#Godfather #Trojan

The Android banking Trojan Godfather is currently being utilized by cybercriminals to attack users of popular financial services across the globe. To date, 215 international banks, 94 cryptocurrency wallets and 110 crypto exchange platforms have fallen victim to this Trojan.

Group-IB’s Threat Intelligence team discovered that Godfather is a successor of Anubis, a widely-used banking Trojan whose functionalities were limited by Android updates and the prior efforts of malware detection and prevention providers. According to Group-IB’s findings, banking applications in the United States, Turkey, Spain, Canada, France, Germany, and the United Kingdom, have been the most targeted by Godfather.

In a new blog post, Group-IB’s Threat Intelligence team describes in detail who Godfather attacks, how it does it, and what this banking Trojan inherited from its predecessor. Read now👈

Group-IB has analyzed an ongoing advanced persistent threat campaign that we believe, with moderate confidence, was launched by a new threat actor. This new APT group, codenamed Dark Pink by Group-IB researchers, is notable due to their specific focus on attacking branches of the military, and government ministries and agencies.

Group-IB discovered that, as of December 2022, Dark Pink APT breached the security defenses of six organizations in five APAC countries (Cambodia, Indonesia, Malaysia, Philippines, and Vietnam), and one organization in Europe (Bosnia and Herzegovina).

Group-IB, in line with its zero-tolerance policy to cybercrime, has issued proactive notifications to all potential and confirmed targets of Dark Pink. Read our fresh blog post to get the details about the new threat actor👈

#APT #DarkPink

Let's dive a little bit deeper into the ransomware threat. According to the latest edition of Group-IB’s annual Hi-Tech Crime Trends report, ransomware will remain the top threat for organizations and businesses in 2023.

Here are some highlights:

📍Across the globe, 2,886 companies had their information, files, and data published on ransomware DLS between H2 2021 – H1 2022.

📍The top five most affected countries were the United States, Germany, United Kingdom, Canada, and Italy.

📍The largest number of ransomware-related data leak victims were found in the following sectors: manufacturing, real estate, professional services, and transportation industries.

📍The most active ransomware groups in H2 2021 – H1 2022 were Lockbit, Conti, and Hive.

Want to learn more about Group-IB's findings on ransomware and other cyberthreats? Download our newest report Hi-Tech Crime Trends 2022/2023👈

#HiTechCrimeTrends #report #ransomware

🔮A little cybersecurity forecast never hurt nobody. We have put together the top cyber threats that you need to be aware of in 2023, according to Group-IB's annual Hi-Tech Crime Trends report.

Make sure to download the full report👈

#HiTechCrimeTrends #report

📨 It all started with an email...

In the summer of 2022, the Group-IB Managed Extended Detection and Response (MXDR) solution successfully detected and blocked an email carrying a malicious attachment. This email was intended for Group-IB’s employees.

While analyzing this attack, the Group-IB Threat Intelligence team found patterns in the actions of the attackers and attributed the observed TTPs to the Tonto Team (aka HeartBeat, Karma Panda, CactusPete, Bronze Huntley, Earth Akhlut). What else did we find out about the threat actor?

▪️The attackers used phishing emails to deliver malicious Microsoft Office documents created with the Royal Road Weaponizer, a tool widely used by Chinese nation-state threat actors.

▪️During the attack, Group-IB researchers noticed the use of the Bisonal.DoubleT backdoor. Bisonal.DoubleT is a unique tool developed by the Tonto Team APT.

▪️The attackers used a new downloader that Group-IB analysts named TontoTeam.Downloader (aka QuickMute).

Check out our fresh blog where we provide indicators of compromise associated with the Tonto Team campaign and detailed analysis of the tools, techniques, and procedures (TTPs) of the threat actor. This information is useful for organizations fighting cybercrime and information security professionals — chief information officers, SOC analysts, and incident responders — in other sectors targeted by the Tonto Team. Read👈

#APT #TontoTeam