is not a huge leap as the malware author(s) offer both dedicated purchasing and support lines through their respective Telegram groups.”

Manufacturing 132

Manufacturing File names Archiving Encryption 132

Security Affairs

FEBRUARY 28, 2024

“These operations have targeted various industries, including Aerospace & Defense, Education, Energy & Utilities, Governments, Hospitality, Manufacturing, Oil & Gas, Retail, Technology, and Transportation. Communication to and from the EdgeRouters involved encryption using a randomly generated 16-character AES key.

Energy and Utilities 95

Energy and Utilities Military Government Phishing 95

Security Affairs

JANUARY 29, 2023

Copycat Criminals mimicking Lockbit gang in northern Europe Sandworm APT targets Ukraine with new SwiftSlicer wiper ISC fixed high-severity flaws in DNS software suite BIND Patch management is crucial to protect Exchange servers, Microsoft warns Hacker accused of having stolen personal data of all Austrians and more CVE-2023-23560 flaw exposes 100 (..)

Security 86

Security Data breaches Military Ransomware 86

Thales Cloud Protection & Licensing

FEBRUARY 16, 2021

Driven by the need to secure themselves against increasing threats, organizations (both manufacturers and IoT consumers) realize that they need better built-in security. Once installed, the malware “phoned home” to a command-and-control network run by the hacking group, which enabled them to enter the network and take further action.

IoT 96

IoT Manufacturing Energy and Utilities Encryption 96

Security Affairs

NOVEMBER 20, 2020

Group-IB, a global threat hunting and intelligence company headquartered in Singapore, has discovered that QakBot (aka Qbot) operators have abandoned ProLock for Egregor ransomware. The biggest ransom demand detected by Group-IB team has been at $4 million worth of BTC. Egregor’s favorite sectors are Manufacturing (28.9%

Ransomware 115

Ransomware Retail Encryption Manufacturing 115