Security Affairs

OCTOBER 22, 2023

“The overlap of tools and campaigns is very likely due to the effects of a cybercrime marketplace and ecosystem described in the WithSecure Professionalization of Cybercrime report. WithSecure speculates that these groups are a closely related cluster of operators/groups. ” reads the report published by WithSecure.

File names 117

File names Archiving IT Access 117

Security Affairs

MARCH 26, 2021

The Federal Bureau of Investigation (FBI) issued an alert to warn that the Mamba ransomware is abusing the DiskCryptor open source tool to encrypt entire drives. Mamba ransomware is one of the first malware that encrypted hard drives rather than files that was detected in public attacks. ” reads the alert published by the FBI.

Ransomware 144

Ransomware Encryption File names Passwords 144

eSecurity Planet

MAY 24, 2023

By implementing DKIM, an organization improves the reputation of its own emails and enables receiving email servers to improve their own email security. Basic DKIM DNS Record Structure The DKIM DNS record is very simple and conveys information both through the content of the record as well as the file name.

Encryption 73

Encryption Security Authentication File names 73

AIIM

JULY 8, 2021

Don’t, however, lose sight of the fact that information scattered across a dispersed workforce can significantly raise the risk of a data breach or other security concerns. At Gimmal, we regularly talk to IT, security, and privacy professionals across a broad portfolio of industries. Applying retention rules (i.e.,

File names 200

File names Data breaches Risk Privacy 200

Security Affairs

OCTOBER 13, 2022

The cyber espionage group leverage both readily available tools and custom malware in their operations, many tools are available for years, but in recent attacks, their code was updated. “In some cases, the HyperBro backdoor was loaded with its own HyperBro loader (file names: peloader.exe, 12.exe).

File names 137

File names Financial Services Manufacturing Libraries 137

Security Affairs

MAY 31, 2023

Researchers from firmware security firm Eclypsium have discovered a suspected backdoor-like behavior within Gigabyte systems. ” Firmware security firm Eclypsium said it first detected the anomaly in April 2023. Researchers discovered a suspected backdoor-like behavior within Gigabyte systems that exposes devices to compromise.

File names 98

File names Risk Passwords Security 98

Security Affairs

MARCH 2, 2020

Security experts uncovered an ongoing campaign delivering Nemty Ransomware via emails disguised as messages from secret lovers. “Attached to each email is a ZIP archive with a name formatted as with only the #s changing,” reads the advisory published by IBM X-Force IRIS. they also announced a working tool for version 1.5.

Ransomware 133

Ransomware File names Archiving Encryption 133

Schneier on Security

MAY 4, 2022

The group, which security firm Mandiant is calling UNC3524, has spent the past 18 months burrowing into victims’ networks with unusual stealth. Customized versions of the backdoor that use file names and creation dates that are similar to legitimate files used on a specific infected device.

IoT 98

IoT File names Encryption Access 98

Security Affairs

MARCH 19, 2022

Cybersecurity firm Emsisoft released a free decryptor that allows the victims of the Diavol ransomware to recover their files without paying a ransom. Cybersecurity firm Emsisoft has released a free decryption tool to help Diavol ransomware victims recover their files without paying a ransom. Pierluigi Paganini.

Ransomware 98

Ransomware File names Encryption Cybersecurity 98

Security Affairs

JUNE 8, 2019

Cisco Talos experts uncovered a new wave of attacks tracked as Frankenstein campaign, attackers used tools built by combining four open-source techniques. Security experts at Cisco Talos uncovered a series of highly targeted attacks, tracked as Frankenstein campaign, hackers used tools built by combining four different open-source techniques.

File names 62

File names Encryption Security IT 62

Security Affairs

JUNE 8, 2019

Cisco Talos experts uncovered a new wave of attacks tracked as Frankenstein campaign, attackers used tools built by combining four open-source techniques. Security experts at Cisco Talos uncovered a series of highly targeted attacks, tracked as Frankenstein campaign, hackers used tools built by combining four different open-source techniques.

File names 62

File names Encryption Security IT 62

Security Affairs

OCTOBER 27, 2021

Researchers from cybersecurity firm Avast released a decryption tool for Babuk ransomware that allows victims to recover their files for free. Cybersecurity firm Avast has released a decryption tool for Babuk ransomware that allows victims to recover their files for free. Pierluigi Paganini.

