Remove Information Security Remove IT Remove Libraries Remove Military
article thumbnail

Targeted operation against Ukraine exploited 7-year-old MS Office bug

Security Affairs

The payload includes a dynamic-link library (vpn.sessings) that injects the post-exploitation tool Cobalt Strike Beacon into memory and awaits commands from the C2 server. “The lure contained military-related content, suggesting it was targeting military personnel. Threat actors used a cracked version of Cobalt Strike. .

Military 110
article thumbnail

InvisiMole group targets military sector and diplomatic missions in Eastern Europe

Security Affairs

Security researchers at ESET recently uncovered a campaign carried out by the InvisiMole group that has been targeting a small number of high-profile organizations in the military sector and diplomatic missions in Eastern Europe. The SMInit exploit chain exploits a vulnerability in the legitimate Total Video Player software.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Security Affairs newsletter Round 439 by Pierluigi Paganini – International edition

Security Affairs

million newborns and pregnancy care patients Xenomorph malware is back after months of hiatus and expands the list of targets Smishing Triad Stretches Its Tentacles into the United Arab Emirates Crooks stole $200 million worth of assets from Mixin Network A phishing campaign targets Ukrainian military entities with drone manual lures Alert!

article thumbnail

China-linked Alloy Taurus APT uses a Linux variant of PingPull malware

Security Affairs

It uses a statically linked OpenSSL (OpenSSL 0.9.8e) library to interact with the domain over HTTPS via HTTP POST request” The researchers noticed that the command handler implemented in the PingPull malware is similar to the ones supported by both the China Chopper web shell and the PingPull Windows PE variant. saspecialforces.co[.]za

article thumbnail

GoDaddy discloses a new data breach

Security Affairs

GoDaddy discloses a security breach, threat actors have stolen source code and installed malware on its servers in a long-runing attack. The security breach was discovered in December 2022 after customer reported that their sites were being used to redirect to random domains. ” concludes the company.

article thumbnail

China-linked APT40 group hides behind 13 front companies

Security Affairs

“While the companies stress that they are committed to information security and cyber-defence, the technical job adverts that they have placed seek skills that would more likely be suitable for red teaming and conducting cyber-attacks,” they go on to say. “We know that multiple areas of China each have their own APT.”

article thumbnail

Security Affairs newsletter Round 249

Security Affairs

A new piece of Ryuk Stealer targets government, military and finance sectors. CVE-2020-7247 RCE flaw in OpenSMTPD library affects many BSD and Linux distros. Authorities arrest 3 Indonesian hackers behind many Magecart attacks. City of Potsdam offline following a cyberattack. Did H&M spy on its German employees? Magento 2.3.4