Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities
https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/
🎖@malwr
https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/
🎖@malwr
Check Point Research
Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities - Check Point Research
Key Points Introduction On January 10, 2024, Ivanti published a security advisory regarding two vulnerabilities in Ivanti Connect Secure VPN. These vulnerabilities, which were exploited in the wild, are identified as CVE-2023-46805 and CVE-2023-21887. The…
Evasive Panda leverages Monlam Festival to target Tibetans
ESET researchers uncover strategic web compromise and supply-chain attacks targeting Tibetans
https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/
🎖@malwr
ESET researchers uncover strategic web compromise and supply-chain attacks targeting Tibetans
https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/
🎖@malwr
Welivesecurity
Evasive Panda leverages Monlam Festival to target Tibetans
ESET research uncovers a cyberespionage campaign that has been victimizing Tibetans through targeted watering hole (also known as a strategic web compromise) and supply-chain compromise attacks
👍1
Evasive Panda leverages Monlam Festival to target Tibetans
ESET researchers uncover strategic web compromise and supply-chain attacks targeting Tibetans
https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/
🎖@malwr
ESET researchers uncover strategic web compromise and supply-chain attacks targeting Tibetans
https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/
🎖@malwr
Welivesecurity
Evasive Panda leverages Monlam Festival to target Tibetans
ESET research uncovers a cyberespionage campaign that has been victimizing Tibetans through targeted watering hole (also known as a strategic web compromise) and supply-chain compromise attacks
🔥1
Analyze installed Android applications for security risks in Termux
https://www.mobile-hacker.com/2024/03/11/analyze-installed-android-applications-for-security-risks-in-termux/?utm_source=rss&utm_medium=rss&utm_campaign=analyze-installed-android-applications-for-security-risks-in-termux
🎖@malwr
https://www.mobile-hacker.com/2024/03/11/analyze-installed-android-applications-for-security-risks-in-termux/?utm_source=rss&utm_medium=rss&utm_campaign=analyze-installed-android-applications-for-security-risks-in-termux
🎖@malwr
Mobile Hacker
Analyze installed Android applications for security risks in Termux
I will show you how to install and run it on non-rooted Android device using Termux app. This brings convenience of analyzing Android apps directly on device
❤1
Know your enemies: An approach for CTI teams
https://blog.virustotal.com/2024/03/know-your-enemies-approach-for-cti-teams.html
🎖@malwr
https://blog.virustotal.com/2024/03/know-your-enemies-approach-for-cti-teams.html
🎖@malwr
Virustotal
Know your enemies: An approach for CTI teams
VirusTotal’s Threat Landscape can be a valuable source of operational and tactical threat intelligence for CTI teams, for instance helping...
FakeBat delivered via several active malvertising campaigns
https://www.malwarebytes.com/blog/threat-intelligence/2024/03/fakebat-delivered-via-several-active-malvertising-campaigns
🎖@malwr
https://www.malwarebytes.com/blog/threat-intelligence/2024/03/fakebat-delivered-via-several-active-malvertising-campaigns
🎖@malwr
ThreatDown by Malwarebytes
FakeBat delivered via several active malvertising campaigns
A number of software brands are being impersonated with malicious ads and fake sites to distribute malware.
.NET Malware 101: Analyzing the .NET Executable File Structure
Welcome to our deep dive into the world of .NET malware reverse engineering. As a security researcher or analyst, you’re likely aware that the .NET framework, famed for its ability to enable rapid and robust application development, is a double-edged sword. The same features that make it attractive to legitimate developers also make it a...
https://intezer.com/blog/incident-response/intro-to-malware-net-executable-file/
🎖@malwr
Welcome to our deep dive into the world of .NET malware reverse engineering. As a security researcher or analyst, you’re likely aware that the .NET framework, famed for its ability to enable rapid and robust application development, is a double-edged sword. The same features that make it attractive to legitimate developers also make it a...
https://intezer.com/blog/incident-response/intro-to-malware-net-executable-file/
🎖@malwr
Intezer
.NET Malware 101: Analyzing the .NET Executable File Structure
This deep dive aims to guide you through .NET reverse engineering, equipping you with the essential knowledge to analyze .NET malware.
❤1
CVE-2024-21412: DarkGate Operators Exploit Microsoft Windows SmartScreen Bypass in Zero-Day Campaign
In addition to our Water Hydra APT zero day analysis, the Zero Day Initiative (ZDI) observed a DarkGate campaign which we discovered in mid-January 2024 where DarkGate operators exploited CVE-2024-21412.
https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
🎖@malwr
In addition to our Water Hydra APT zero day analysis, the Zero Day Initiative (ZDI) observed a DarkGate campaign which we discovered in mid-January 2024 where DarkGate operators exploited CVE-2024-21412.
https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
🎖@malwr
Trend Micro
CVE-2024-21412: DarkGate Operators Exploit Microsoft Windows SmartScreen Bypass in Zero-Day Campaign
In addition to our Water Hydra APT zero day analysis, the Zero Day Initiative (ZDI) observed a DarkGate campaign which we discovered in mid-January 2024 where DarkGate operators exploited CVE-2024-21412.
👍1
Threat actors leverage document publishing sites for ongoing credential and session token theft
Talos IR has responded to several recent incidents in which threat actors used legitimate digital document publishing sites such as Publuu and Marq to host phishing documents as part of ongoing credential and session harvesting attacks.
https://blog.talosintelligence.com/threat-actors-leveraging-document-publishing-sites/
🎖@malwr
Talos IR has responded to several recent incidents in which threat actors used legitimate digital document publishing sites such as Publuu and Marq to host phishing documents as part of ongoing credential and session harvesting attacks.
https://blog.talosintelligence.com/threat-actors-leveraging-document-publishing-sites/
🎖@malwr
Cisco Talos
Threat actors leverage document publishing sites for ongoing credential and session token theft
Talos IR has responded to several recent incidents in which threat actors used legitimate digital document publishing sites such as Publuu and Marq to host phishing documents as part of ongoing credential and session harvesting attacks.
