Security Affairs

AUGUST 8, 2021

Every week the best security articles from Security Affairs free for you in your email box. ransomware gang BlackMatter ransomware also targets VMware ESXi servers Conti ransomware affiliate leaked gang’s training material and tools Conti Leak Indicators – What to block, in your SOC…. Do You Trust Your Smart TV?

Security 101

Security Ransomware Mining IoT 101

Security Affairs

NOVEMBER 10, 2023

The hacktivist group Anonymous Sudan claimed responsibility for the massive distributed denial-of-service (DDoS) attack that took down the website of Cloudflare. “ To be clear, there was no Cloudflare breach. ” reads the message published on the group’s Telegram channel.

Mining 131

Mining Cloud IT Security 131

Security Affairs

MAY 26, 2021

Researchers from Trend Micro reported that about 50,000 IPs were compromised across multiple Kubernetes clusters in a cryptojacking campaign conducted by TeamTNT group. The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. sh) used by the TeamTNT group.

Mining 131

Mining Cloud Security Access 131

Krebs on Security

SEPTEMBER 17, 2020

Charging documents say the seven men are part of a hacking group known variously as “ APT41 ,” “ Barium ,” “ Winnti ,” “ Wicked Panda ,” and “ Wicked Spider.” Security analysts and U.S. Image: FBI. APT41’s activities span from the mid-2000s to the present day.

Government 352

Government Mining Big data Phishing 352

Security Affairs

APRIL 30, 2023

Every week the best security articles from Security Affairs are free for you in your email box. A new round of the weekly SecurityAffairs newsletter arrived! Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

Security 95

Security Ransomware Cybersecurity Authentication 95

Krebs on Security

MARCH 28, 2021

The Shadowserver Foundation , a nonprofit that helps network owners identify and fix security threats , says it has found 21,248 different Exchange servers which appear to be compromised by a backdoor and communicating with brian[.]krebsonsecurity[.]top Let’s just get this out of the way right now: It wasn’t me. krebsonsecurity[.]top

Honeypots 347

Honeypots Mining Encryption Communications 347

Krebs on Security

AUGUST 21, 2020

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued a joint alert to warn about the growing threat from voice phishing or “ vishing ” attacks targeting companies. Restrict VPN access hours, where applicable, to mitigate access outside of allowed times.

Authentication 355

Authentication Access Phishing Mining 355

Security Affairs

AUGUST 18, 2020

Security researchers have discovered a new crypto-minining botnet, dubbed TeamTNT, that is able to steal AWS credentials from infected servers. Security firm Cado Security reported that the TeamTNT botnet is the first one that is able to scan and steal AWS credentials. ” reads the report published by Cado Security.

Mining 110

Mining Security Access IT 110

Security Affairs

JULY 7, 2022

Researchers uncovered a large-scale cryptocurrency mining campaign targeting the NPM JavaScript package repository. Checkmarx researchers spotted a new large-scale cryptocurrency mining campaign, tracked as CuteBoi , that is targeting the NPM JavaScript package repository. ” concludes the experts. Pierluigi Paganini.

Mining 116

Mining Security IT Information Security 116

Security Affairs

JANUARY 10, 2021

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and that targets Docker installs. The activity of the TeamTNT group has been detailed by security firm Trend Micro, but in August experts from Cado Security discovered that that botnet is also able to target misconfigured Kubernetes installations.

Mining 138

Mining Metadata Authentication Security 138

Security Affairs

JUNE 19, 2023

Cado researchers recently detected an interesting attack pattern linked to an emerging cybercrime group tracked as Diicot (formerly, “Mexals”) and described in analyses published by Akamai and Bitdefender. The initial access for this campaign is via a custom SSH brute-forcing tool, named aliases. ” concludes the report.

IT 93

IT Mining Authentication Passwords 93

Security Affairs

MAY 27, 2021

The Federal Bureau of Investigation (FBI) reported that an APT group had breached the network of a local US municipal government by exploiting vulnerabilities in an unpatched Fortinet VPN. As of at least May 2021, an APT actor group almost certainly exploited a Fortigate appliance to access a webserver hosting the domain for a U.S.

Government 123

Government Mining Archiving Encryption 123

eSecurity Planet

JULY 27, 2021

The LemonDuck malware that for the past couple of years has been known for its cryptocurrency mining and botnet capabilities is evolving into a much broader threat, moving into new areas of cyber attacks, targeting both Linux and Microsoft systems and expanding its geographical reach, according to security researchers with Microsoft.

Risk 144

Risk Mining Ransomware Access 144

Security Affairs

NOVEMBER 16, 2018

According to Group-IB’s report findings, Asia is one of the most actively attacked regions in the world, the company presented latest cybercrime trends. According to Group-IB’s report findings, Asia is one of the most actively attacked regions in the world. Espionage as one of the main APT groups’ goals.

