New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization
Talos discovered a new, stealthy espionage campaign that has likely persisted since at least March 2021. The observed activity affects an Islamic non-profit organization using backdoors for a previously unreported malware family we have named “Zardoor.”
https://blog.talosintelligence.com/new-zardoor-backdoor/
🎖@malwr
Talos discovered a new, stealthy espionage campaign that has likely persisted since at least March 2021. The observed activity affects an Islamic non-profit organization using backdoors for a previously unreported malware family we have named “Zardoor.”
https://blog.talosintelligence.com/new-zardoor-backdoor/
🎖@malwr
Cisco Talos
New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization
Talos discovered a new, stealthy espionage campaign that has likely persisted since at least March 2021. The observed activity affects an Islamic non-profit organization using backdoors for a previously unreported malware family we have named “Zardoor.”
Maldocs of Word and Excel: Vigor of the Ages
https://research.checkpoint.com/2024/maldocs-of-word-and-excel-vigor-of-the-ages/
🎖@malwr
https://research.checkpoint.com/2024/maldocs-of-word-and-excel-vigor-of-the-ages/
🎖@malwr
Check Point Research
Maldocs of Word and Excel: Vigor of the Ages - Check Point Research
Research by: Raman Ladutska We chose a fantasy decoration style at certain points of the article to attract attention to the described problem. We hope that visualizing a fantasy adventure as a fight against the source of evil will transform the real world…
Puckungfu 2: Another NETGEAR WAN Command Injection
https://research.nccgroup.com/2024/02/09/puckungfu-2-another-netgear-wan-command-injection/
🎖@malwr
https://research.nccgroup.com/2024/02/09/puckungfu-2-another-netgear-wan-command-injection/
🎖@malwr
NetHunter Hacker XIII: Overall guide to MITM framework
https://www.mobile-hacker.com/2024/02/13/nethunter-hacker-xiii-overall-guide-to-mitm-framework
🎖@malwr
https://www.mobile-hacker.com/2024/02/13/nethunter-hacker-xiii-overall-guide-to-mitm-framework
🎖@malwr
Mobile Hacker
NetHunter Hacker XIII: Overall guide to MITM framework Mobile Hacker
I will cover the several methods that attackers may employ to intercept network communication to execute ARP poisoning, HTTP and HTTPS traffic interception, and DNS spoofing. In the video below is a demonstration of using SSLstrip and DNS change to intercept…
👍2
CharmingCypress: Innovating Persistence
Through its managed security services offerings, Volexity routinely identifies spear-phishing campaigns targeting its customers. One persistent threat actor, whose campaigns Volexity frequently observ...
https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/
🎖@malwr
Through its managed security services offerings, Volexity routinely identifies spear-phishing campaigns targeting its customers. One persistent threat actor, whose campaigns Volexity frequently observ...
https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/
🎖@malwr
Volexity
CharmingCypress: Innovating Persistence
Through its managed security services offerings, Volexity routinely identifies spear-phishing campaigns targeting its customers. One persistent threat actor, whose campaigns Volexity frequently observes, is the Iranian-origin threat actor CharmingCypress…
HijackLoader Expands Techniques to Improve Defense Evasion
HijackLoader continues to become increasingly popular among adversaries for deploying additional payloads and tooling A recent HijackLoader variant employs sophisticated techniques to enhance its complexity and defense evasion CrowdStrike detects this new HijackLoader variant using machine learning and behavior-based detection capabilities CrowdStrike researchers have identified a HijackLoader (aka IDAT Loader) sample that employs sophisticated evasion...
https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
🎖@malwr
HijackLoader continues to become increasingly popular among adversaries for deploying additional payloads and tooling A recent HijackLoader variant employs sophisticated techniques to enhance its complexity and defense evasion CrowdStrike detects this new HijackLoader variant using machine learning and behavior-based detection capabilities CrowdStrike researchers have identified a HijackLoader (aka IDAT Loader) sample that employs sophisticated evasion...
https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
🎖@malwr
CrowdStrike.com
HijackLoader Expands Techniques to Improve Defense Evasion
Read this blog to learn about the HijackLoader sample that employs sophisticated evasion techniques to enhance the complexity of the threat.