Ransomware 102

Ransomware File names Encryption Cybersecurity 102

Security Affairs

DECEMBER 27, 2018

This sample attempt to disguise itself as a system optimization tool developed by Chinese technology company Baidu. AThis sample was packed using the commercial packing tool Enigma version 4. As observed in previous Shamoon samples the internal file name invokes a known PC tool, likely as a lure to allay initial user suspicion.”

File names 103

File names IT Security 103

Security Affairs

MAY 10, 2023

exe ” and used the icon image associated with docx files. The executable is a self-contained archive that once executed will extract two files. One of the files is the bait document, while the other one is an HTA file named log extension with embedded VBScript code The HTA file contacts the C2 server to fetch a second-stage payload.

File names 97

File names Archiving Phishing Government 97

Security Affairs

SEPTEMBER 12, 2022

In August, Cisco disclosed a security breach, the Yanluowang ransomware gang breached its corporate network in late May and stole internal data. Then threat actors were able to drop multiple tools in the target network, including remote access tools like LogMeIn and TeamViewer, Cobalt Strike, PowerSploit, Mimikatz, and Impacket.

Ransomware 106

Ransomware IT Authentication File names 106

Security Affairs

OCTOBER 24, 2022

Upon clicking the “DOWNLOAD” button, the executable file named “AcroRdrDCx642200120169_uk_UA.exe” will be downloaded to the machine. Running the above executable will decode and run the “rmtpak.dll” DLL file which is the ROMCOM RAT. Follow me on Twitter: @securityaffairs and Facebook.

Ransomware 105

Ransomware Phishing File names IT 105

Security Affairs

FEBRUARY 7, 2022

Cybersecurity firm Avast has released a decryption tool to allow victims of TargetCompany ransomware to recover their files for free. Czech cybersecurity software firm Avast has released a decryption tool that could allow victims of the TargetCompany ransomware to recover their files for free under certain circumstances.

Ransomware 98

Ransomware Encryption Passwords File names 98

Security Affairs

JULY 20, 2023

WyrmSpy is able to collect Log files, Photos, Device location, SMS messages (read and write), and Audio recording. “After it’s installed and launched, WyrmSpy uses known rooting tools to gain escalated privileges to the device and perform surveillance activities specified by commands received from its C2 servers.

File names 94

File names Libraries Cybersecurity IT 94

Security Affairs

MAY 23, 2023

“The fake Skype installer was a.NET executable file named skype32.exe This tool was used in 2020.” JackalSteal is an implant, used in limited attacks, that allows to look for files of interest on the target’s machine and exfiltrate them. exe that was approximately 400 MB in size. ” Kaspersky concludes.

File names 93

File names Government Communications IT 93

Security Affairs

FEBRUARY 8, 2023

Upon execution, the downloader will check against a blacklist of malware analysis tools by checking for running processes’ specific names (i.e. It creates temporary files with the “ lock” and “ trash” extensions. The downloader contains hardcoded C2 server addresses. ” Symantec concludes.

File names 93

File names Passwords Phishing Encryption 93

Security Affairs

JUNE 5, 2021

The company reported the security breach to the Bombay Stock Exchange (BSE) and the National Stock Exchange of India (NSEI). The Ransomware perform file system enumeration while encrypting the victim files, then appends the extension “.BlackCocaine BlackCocaine ” to the filenames of encrypted files. Pierluigi Paganini.

Ransomware 137

Ransomware Encryption File names Financial Services 137

Security Affairs

APRIL 18, 2021

“The attack begins with a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth).” ” The attack used a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth). .

File names 86

File names Archiving Passwords Communications 86

Security Affairs

APRIL 10, 2023

MERCURY (aka MuddyWater , SeedWorm and TEMP.Zagros ) has been active since at least 2017, in January 2022 the USCYBERCOM has officially linked the Iran-linked APT group to Iran’s Ministry of Intelligence and Security (MOIS). The attackers were able to interfere with security tools using Group Policy Objects (GPO).

Ransomware 97

Ransomware File names Access Education 97

Security Affairs

APRIL 24, 2021

Telegram is a legitimate service and enterprise AV engines and security solutions trust its traffic. “The bot is embedded into the ToxicEye RAT configuration file and compiled into an executable file (an example of a file name we found was ‘paypal checker by saint.exe’). ” concludes the report.

Communications 120

Communications File names Encryption Education 120

Security Affairs

SEPTEMBER 22, 2022

The now-patched critical security flaw was disclosed by Atlassian in early June, at the time the company warned of a critical unpatched remote code execution vulnerability affecting all Confluence Server and Data Center supported versions that is being actively exploited in attacks in the wild. in the collaboration tool Atlassian Confluence.

