article thumbnail

TeamTNT is back and targets servers to run Bitcoin encryption solvers

Security Affairs

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and targets Docker installs. The activity of the TeamTNT group has been detailed by security firm Trend Micro, but in August 2020 experts from Cado Security discovered that botnet is also able to target misconfigured Kubernetes installations.

article thumbnail

Threat Group TeamTNT Returns with New Cloud Attacks

eSecurity Planet

A retired threat actor has returned with new attacks aimed at the cloud, containers – and encryption keys. All internet communications, including SSL and SSH, rely on private and public keys for encryption. It’s the fundamental principle of modern cryptography: encryption must be a one-way operation.

Cloud 122
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Ransomware, Trojan and Miner together against “PIK-Group”

Security Affairs

Security expert Marco Ramilli analyzed a new piece of malware apparently designed to target PIK-Group that implements ransomware , Trojan, and Miner capabilities. which according to google translate would be: “PIK Group of Companies order details”. For example, after encryption, the file “1.jpg” crypted000007” extension to each.

article thumbnail

8220 Gang used new ScrubCrypt crypter in recent cryptojacking attacks

Security Affairs

Fortinet researchers observed the mining group 8220 Gang using a new crypter called ScrubCrypt in cryptojacking attacks. “This payload extracts ScrubCrypt, which obfuscates and encrypts applications and makes them able to dodge security programs. . ” reads the analysis published by Fortinet.

Mining 89
article thumbnail

No, I Did Not Hack Your MS Exchange Server

Krebs on Security

The group looks for attacks on Exchange systems using a combination of active Internet scans and “honeypots” — systems left vulnerable to attack so that defenders can study what attackers are doing to the devices and how. ” “The web shell path that was dropped was new to us,” said Watson said.

Honeypots 347
article thumbnail

APT hacked a US municipal government via an unpatched Fortinet VPN

Security Affairs

The Federal Bureau of Investigation (FBI) reported that an APT group had breached the network of a local US municipal government by exploiting vulnerabilities in an unpatched Fortinet VPN. As of at least May 2021, an APT actor group almost certainly exploited a Fortigate appliance to access a webserver hosting the domain for a U.S.

article thumbnail

Security Affairs newsletter Round 417 by Pierluigi Paganini – International edition

Security Affairs

Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.