❤1
CrowdStrike Defends Against Azure Cross-Tenant Synchronization Attacks
Azure cross-tenant synchronization (CTS) was made generally available on May 30, 2023, and introduced a new attack surface on Microsoft Entra ID (formerly Azure Active Directory) where attackers can move laterally to a partner tenant or create a backdoor on an existing tenant. CrowdStrike showcases two observed attack paths to outline how adversaries can abuse...
https://www.crowdstrike.com/blog/crowdstrike-defends-against-azure-cross-tenant-synchronization-attacks/
🎖@malwr
Azure cross-tenant synchronization (CTS) was made generally available on May 30, 2023, and introduced a new attack surface on Microsoft Entra ID (formerly Azure Active Directory) where attackers can move laterally to a partner tenant or create a backdoor on an existing tenant. CrowdStrike showcases two observed attack paths to outline how adversaries can abuse...
https://www.crowdstrike.com/blog/crowdstrike-defends-against-azure-cross-tenant-synchronization-attacks/
🎖@malwr
CrowdStrike.com
CrowdStrike Defends Against Azure Cross-Tenant Synchronization Attacks
Read this blog and learn how CrowdStrike Falcon Cloud Security defends against Azure cross-tenant synchronization attacks.
👍1
CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day
The APT group Water Hydra has been exploiting the zero-day Microsoft Defender SmartScreen vulnerability (CVE-2024-21412) in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day Initiative.
https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
🎖@malwr
The APT group Water Hydra has been exploiting the zero-day Microsoft Defender SmartScreen vulnerability (CVE-2024-21412) in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by the Trend Micro Zero Day Initiative.
https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
🎖@malwr
Trend Micro
CVE-2024-21412: Water Hydra Targets Traders with Microsoft Defender SmartScreen Zero-Day
The APT group Water Hydra has been exploiting the Microsoft Defender SmartScreen vulnerability CVE-2024-21412 in its campaigns targeting financial market traders. This vulnerability, which has now been patched by Microsoft, was discovered and disclosed by…
Kasseika Ransomware Deploys BYOVD Attacks, Abuses PsExec and Exploits Martini Driver
In this blog, we detail our investigation of the Kasseika ransomware and the indicators we found suggesting that the actors behind it have acquired access to the source code of the notorious BlackMatter ransomware.
https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware-deploys-byovd-attacks-abuses-psexec-and-expl.html
🎖@malwr
In this blog, we detail our investigation of the Kasseika ransomware and the indicators we found suggesting that the actors behind it have acquired access to the source code of the notorious BlackMatter ransomware.
https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware-deploys-byovd-attacks-abuses-psexec-and-expl.html
🎖@malwr
Trend Micro
Kasseika Ransomware Deploys BYOVD Attacks Abuses PsExec and Exploits Martini Driver
In this blog, we detail our investigation of the Kasseika ransomware and the indicators we found suggesting that the actors behind it have acquired access to the source code of the notorious BlackMatter ransomware.
The Risks of the #MonikerLink Bug in Microsoft Outlook and the Big Picture
https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/
🎖@malwr
https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/
🎖@malwr
Check Point Research
The Risks of the #MonikerLink Bug in Microsoft Outlook and the Big Picture - Check Point Research
Introduction Recently, Check Point Research released a white paper titled “The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors”, detailing various attack vectors on Outlook to help the industry understand the security…
2024-01-23 - UltraVNC infection
https://www.malware-traffic-analysis.net/2024/01/23/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2024/01/23/index.html
🎖@malwr
2024-01-17 - Malspam pushes WikiLoader
https://www.malware-traffic-analysis.net/2024/01/17/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2024/01/17/index.html
🎖@malwr
TinyTurla Next Generation - Turla APT spies on Polish NGOs
This new backdoor we’re calling “TinyTurla-NG” (TTNG) is similar to Turla’s previously disclosed implant, TinyTurla, in coding style and functionality implementation.
