article thumbnail

Russia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 Windows flaw

Security Affairs

Russia-linked APT28 group used a previously unknown tool, dubbed GooseEgg, to exploit Windows Print Spooler service flaw. Microsoft reported that the Russia-linked APT28 group (aka “ Forest Blizzard ”, “ Fancybear ” or “ Strontium ” used a previously unknown tool, dubbed GooseEgg, to exploit the Windows Print Spooler flaw CVE-2022-38028.

Military 113
article thumbnail

Chinese APT Tropic Trooper target air-gapped military Networks in Asia

Security Affairs

Chinese threat actors, tracked as Tropic Trooper and KeyBoy, has been targeting air-gapped military networks in Taiwan and the Philippines. Chinese APT group Tropic Trooper, aka KeyBoy, has been targeting air-gapped military networks in Taiwan and the Philippines, Trend Micro researchers reported. ” continues the report.

Military 105
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Naikon APT group uses new Nebulae backdoor in attacks aimed at military orgs

Security Affairs

China-linked APT Naikon employed a new backdoor in multiple cyber-espionage operations targeting military organizations from Southeast Asia in the last 2 years. The Naikon APT group mainly focuses on high-profile orgs, including government entities and military orgs. Follow me on Twitter: @securityaffairs and Facebook.

article thumbnail

Estonian National charged with helping Russia acquire U.S. hacking tools and electronics

Security Affairs

made electronics on behalf of the Russian government and military. The Estonian man is accused of having helped the Russian government and military to purchase US-made electronics and hacking tools. “Shevlyakov also attempted to acquire computer hacking tools.” ” reads a press release published by DoJ.

article thumbnail

Targeted operation against Ukraine exploited 7-year-old MS Office bug

Security Affairs

The payload includes a dynamic-link library (vpn.sessings) that injects the post-exploitation tool Cobalt Strike Beacon into memory and awaits commands from the C2 server. The DLL also implements features to evade detection and avoid analysis by security experts. . Threat actors used a cracked version of Cobalt Strike.

Military 112
article thumbnail

Chinese Tropic Trooper APT spreads a hacking tool laced with a backdoor

Security Affairs

The Tropic Trooper APT has been active at least since 2012, it was first spotted by security experts at Trend Micro in 2015, when the threat actors targeted government ministries and heavy industries in Taiwan and the military in the Philippines. This version gather information collected by the original Yahoyah (i.e.

Military 101
article thumbnail

InvisiMole group targets military sector and diplomatic missions in Eastern Europe

Security Affairs

Security researchers at ESET recently uncovered a campaign carried out by the InvisiMole group that has been targeting a small number of high-profile organizations in the military sector and diplomatic missions in Eastern Europe. Pierluigi Paganini. SecurityAffairs – hacking, InvisiMole).