Tag: malware
Malware Found to Evade Ukranian Detection for 9 Years – April 18th
Cisco Talos revealed its findings, showing that select Ukranian government agencies have been infected with the 'OfflRouter' malware since 2015. Cisco Talos researcher, Vanja Svajcer said. "The virus is still active in Ukraine and is causing potentially confidential documents to be uploaded to publicly accessible document repositories."
Raspberry Robin attacks via Windows
Raspberry Robin, a tough-to-detect worm carrying malware and ransomware, is now being delivered via Windows Shortcut Files and Windows Script Files. Researchers at Hewlett Packard (HP) first began to identify the new trend in March of this year. Previously, Raspberry Robin was delivered physically by inserting a weaponized USB stick into a targeted device. But now, this highly effective malware is being delivered via Windows Script Files (WSF), which are widely used by administrators and legitimate software to automate tasks within Windows. The WSF file format supports scripting languages, such as JScript and VBScript, that are interpreted by the Windows Script Host component built into the Windows operating system. It can, however, also be abused by attackers. The Windows Script Files are offered for download via various malicious domains and subdomains controlled by the attackers, which can be distributed via spam or fake online advertising campaigns.
Cyber gangs hold healthcare ransom
Cybercriminal groups have now completely abandoned any pretense that theirs are basically victimless crimes by attacking the healthcare sector with increasing ruthlessness. Healthcare, once said to be off limits to ‘responsible’ cyber criminals, is now the subject of an urgent warning from the Cybersecurity Coordination Center (HC3) of the US Department of Health and Human Services. “HC3 has recently observed threat actors employing advanced social engineering tactics to target IT help desks in the health sector and gain initial access to target organizations,” the warning states. Tactics include contacting an organization’s IT help desk with phone calls from a familiar area code and claiming to be an employee in a financial role.
Visa’s Warning on RAT Campaign Targeting Financial Orgs – April 5th
Visa released an alert on the 'JsOutProx' remote access trojan (RAT) malware phishing campaign which targets financial institutions and customers. The JSOutProx malware linked to the 'Solar Spider' threat actor delivers a RAT that could steal sensitive data, establish a C2 connection, and extract Outlook information, among others.
55% of Organizations Plan to Use AI to Enhance Security – April 4th
According to a report released by the Cloud Security Alliance and Google Cloud, 55% of all organizations plan to use AI to boost security by 2025. The "State of AI and Security Survey Report," also found that 67% of organizations already tested and are pleased with AI-backed security capabilities.
Millions of AT&T Data at Risk from Data Breach – April 1st
AT&T sent out a mass announcement to its customers, informing them that a dataset containing sensitive data from 7.6M current users and 65.4M former users is for sale on the dark web. To mitigate the breach, AT&T reset the passcodes of all its current users and will constantly communicate with customers to further protect accounts.
Finland Police Accuse Chinese APT31 Group of 2020 Parliament Attack – March 29th
Following the US-led sanctions on Chinese individuals behind the Chinese APT31 group, the Police of Finland formally accused the group of hacking Finland's parliament in 2020. The country's law enforcement confirmed the connections between the breach and the Chinese group, claiming to have identified one specific suspect.
Rise in Tax-Related Phishing Scams Detected – March 22nd
Microsoft's Threat Intelligence arm issued a warning on the rise of new, sophisticated tax phishing scams that could lead to stolen personal and financial data. These tax-related phishing scams are initiated by impersonating trusted employers, tax agencies, and payment processors. Victims click on a malicious attachment, which leads to a believable landing page designed to capture sensitive information.
Beware of fake Google docs
An under-the-radar attack that creates fake Google docs is now playing havoc across multiple sectors in the US and UK, particularly in healthcare. Companies’ increasing reliance on widely-used off-the-shelf external software may save costs and create efficiencies in the short-term, but it also offers new inroads for the current generation of increasingly devious and skilled cybercriminals Cybersecurity firm Netskope has identified a new Google Docs threat in the wild, AZORult infostealer. It is designed to steal sensitive information such as user credentials, browser information, credit card details and crypto-wallet data. A comprehensive study conducted by Netskope’s research team has uncovered a campaign where an attacker created fake Google Docs pages on Google sites from which to download malicious payloads.
Fake Chrome Update Spreads Banking Malware – March 19th
According to a Broadcom report, a banking trojan named "Cerberus" pretending to be a Google Chrome update has successfully distributed to numerous systems. Affecting only Android users, the Cerberus malware allows attackers to completely control affected systems through its complex remote access capabilities.
Google’s Improvements to Chrome’s ‘Safe Browsing’ Mode – March 18th
Google announced major security-focused revamps to Chrome's 'Safe Browsing' mode, which enables the service to work while checking against a server-side malware-site list in real-time. The added safety feature to Google Chrome's 'Safe Browsing' mode is a massive improvement compared to the browsing mode cross-checking against lists of malware-infected sites that were manually added every two hours.
Russian Hackers Breach Microsoft’s Code Base – March 8th
Microsoft announced the cyber campaign by the Russian-state-sponsored 'Midnight Blizzard' hackers, resulting in the group stealing the tech giant's source code. The sophisticated 'Midnight Blizzard' campaign is said to be rooted in a grander scheme to gain unauthorized access to Microsoft's environment using the stolen source code.