Phishing 88

Phishing Manufacturing Marketing Blockchain 88

eSecurity Planet

NOVEMBER 18, 2022

From compromised systems integrity and faulty regulatory oversight abroad, to the concentration of control in the hands of a very small group of inexperienced, unsophisticated and potentially compromised individuals, this situation is unprecedented.”. Security Forensics Investigation. Security is another issue with the industry.

Cybersecurity 136

Cybersecurity Risk Blockchain Mining 136

IT Governance

SEPTEMBER 15, 2023

Microsoft did not set out Storm-0324’s aim in this campaign, but the group is known to have worked with numerous malware groups to distribute malicious payloads including the Trickbot malware, Gootkit and Dridex banking Trojans, and Sage and GandCrab ransomware.

Phishing 110

Phishing Mining Education Passwords 110

Security Affairs

DECEMBER 1, 2020

Microsoft warns of Vietnam-linked Bismuth group that is deploying cryptocurrency miner while continues its cyberespionage campaigns. Researchers from Microsoft reported that the Vietnam-linked Bismuth group, aka OceanLotus , Cobalt Kitty , or APT32 , is deploying cryptocurrency miners while continues its cyberespionage campaigns.

Mining 99

Mining Manufacturing Phishing Government 99

Security Affairs

SEPTEMBER 19, 2022

The TeamTNT botnet is a crypto-mining malware operation that has been active since April 2020 and targets Docker installs. The activity of the TeamTNT group has been detailed by security firm Trend Micro, but in August 2020 experts from Cado Security discovered that botnet is also able to target misconfigured Kubernetes installations.

Encryption 98

Encryption Honeypots Mining Communications 98

eSecurity Planet

NOVEMBER 29, 2022

Group-IB cybersecurity researchers recently identified several Russian-speaking cybercrime groups offering infostealing malware-as-a-service (MaaS), resulting in the theft of more than 50 million passwords thus far. Eight of the groups use Raccoon malware, 23 use Redline, and three use custom stealers. Gaming Becomes a Target.

Passwords 116

Passwords Phishing Mining Marketing 116

Security Affairs

DECEMBER 2, 2020

Security researcher Tolijan Trajanovski ( @tolisec ) analyzed the multi-vector Miner+Tsunami Botnet that implements SSH lateral movement. A fellow security researcher, 0xrb , shared with me samples of a botnet that propagates using weblogic exploit. This botnet is targeting cloud servers. Botnet Summary. read())’ If bash.givemexyz.in

Mining 107

Mining IoT Cloud IT 107

Security Affairs

APRIL 1, 2020

Cybersecurity researchers spotted a crypto-mining botnet, tracked as Vollgar, that has been hijacking MSSQL servers since at least 2018. Researchers at Guardicore Labs discovered a crypto-mining botnet , tracked as Vollgar botnet , that is targeting MSSQL databases since 2018. ” continues the analysis. Pierluigi Paganini.

Mining 113

Mining Passwords Education Cybersecurity 113

Security Affairs

MARCH 2, 2022

News of alleged data leaks is circulating online, a hacker group known as AgainstTheWest which is supporting Anonymous claims to have hacked the Russian state-owned Sberbank bank and promise to leak the data soon. NPKTAIR, a Russian tool manufacturer, has been breached. The website of the bank is down at the time of this writing.

IT 98

IT Manufacturing Mining Government 98

Krebs on Security

NOVEMBER 21, 2020

And in May of this year, GoDaddy disclosed that 28,000 of its customers’ web hosting accounts were compromised following a security incident in Oct. The result shows that several other cryptocurrency platforms also may have been targeted by the same group, including Bibox.com , Celsius.network , and Wirex.app. and 11:00 p.m.

Phishing 363

Phishing Authentication Passwords Access 363

Security Affairs

AUGUST 25, 2019

The best news of the week with Security Affairs. Intel addresses High-Severity flaws in NUC Firmware and other tools. China-linked APT41 group targets US-Based Research University. The gang deploys new tools on its worldwide tour. Employees abused systems at Ukrainian nuclear power plant to mine cryptocurrency.

Security 51

Security Mining Data breaches Libraries 51

Security Affairs

JANUARY 8, 2021

The Ezuri memory loader tool allows to load and execute a payload directly into the memory of the infected machine, without writing any file to disk. In case, the password is not provided, the tool generates one. Experts noticed that the group also used the Ezuri loader that is similar to the original one. . Pierluigi Paganini.

