Threatpost

MAY 21, 2021

Microsoft Security discovered malicious PDFs that download Java-based StrRAT, which can steal credentials and change file names but doesn't actually encrypt.

File names 103

File names Ransomware Encryption Security 103

Security Affairs

FEBRUARY 21, 2023

The two vulnerabilities, tracked as CVE-2022-39952 and CVE-2021-42756 , are respectively an external control of file name or path in Fortinet FortiNAC and a collection of stack-based buffer overflow issues in the proxy daemon of FortiWeb. is an external control of file name or path in the keyUpload scriptlet of FortiNAC.

File names 98

File names Archiving Access Cybersecurity 98

Security Affairs

MAY 17, 2024

“And if you compare the two malicious file execution screens, you can see the same pattern. The malicious file, named “Console Root task window ‘Security Mode’,” hid certain window styles and tabs. ” reads the analysis. If the victims launch it the multi-stage attack chain starts.

File names 109

File names Phishing Communications Security 109

Security Affairs

MARCH 18, 2024

Upload a command shell with a pseudo-randomly generated file name. With previously disclosed flaws in Fortra GoAnywhere managed file transfer (MFT) coming under heavy exploitation last year by threat actors like Cl0p, it’s recommended that users have applied the necessary updates to mitigate potential threats.

File names 128

File names IT Security 128

Security Affairs

JULY 30, 2024

When this.html file is opened, it displays an image designed to create a sense of urgency about accessing the document, thereby increasing the likelihood that the user will follow the provided instructions.” ” reads the report published by Trellix.

Phishing 133

Phishing File names Archiving Access 133

Security Affairs

FEBRUARY 23, 2023

The two vulnerabilities, tracked as CVE-2022-39952 and CVE-2021-42756 , are respectively an external control of file name or path in Fortinet FortiNAC and a collection of stack-based buffer overflow issues in the proxy daemon of FortiWeb. is an external control of file name or path in the keyUpload scriptlet of FortiNAC.

Honeypots 93

Honeypots File names Cybersecurity Security 93

Security Affairs

JUNE 29, 2023

Fortinet started investigating the threat after the discovery of an archive file with a file name in Russian, “Табель учета рабочего времени.zip” (“time sheet” in English). The zip archive contains two files with.exe extension preceded by another document-related extension (double extension). ” concludes the report.

File names 86

File names Archiving IT Security 86

Security Affairs

MARCH 11, 2023

The PlugX backdoor has been used since 2008 by multiple China-linked APT groups, including Mustang Panda , Winnti , and APT41 In the attacks observed by ASEC, once exploited the vulnerability, threat actors executed a PowerShell command to create a file named esetservice.exe.

File names 89

File names Security IT Information Security 89

Security Affairs

SEPTEMBER 7, 2024

To improve the security of the debug log feature, the researchers also recommend implementing a proper.htaccess rule that prevents direct access to the log file. Users with knowledge of the log file name can still gain access to it, indicating that the current rule needs further refinement.

File names 118

File names Access Authentication Security 118

Security Affairs

JULY 23, 2024

Attackers used this swap file to keep malware on the server and evade detection. After removing the swap file and clearing caches, the checkout page was clean. “The swapme part of the file name clued us in that there might be some swap lingering around. ” reads the report published by Sucuri.

Cleanup 117

Cleanup CMS File names Analytics 117

Security Affairs

FEBRUARY 29, 2024

The ZIP archive contains an HTA file named wine.hta that contains obfuscated JavaScript code. The campaign is characterized by its very low volume and the advanced tactics, techniques, and procedures (TTPs) employed by the threat actors.

Archiving 109

Archiving File names IT Information Security 109

Security Affairs

MAY 20, 2021

The Java-based STRRAT RAT was distributed in a massive spam campaign, the malware shows ransomware-like behavior of appending the file name extension.crimson to files without actually encrypting them. The latest version of the Java-based STRRAT malware (1.5) was seen being distributed in a massive email campaign last week.

