article thumbnail

New RedLine malware version distributed as fake Omicron stat counter

Security Affairs

The new variant discovered by Fortinet has the file name “Omicron Stats.exe,” threat actors are attempting to exploit the enormous interest on a global scale on the COVID-19 Omicron variant. The malicious code can also act as a first-stage malware. This variant uses 207[.]32.217.89 as its C2 server through port 14588. 154.167.91

article thumbnail

FBI published a flash alert on Mamba Ransomware attacks

Security Affairs

According to the flash alert published by the FBI, the Mamba ransomware was employed in attacks against local governments, public transportation agencies, legal services, technology services, industrial, commercial, manufacturing, and construction businesses. ” reads the alert published by the FBI.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

New Linux Ransomware BlackSuit is similar to Royal ransomware

Security Affairs

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. ReadMe file name: README.BlackSuit.txt. similarities in jumps based on BinDiff, a comparison tool for binary files.”

article thumbnail

3CX voice and video conferencing software victim of a supply chain attack

Security Affairs

The company started distributing digitally signed Trojanized installers to its customers “The trojanized 3CXDesktopApp is the first stage in a multi-stage attack chain that pulls ICO files appended with base64 data from Github and ultimately leads to a 3rd stage infostealer DLL still being analyzed as of the time of writing.”

article thumbnail

China-linked APT41 group targets Hong Kong with Spyder Loader

Security Affairs

The attacks detailed by Cybereason targeted technology and manufacturing companies primarily located in East Asia, Western Europe, and North America. To prevent analysis, the malware also cleans up created artifacts, overwriting the content of the dropped wlbsctrl.dll file before deleting it. ” continues the report. .

article thumbnail

China-linked Budworm APT returns to target a US entity

Security Affairs

The Budworm cyber espionage group (aka APT27 , Bronze Union , Emissary Panda , Lucky Mouse , TG-3390 , and Red Phoenix) is behind a series attacks conducted over the past six months against a number of high-profile targets, including the government of a Middle Eastern country, a multinational electronics manufacturer, and a U.S.

article thumbnail

Xenomorph malware is back after months of hiatus and expands the list of targets

Security Affairs

“ While investigating the campaign the researchers noticed that threat actors made an important mistake exposing without restrictions the server folder containing the files necessary to distribute the malware. This allowed the researchers to monitor the server, identifying multiple interesting files. ” concludes the report.

Phishing 116