The Development of a Telco Attack Testing Tool
https://research.nccgroup.com/2024/03/13/the-development-of-a-telco-attack-testing-tool/
🎖@malwr
https://research.nccgroup.com/2024/03/13/the-development-of-a-telco-attack-testing-tool/
🎖@malwr
Nccgroup
Cyber Security Research
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
LTair: The LTE Air Interface Tool
https://research.nccgroup.com/2024/03/14/ltair-the-lte-air-interface-tool/
🎖@malwr
https://research.nccgroup.com/2024/03/14/ltair-the-lte-air-interface-tool/
🎖@malwr
Nccgroup
Cyber Security Research
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
The Anatomy of an ALPHA SPIDER Ransomware Attack
ALPHA SPIDER is the adversary behind the development and operation of the Alphv ransomware as a service (RaaS). Over the last year, ALPHA SPIDER affiliates have been leveraging a variety of novel techniques as part of their ransomware operations. CrowdStrike Services has observed techniques such as the usage of NTFS Alternate Data Streams for hiding...
https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/
🎖@malwr
ALPHA SPIDER is the adversary behind the development and operation of the Alphv ransomware as a service (RaaS). Over the last year, ALPHA SPIDER affiliates have been leveraging a variety of novel techniques as part of their ransomware operations. CrowdStrike Services has observed techniques such as the usage of NTFS Alternate Data Streams for hiding...
https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/
🎖@malwr
CrowdStrike.com
The Anatomy of an ALPHA SPIDER Ransomware Attack
Read this blog on the anatomy of an ALPHA SPIDER ransomware attack to better understand how they operate and how to better protect your business.
👍2
Android Phishing Scam Using Malware-as-a-Service on the Rise in India
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/android-phishing-scam-using-malware-as-a-service-on-the-rise-in-india/
🎖@malwr
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/android-phishing-scam-using-malware-as-a-service-on-the-rise-in-india/
🎖@malwr
McAfee Blog
Android Phishing Scam Using Malware-as-a-Service on the Rise in India | McAfee Blog
Authored by ZePeng Chen and Wenfeng Yu McAfee Mobile Research Team has observed an active scam malware campaign targeting Android users in India. This
👍1
2024-03-06: Pikabot infection leads to Meduza Stealer
https://www.malware-traffic-analysis.net/2024/03/06/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2024/03/06/index.html
🎖@malwr
2024-03-14: AsyncRAT and XWorm infection
https://www.malware-traffic-analysis.net/2024/03/14/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2024/03/14/index.html
🎖@malwr
The LockBit story: Why the ransomware affiliate model can turn takedowns into disruptions
Talos explores the recent law enforcement takedown of LockBit, a prolific ransomware group that claimed to resume their operations 7 days later.
https://blog.talosintelligence.com/ransomware-affiliate-model/
🎖@malwr
Talos explores the recent law enforcement takedown of LockBit, a prolific ransomware group that claimed to resume their operations 7 days later.
https://blog.talosintelligence.com/ransomware-affiliate-model/
🎖@malwr
Cisco Talos
The LockBit story: Why the ransomware affiliate model can turn takedowns into disruptions
Talos explores the recent law enforcement takedown of LockBit, a prolific ransomware group that claimed to resume their operations 7 days later.
👍1
Ransomware’s appetite for US healthcare sees known attacks double in a year
https://www.malwarebytes.com/blog/ransomware/2024/03/ransomwares-appetite-for-us-healthcare-sees-known-attacks-double-in-a-year
🎖@malwr
https://www.malwarebytes.com/blog/ransomware/2024/03/ransomwares-appetite-for-us-healthcare-sees-known-attacks-double-in-a-year
🎖@malwr
ThreatDown by Malwarebytes
Ransomware’s appetite for US healthcare sees known attacks double in a year - ThreatDown by Malwarebytes
The US healthcare industry suffers more ransomware attacks than most countries.
Hello everybody. I'm sorry for inconvenience. To keep our channel up, I have to pay for server and services. For that, we need financial support. If channel members could kindly donate in BTC, I will not post any ads in the channel.
Sincerely,
@SirMalware
🎖@malwr
Sincerely,
@SirMalware
🎖@malwr
👍7
Healthcare still a prime target for cybercrime gangs – Week in security with Tony Anscombe
Healthcare organizations remain firmly in attackers' crosshairs, representing 20 percent of all victims of ransomware attacks among critical infrastructure entities in the US in 2023
https://www.welivesecurity.com/en/videos/healthcare-target-cybercrime-week-security-tony-anscombe/
🎖@malwr
Healthcare organizations remain firmly in attackers' crosshairs, representing 20 percent of all victims of ransomware attacks among critical infrastructure entities in the US in 2023
https://www.welivesecurity.com/en/videos/healthcare-target-cybercrime-week-security-tony-anscombe/
🎖@malwr
Welivesecurity
Healthcare still a prime target for cybercrime gangs – Week in security with Tony Anscombe
Healthcare organizations remain firmly in attackers' crosshairs, accounting for more than 20 percent of all ransomware attacks that targeted critical infrastructure entities in the US in 2023
Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.
https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html
🎖@malwr
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.
https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html
🎖@malwr
Trend Micro
Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
Since early 2022, we have been monitoring an APT campaign that targets several government entities worldwide, with a strong focus in Southeast Asia, but also seen targeting Europe, America, and Africa.