Ransomware 129

Ransomware File names Encryption Passwords 129

Security Affairs

AUGUST 28, 2024

The first sample, contained in a file named Network Security.zip including: YAHSAT NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20240421.pdf.exe pdf.exe (Tickler malware disguised as a PDF) Two benign PDF files used as decoys. The malware is a 64-bit C/C++ executable starts by locating and loading kernel32.dll

IT 99

IT Education File names Passwords 99

Security Affairs

JUNE 19, 2023

The function writes some C code received from the C2 to a temporary file named tmp.c, that is later compiled to a file named /tmp/.ICE-unix/git After compilation, the file is executed in background with two parameters, also received from C2.” ICE-unix/git using the cc command on Fedora and gcc on Debian.

File names 98

File names Archiving IT Security 98

Security Affairs

JULY 28, 2024

The spear-phishing page included a download link pointing to a ZIP archive file that contained a malicious InnoSetup installer. The installer injected the executable into a JavaScript file named “jquery-3.7.1.min.js” min.js” to evade detection.

Passwords 116

Passwords Phishing File names Metadata 116

Security Affairs

MAY 31, 2023

Upon analyzing of the impacted UEFI firmware, the researchers identified a file named File Name: 8ccbee6f7858ac6b92ce23594c9e2563ebcef59414b5ac13ebebde0c715971b2.bin .” Firmware security firm Eclypsium said it first detected the anomaly in April 2023. Gigabyte has since acknowledged and addressed the issue.

File names 94

File names Risk Passwords Security 94

Schneier on Security

JANUARY 26, 2022

There’s a new ransomware that targets NAT devices made by QNAP: The attacks started today, January 25th, with QNAP devices suddenly finding their files encrypted and file names appended with a.deadbolt file extension.

Ransomware 95

Ransomware File names Encryption Access 95

Security Affairs

FEBRUARY 10, 2024

The researchers noticed that the backdoor contained a plist file named ‘test’. The first variant of the backdoor that was detected in November 2023 was likely a test version that did not support a persistence mechanism. “We identified multiple variants of the embedded Apple script, but all of them are meant for data exfiltration.”

Ransomware 126

Ransomware File names Passwords IT 126

Security Affairs

AUGUST 23, 2023

This downloader was used to install the Korplug backdoor on the infected systems. “The downloader attempted to download a file named update.zip from the following location: [link] continues the report. “The update.zip file is a zlib compressed archive file. This file is not saved on disk.

File names 81

File names Encryption Archiving Information Security 81

Security Affairs

MARCH 26, 2021

“Once encrypted, the system displays a ransom note including the actor’s email address, ransomware file name, the host system name, and a place to enter the decryption key.” DiskCryptor is not inherently malicious but has been weaponized.” ” reads the alert published by the FBI.

Ransomware 145

Ransomware Encryption File names Passwords 145

Security Affairs

JULY 11, 2024

The botnet shell script downloads an ELF file named “pty3” from a different IP address, likely a sample of Muhstik malware. “Therefore, it is recommended that users conduct a comprehensive asset assessment, verify their usage scenarios, and update PHP to the latest version to ensure security.

Honeypots 117

Honeypots File names Mining IoT 117

Security Affairs

APRIL 22, 2024

GooseEgg is usually deployed with a batch script, commonly named execute.bat or doit.bat. This script creates a file named servtask.bat, which includes commands for saving or compressing registry hives. APT28 deployed GooseEgg to gain elevated access to target systems and steal credentials and sensitive information.

Military 120

Military File names Education Phishing 120

Security Affairs

JUNE 22, 2024

The experts at Insikt Group noticed that the ESXi version of RansomHub creates a file named /tmp/app.pid to ensure the exclusive execution of RansomHub processes. “After processing command-line arguments and decrypting the configuration, RansomHub ESXi leverages the file /tmp/app.pid to check whether it is already running.

Ransomware 122

Ransomware Encryption File names Communications 122

Security Affairs

APRIL 2, 2020

Upon execution, the wiper drops a series of helper files into a temporary folder, including a BAT file named “coronovirus Installer,” which is responsible for most of the setup work. The BAT file creates a hidden folder named COVID-19, then move the dropped files to it. ” continues the analysis.