https://blog.talosintelligence.com/tinyturla-next-generation/
🎖@malwr
This new backdoor we’re calling “TinyTurla-NG” (TTNG) is similar to Turla’s previously disclosed implant, TinyTurla, in coding style and functionality implementation.
https://blog.talosintelligence.com/tinyturla-next-generation/
🎖@malwr
Cisco Talos
TinyTurla Next Generation - Turla APT spies on Polish NGOs
This new backdoor we’re calling “TinyTurla-NG” (TTNG) is similar to Turla’s previously disclosed implant, TinyTurla, in coding style and functionality implementation.
BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps
ESET researchers have discovered active campaigns linked to the China-aligned APT group known as GREF, distributing espionage code that has previously targeted Uyghurs
https://www.welivesecurity.com/en/eset-research/badbazaar-espionage-tool-targets-android-users-trojanized-signal-telegram-apps/
🎖@malwr
ESET researchers have discovered active campaigns linked to the China-aligned APT group known as GREF, distributing espionage code that has previously targeted Uyghurs
https://www.welivesecurity.com/en/eset-research/badbazaar-espionage-tool-targets-android-users-trojanized-signal-telegram-apps/
🎖@malwr
Welivesecurity
BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps
ESET research uncovers active campaigns linked to the China-aligned APT group known as GREF that distributing espionage code previously targeting Uyghurs.
Massive utility scam campaign spreads via online ads
https://www.malwarebytes.com/blog/threat-intelligence/2024/02/massive-utility-scam-campaign-spreads-via-online-ads
🎖@malwr
https://www.malwarebytes.com/blog/threat-intelligence/2024/02/massive-utility-scam-campaign-spreads-via-online-ads
🎖@malwr
Malwarebytes
Massive utility scam campaign spreads via online ads
Malwarebytes researchers have discovered a prolific campaign of fraudulent energy ads shown to users via Google searches.
Remote Monitoring & Management software used in phishing attacks
https://www.malwarebytes.com/blog/cybercrime/2024/02/remote-monitoring-management-software-used-in-phishing-attacks
🎖@malwr
https://www.malwarebytes.com/blog/cybercrime/2024/02/remote-monitoring-management-software-used-in-phishing-attacks
🎖@malwr
Malwarebytes
Remote Monitoring & Management software used in phishing attacks | Malwarebytes
Threat actors are abusing commercial remote software like AnyDesk to phish users and defraud them.
Navigating 2024's Geopolitical Fault Lines
Explore key 2024 geopolitical risks: Middle East volatility, Russia-Ukraine tensions, and China-Taiwan relations, with insights on global conflict flashpoints.
https://www.recordedfuture.com/navigating-2024s-geopolitical-fault-lines
🎖@malwr
Explore key 2024 geopolitical risks: Middle East volatility, Russia-Ukraine tensions, and China-Taiwan relations, with insights on global conflict flashpoints.
https://www.recordedfuture.com/navigating-2024s-geopolitical-fault-lines
🎖@malwr
Recordedfuture
Navigating 2024's Geopolitical Fault Lines
Explore key 2024 geopolitical risks: Middle East volatility, Russia-Ukraine tensions, and China-Taiwan relations, with insights on global conflict flashpoints.
👍1
Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
Insikt Group has observed TAG-70 leveraging cross-site scripting (XSS) vulnerabilities against Roundcube webmail servers in Europe, targeting government, military, and national infrastructure.
https://www.recordedfuture.com/russia-aligned-tag-70-targets-european-government-and-military-mail
🎖@malwr
Insikt Group has observed TAG-70 leveraging cross-site scripting (XSS) vulnerabilities against Roundcube webmail servers in Europe, targeting government, military, and national infrastructure.
https://www.recordedfuture.com/russia-aligned-tag-70-targets-european-government-and-military-mail
🎖@malwr