Remove File names Remove Information Security Remove Military Remove Security
article thumbnail

Russia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 Windows flaw

Security Affairs

National Security Agency and Microsoft addressed it with the release of Microsoft October 2022 Patch Tuesday security updates. APT28 deployed GooseEgg to gain elevated access to target systems and steal credentials and sensitive information. The vulnerability CVE-2022-38028 was reported by the U.S.

Military 113
article thumbnail

Russia-linked APT Gamaredon update TTPs in recent attacks against Ukraine

Security Affairs

The Gamaredon APT group (aka Shuckworm, Actinium, Armageddon, Primitive Bear, UAC-0010, and Trident Ursa) continues to carry out attacks against entities in Ukraine, including security services, military, and government organizations. A novelty observed in the recent attacks is the use of a USB propagation malware.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Russia-linked Armageddon APT targets Ukrainian state organizations, CERT-UA warns

Security Affairs

Ukraine CERT-UA published a security advisory to warn of spear-phishing attacks conducted by Russia-linked Armageddon APT (aka Gamaredon , Primitive Bear, Armageddon, Winterflounder, or Iron Tilden) targeting local state organizations. The group targeted government and military organizations in Ukraine. Pierluigi Paganini.

Military 114
article thumbnail

Google TAG: Russia, Belarus-linked APTs targeted Ukraine

Security Affairs

Google TAG observed Russian, Belarusian, and Chinese threat actors targeting Ukraine and European government and military orgs. Google TAG observed Russian, Belarusian, and Chinese threat actors targeting Ukrainian and European government and military organizations, as well as individuals. Pierluigi Paganini.

article thumbnail

GhostWriter APT targets state entities of Ukraine with Cobalt Strike Beacon 

Security Affairs

The phishing messages use a RAR-archive named “Saboteurs.rar”, which contains RAR-archive “Saboteurs 21.03.rar.” ” This second archive contains SFX-archive “Saboteurs filercs.rar,” experts reported that the file name contains the right-to-left override (RTLO) character to mask the real extension.

article thumbnail

Russia-linked Cyclops Blink botnet targeting ASUS routers

Security Affairs

In February, US and UK cybersecurity and law enforcement agencies published a joint security advisory about the Cyclops Blink bot that has been linked to the Russian-backed Sandworm APT group. Experts pointed out that these victims do not appear to be evidently valuable targets for either economic, military, or political espionage.

IoT 94
article thumbnail

SWEED targets precision engineering companies in Italy

Security Affairs

Security expert Marco Ramilli published a quick analysis of an interesting attack carried out by SWEED threat actor targeting precision engineering firms in Italy. According to VT history detection the same hash has been seen with at least three different names: educrety.exe , prestezza.exe and cardsharper.exe. Introduction.