File names 115

File names Access IT Security 115

AIIM

JULY 8, 2021

This strategy can help keep project files organized among team members and aid in the disposition of documents once a project has been completed. Discovering content on an employee’s workstation by examining meta-data criteria such as file name, type, or age. social security numbers, customer information, etc.).

File names 204

File names Data breaches Risk Privacy 204

Security Affairs

MARCH 2, 2020

. “Attached to each email is a ZIP archive with a name formatted as with only the #s changing,” reads the advisory published by IBM X-Force IRIS. “The hash of the file contained within each of these archives remains the same and is associated with a highly obfuscated JavaScript file named LOVE_YOU.

Ransomware 122

Ransomware File names Archiving Encryption 122

Security Affairs

MARCH 19, 2022

. “The decryptor requires access to a file pair consisting of one encrypted file and the original, unencrypted version of the encrypted file to reconstruct the encryption keys needed to decrypt the rest of your data. This file must be roughly 20KB or larger in size. ” reads the guide for the decryptor.

Ransomware 91

Ransomware File names Encryption Cybersecurity 91

Security Affairs

SEPTEMBER 10, 2023

. “When receiving a message, uploadTextMessageToService collects its contents, chat/channel title and ID, as well as sender’s name and ID. The collected information is then encrypted and cached into a temporary file named tgsync.s3. The app sends this temporary file to the command server at certain intervals.”

File names 128

File names Personal data Encryption Security 128

Security Affairs

JUNE 20, 2024

“In addition to some popular applications, this stealer searches sensitive files in parent directories of common installation directories to ensure comprehensive data gathering. .” The information stealer performs a series of anti-analysis checks to determine if it’s running in a sandbox or a virtual machine environment.

File names 110

File names IT Information Security Security 110

Security Affairs

MARCH 17, 2024

All unique passwords are stored in a file named “brute.txt”. In the file “password.txt” we discovered a big RISEPRO banner and the link to the public Telegram channel. RisePro is a C++ info-stealer that has been active since at least 2022, it allows to gathering sensitive data from the infected system.

Passwords 113

Passwords File names Archiving Cybersecurity 113

National Archives Records Express

JUNE 12, 2023

Metadata Capture Requirements Agencies must adhere to the following metadata capture requirements: Capturing Metadata at the File or Item Level Agencies must capture the metadata specified in paragraphs (c) through (e) of the regulation at the file or item level as part of the digitization project.

Metadata 109

Metadata Digital transformation File names Archiving 109

Security Affairs

OCTOBER 6, 2018

“This application handles file names incorrectly when the user uploads a media file. ” The third flaw directory-traversal vulnerability tracked as CVE-2018-16594 that relates to the way the Photo Sharing Plus app handles file names. ” reads the blog post published by Fortinet.

File names 93

File names IoT Security IT 93

The Texas Record

JUNE 26, 2023

Consistency Choose file naming conventions and stick with them. For example, unless an abbreviation is known and widely used, avoid using it in folder or file names. A consistent approach with folder structure and file naming means there is less need for individual interpretation. Be consistent.

Cleanup 40

Cleanup File names ROT Access 40

Security Affairs

DECEMBER 27, 2018

” In the attempt to deceive the victims, attackers used the internal file name “Baidu PC Faster” and the “Baidu WiFi Hotspot Setup” in the description of the file. ” reads the analysis published by Anomali Labs.

File names 94

File names IT Security 94

Security Affairs

JUNE 24, 2024

While investigating a security incident from March 2024 on a client’s Linux host, Positive Technologies researchers discovered a file named “scrond.”

File names 81

File names Communications Mining Archiving 81

Security Affairs

DECEMBER 6, 2023

The researchers’ approach is simple, when the user activates Lockdown Mode, a file named /fakelockdownmode_on is generated as an indicator, triggering a userspace reboot. The researchers also intercepted other functions, including -[PUILockdownModeController lockdownModeEnabled()], to simulate the presence of this file.

File names 116

File names IT Security Access 116

Security Affairs

APRIL 18, 2021

“The attack begins with a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth).” ” The attack used a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth). .

File names 84

File names Archiving Passwords Communications 84