article thumbnail

New SPIKEDWINE APT group is targeting officials in Europe

Security Affairs

The cyberspies used a bait PDF document masqueraded as an invitation letter from the Ambassador of India, inviting diplomats to a wine-tasting event in February 2024. The ZIP archive contains an HTA file named wine.hta that contains obfuscated JavaScript code.

Archiving 110
article thumbnail

Russia-linked Turla APT uses new TinyTurla-NG backdoor to spy on Polish NGOs

Security Affairs

The malware uses Windows events for synchronization, with the first primary malware thread initiated in the DLL’s ServiceMain function. killmeā€ : Create a BAT file (see below) with a name based on the current tick count. Like TinyTurla, TinyTurla-NG operates as a service DLL initiated through svchost.exe.

CMS 112
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Tips for Folder Structure Design and Cleanup

The Texas Record

Consistency Choose file naming conventions and stick with them. For example, unless an abbreviation is known and widely used, avoid using it in folder or file names. A consistent approach with folder structure and file naming means there is less need for individual interpretation. Be consistent.

Cleanup 40
article thumbnail

Lilith: The Latest Threat in Ransomware

eSecurity Planet

According to Cyble, ā€œThe ransomware searches for files to encrypt on the local system by enumerating the file directories […] It ignores the file extensions such as EXE, DLL, and SYS and excludes a list of directory and file names from the encryption process.ā€.

article thumbnail

Severe bug in LibreOffice and OpenOffice suites allows remote code execution

Security Affairs

The security researcher Alex InfĆ¼hr discovered a severe remote code execution vulnerability in LibreOffice and Apache OpenOffice that could be exploited by tricking victims into opening an ODT (OpenDocument Text) file embedding an event embedded. The expert also published the PoC exploit code for the flaw that works on Windows OS.

article thumbnail

CDRThief Linux malware steals VoIP metadata from Linux softswitches

Security Affairs

The analysis of the source code of the malware revealed that it access tables in the DB that contain logs of system events, information about VoIP gateways, and call metadata. The CDRThief can start from any location on the disk, using any file name. run/callservice.pid'.

Metadata 124
article thumbnail

SolarWinds Attack: Microsoft sheds lights into Solorigate second-stage activation

Security Affairs

Attackers prepared a unique Cobalt Strike DLL implant for each machine and avoided at any cost overlap and reuse of folder name, file name, export function names, C2 domain/IP, HTTP requests, timestamp, file metadata, config, and child process launched. Camouflage and blending into the environment.