Encryption 142

Encryption Passwords Mining IT 142

eSecurity Planet

SEPTEMBER 14, 2022

In the 2021 FBI report, individuals over 60 years of age had the highest number of complaints of any age group with 92,371 and the highest amount of reported losses with $1.68 Of the six age groups listed (under 20, 20-29, 30-39, 40-49, 50-59, 60-69), the three oldest age groups reported $4.13 for individuals under 40.

Energy and Utilities 115

Energy and Utilities Phishing Blockchain Cybersecurity 115

The Last Watchdog

JANUARY 28, 2019

This variant of Xbash is equipped to quietly uninstall any one of five popular types of cloud security protection and monitoring products used on such servers. The end game for this particular hacking ring is to install crypto currency mining routines on compromised Linux servers. Secure your phone. Targeting one device.

Privacy 145

Privacy Passwords Security Access 145

eSecurity Planet

AUGUST 9, 2021

A malicious advertising campaign originating out of Eastern Europe and operating since at least mid-June is targeting Internet of Things (IoT) devices connected to home networks, according to executives with GeoEdge, which offers ad security and quality solutions to online and mobile advertisers. IoT a Security Concern.

IoT 145

IoT Cloud Mining Marketing 145

Security Affairs

OCTOBER 28, 2018

Earlier this year Sysdig and Aqua Security researchers started observing cyber attacks targeting Kubernets and Docker instances aimed at mining Monero cryptocurrency. Experts pointed out that a Docker Engine is not properly secured could be exposed to remote attack through Docker Engine API. Docker Trusted Registry ).

Mining 89

Mining Systems administration Encryption Authentication 89

Security Affairs

AUGUST 12, 2018

The best news of the week with Security Affairs. Security Affairs – Newsletter ). Security Affairs – Newsletter ). The post Security Affairs newsletter Round 175 – News of the week appeared first on Security Affairs. A new round of the weekly SecurityAffairs newsletter arrived! 20% discount. Kindle Edition.

Security 44

Security MDM Mining Marketing 44

Security Affairs

OCTOBER 18, 2021

The Uptycs Threat Research Team recently identified a campaign in which the TeamTNT threat actors deployed a malicious container image (hosted on Docker Hub) with an embedded script to download Zgrab scanner and masscanner —penetration testing tools used for banner grabbing and port scanning respectively. TeamTNT threat actor.

Communications 107

Communications Mining Security IT 107

Security Affairs

OCTOBER 12, 2018

A group of hackers is targeting Drupal vulnerabilities, including Drupalgeddon2, patched earlier this year to install a backdoor on compromised servers. Security Affairs – Drupal, hacking ). The post Hackers targeting Drupal vulnerabilities to install the Shellbot Backdoor appeared first on Security Affairs.

Mining 94

Mining Security IT 94

Security Affairs

APRIL 28, 2020

The Outlaw Hacking Group is back, malware researchers from Cybaze-Yoroi ZLab have uncovered a new botnet that is targeting European organizations. The Linux malware is the well-known “ Shellbot ”, it is a crimetool belonging to the arsenal of a threat actor tracked as the “Outlaw Hacking Group. ”. Introduction. Technical Analysis.

Mining 103

Mining File names Honeypots IT 103

Security Affairs

APRIL 26, 2019

Security experts uncovered a new cryptojacking campaign tracked as Beapy that leverages the NSA’s DoublePulsar backdoor and the EternalBlue exploit. The DOUBLEPULSAR and ETERNALBLUE are now available for anyone after the archive of NSA tools was leaked online by ShadowBrokers hacker group. “ Beapy ( W32.Beapy

Mining 60

Mining Archiving Phishing Passwords 60

eSecurity Planet

AUGUST 3, 2021

Administrators overseeing the Python Package Index (PyPI) in recent days found themselves responding to vulnerabilities found in the repository of open source software, the latest security problems to hit the Python community. Python Security Under Scrutiny. Most Critical Flaw. The administrators also issued a fix for this flaw.

Mining 143

Mining Security Archiving IT 143

Security Affairs

DECEMBER 13, 2023

Microsoft warns that threat actors are using OAuth applications cryptocurrency mining campaigns and phishing attacks. Threat actors are using OAuth applications such as an automation tool in cryptocurrency mining campaigns and other financially motivated attacks. ” states Microsoft. ” continues the report.

Mining 108

Mining Phishing Passwords Access 108

Security Affairs

NOVEMBER 19, 2019

Ransomware accounted for over half of all malicious mailings in H1 2019, Troldesh aka Shade being the most popular tool among cybercriminals. To bypass corporate security systems, cybercriminals are increasingly often archiving their malicious attachments. Another trend was disguising malware in emails.

Ransomware 71

Ransomware Archiving Passwords Encryption 71