article thumbnail

A Closer Look at the Snatch Data Ransom Group

Krebs on Security

Earlier this week, KrebsOnSecurity revealed that the darknet website for the Snatch ransomware group was leaking data about its users and the crime gang’s internal operations. “The command requires Windows system administrators,” Truniger’s ads explained.

article thumbnail

Russia-linked APT28 uses fake Windows Update instructions to target Ukraine govt bodies

Security Affairs

CERT-UA warns of a spear-phishing campaign conducted by APT28 group targeting Ukrainian government bodies with fake ‘Windows Update’ guides. Russia-linked APT28 group is targeting Ukrainian government bodies with fake ‘Windows Update’ guides, Computer Emergency Response Team of Ukraine (CERT-UA) warns.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

FBI and CISA published a new advisory on AvosLocker ransomware

Security Affairs

The AvosLocker ransomware-as-a-service emerged in the threat landscape in September 2021, since January the group expanded its targets by implementing support for encrypting Linux systems, specifically VMware ESXi servers. This joint CSA updates the advisory published by the US Government on March 17, 2022.

article thumbnail

Chinese Hackers Stole an NSA Windows Exploit in 2014

Schneier on Security

Check Point has evidence that (probably government affiliated) Chinese hackers stole and cloned an NSA Windows hacking tool years before (probably government affiliated) Russian hackers stole and then published the same tool. This allows someone with a foothold on a machine to commandeer the whole box.

article thumbnail

China-linked APT BlackTech was spotted hiding in Cisco router firmware

Security Affairs

BlackTech is a Chinese APT group that has been active since at least 2010 and that known for conducting cyber espionage campaigns in Asia aimed at entities in Hong Kong, Japan, and Taiwan. Custom malware families used by the group include BendyBear, Bifrose, BTSDoor, FakeDead (a.k.a.

article thumbnail

City of Dallas has set a budget of $8.5 million to mitigate the May Royal ransomware attack

Security Affairs

CBS News Texas obtained an image the ransomware note dropped by the malware on the infected systems. MILES/CBS NEWS TEXAS The Royal ransomware group is behind the attack and threatens to publish stolen data if the City will not meet its ransom demand. ” continues the report.

article thumbnail

US govt agencies share details of the China-linked espionage malware Taidoor

Security Affairs

China-linked hackers carried out cyber espionage campaigns targeting governments, corporations, and think tanks with TAIDOOR malware. “CISA encourages users and administrators to review Malware Analysis Report MAR-10292089-1.v1 “CISA encourages users and administrators to review Malware Analysis Report MAR-10292089-1.v1