Mining 121

Mining File names Ransomware Cloud 121

Security Affairs

MAY 26, 2023

The infection chain commenced with spear phishing messages using a zip file named Brochure.zip in attachment. Karkoff ) “The PowerExchange backdoor is a simple yet effective tool. The archive contained a malicious.NET executable (Brochure.exe) which is an executable with an Adobe PDF icon. ” concludes the report.

Communications 97

Communications File names Archiving Phishing 97

Security Affairs

MARCH 1, 2021

In its latest attempts to evade detection by endpoint security tools, Gootloader has moved as much of its infection infrastructure to a “fileless” methodology as possible.” file is the initial infector, and the only stage of the infection at which a malicious file is written to the filesystem. . “This.js

Search queries 113

Search queries CMS Ransomware File names 113

Security Affairs

JUNE 15, 2023

The Gamaredon APT group (aka Shuckworm, Actinium, Armageddon, Primitive Bear, UAC-0010, and Trident Ursa) continues to carry out attacks against entities in Ukraine, including security services, military, and government organizations. The attack chain commences with spear-phishing emails with malicious attachments (.docx,rar,sfx

Military 94

Military File names Archiving Phishing 94

Security Affairs

MARCH 3, 2020

Nemty ransomware first appeared on the threat landscape in August 2019, the name of the malware comes after the extension it adds to the encrypted file names. The ransomware deletes shadow copies of encrypted files to make in impossible any recovery procedure. they also announced a working tool for version 1.5.

Ransomware 108

Ransomware File names Encryption Archiving 108

Security Affairs

JANUARY 21, 2021

Microsoft’s report provides details of the entire SolarWinds attack chain with a deep dive in the second-stage activation of malware and tools. While investigating the attack, Microsoft identified several second-stage malware and tools, including TEARDROP, Raindrop, and also other custom loaders for the Cobalt Strike beacon.

File names 118

File names Metadata Data collection Security 118

Security Affairs

JUNE 3, 2023

ReadMe file name: README.BlackSuit.txt. similarities in jumps based on BinDiff, a comparison tool for binary files.” In May, multiple cybersecurity experts spotted a new ransomware family called BlackSuit, including Palo Alto Unit42 experts. New #ransomware #BlackSuit targets Windows, #Linux. Extension: blacksuit.

Ransomware 98

Ransomware Encryption File names Cybersecurity 98

eSecurity Planet

JULY 1, 2022

Security researchers have uncovered an unusually sophisticated malware that has been targeting small office/home office (SOHO) routers for nearly two years, taking advantage of the pandemic and rapid shift to remote work. See The Best Wi-Fi 6 Routers Secure and Fast Enough for Business. State-Sponsored Hacking Campaign.

File names 113

File names Access Communications Security 113

Security Affairs

JULY 28, 2021

Researchers from Palo Alto Networks Unit 42 team tracked the new version of the PlugX malware as Thor, they reported that the RAT was used as a post-exploitation tool deployed on one of the compromised servers. The analysis of the file revealed that it includes the encrypted and compressed PlugX payload. Pierluigi Paganini.

Encryption 109

Encryption File names Communications IT 109

Security Affairs

OCTOBER 11, 2019

Good news for the victims of the Nemty Ransomware , security researchers have released a free decryptor that could be used to recover files. I have great news for the victims of the recently discovered Nemty Ransomware , security researchers have released a free decryptor tool that could be used to recover files.

Ransomware 103

Ransomware File names Encryption Security 103

Security Affairs

NOVEMBER 17, 2020

Security experts at BitDefender have uncovered a new China-linked cyber espionage group, tracked as FunnyDream that has already infected more than 200 systems across Southeast Asia over the past two years. ” The name of the group comes from a powerful backdoor employed in the attacks of the APT group. .

Government 110

Government File names Communications Access 110

Security Affairs

SEPTEMBER 22, 2022

” reads the post published by security firm Trellix.”The ”The vulnerability is a path traversal attack in the extract and extractall functions in the tarfile module that allow an attacker to overwrite arbitrary files by adding the “.” Initially we thought we had found a new zero-day vulnerability. Pierluigi Paganini.

Archiving 101

Archiving File names Metadata Security 101

Security Affairs

JUNE 30, 2022

Good news for the victims of the Hive ransomware, Korean security researchers have released a free decryptor for some versions. “The Korea Internet & Security Agency (KISA) is distributing the Hive ransomware integrated recovery tool.This recovery tool can recover Hive ransomware version 1 to version 4.”

Ransomware 106

Ransomware Cybersecurity Encryption Blockchain 106