Remove tag family
article thumbnail

Multiple APT groups exploited WinRAR flaw CVE-2023-38831

Security Affairs

Google TAG reported that both Russia and China-linked threat actors are weaponizing the a high-severity vulnerability in WinRAR. Google’s Threat Analysis Group (TAG) reported that in recent weeks multiple nation-state actors were spotted exploiting the vulnerability CVE-2023-38831 in WinRAR. ” reported Google TAG.

Archiving 126
article thumbnail

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Security Affairs

Google’s Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively exploited zero-day vulnerabilities in 2023. In 2023, Google (TAG) and Mandiant discovered 29 out of 97 vulnerabilities exploited in the wild. ” reads the report published by Google TAG. ” continues the report.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Google TAG spotted actors using new code signing tricks to evade detection

Security Affairs

Researchers from Google’s TAG team reported that financially motivated actors are using new code signing tricks to evade detection. The experts noticed that the technique was employed by operators behind OpenSUpdater, which is a known family of unwanted software . ” read the analysis published by Google TAG.

Security 118
article thumbnail

Google: four zero-day flaws have been exploited in the wild

Security Affairs

Security researchers from Google Threat Analysis Group (TAG) and Google Project Zero revealed that four zero-day vulnerabilities have been exploited in the wild earlier this year. ” Post by @_clem1 & @maddiestone on 4 0days TAG found this year (with IOCs!). Also thoughts on why we are seeing so many 0day in 2021. .”

article thumbnail

Balada Injector still at large – new domains discovered

Security Affairs

Within the file, there were seven brackets of PHP tags and each of them contained an obfuscated piece of code within. The PHP tags were stacked on top of each other, having legitimate code of the website at the very bottom. Key takeaways The Balada injector is a malware family known to be active from 2017 to the present day.

Access 94
article thumbnail

Poulight Stealer, a new Comprehensive Stealer from Russia

Security Affairs

Like most of the malware of this specific family, it is generated from a builder available to cyber criminal groups that offer a subscription plan for its “product”. The first information tag “ prog.params ” is immediately retrieved in the instruction “ HandlerParams.Start() ” seen in Figure 4. Sample information. Conclusion.

article thumbnail

Exclusive: Pro-Russia group ‘Cyber Spetsnaz’ is attacking government agencies

Security Affairs

Ukraine’s main cybersecurity incident response team released a list of the five most persistent hacking groups and malware families attacking Ukraine’s critical infrastructure.