Tag: open source
FBI warns of fresh North Korean hacking tactic
The US Federal Bureau of Investigation (FBI) has issued a joint advisory warning of a new tactic being used by North Korean intelligence-gathering cyber group Kimsuky. The warning is squarely aimed at think tanks, academic institutions, non-profit organizations, and members of the media in Western countries. Despite North Korea’s previous reliance on revenue from international crime to finance its weapons and military programs, the FBI reports that Kimsuky’s role is intelligence gathering. Kimsuky exploits an improperly configured Domain Name System (DNS) to mimic legitimate email senders and hack targeted individuals. Without properly configured DNS Domain-based Message Authentication, Reporting, and Conformance (DMARC) policies, malicious hackers can send spoofed emails as if they came from a legitimate domain’s email exchange.
Middle Eastern Governments Targeted by Evasive “CR4T” Backdoor – April 19th
Kaspersky reported on their discovery of the cyber campaign labeled "DuneQuixote," which targets Middle Eastern government agencies through a sophisticated backdoor to spread malware. The backdoor, "CR4T," is a C/C++-based memory-only implant that enables threat actors to access consoles for command-line execution. This can lead to uploading and downloading illicit files onto affected systems.
Finland Police Accuse Chinese APT31 Group of 2020 Parliament Attack – March 29th
Following the US-led sanctions on Chinese individuals behind the Chinese APT31 group, the Police of Finland formally accused the group of hacking Finland's parliament in 2020. The country's law enforcement confirmed the connections between the breach and the Chinese group, claiming to have identified one specific suspect.
CISA Warns of “Volt Typhoon” Group Targeting Critical Infrastructure – March 21st
The US Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about the Chinese-linked "Volt Typhoon" group, which is targeting critical infrastructure. The CISA warning, issued in collaboration with the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI), confirmed the recent critical infrastructure attacks initiated by “Volt Typhoon” and the group's tactics and motives.
27,000 Private Data Stolen from Stanford Ransomware Attack – March 12th
Stanford University announced that the personal information of 27,000 individuals was stolen as a result of a September 2023 ransomware attack. The University also disclosed that only one system was breached, namely the "Department of Public Safety" network. The data included biometric data, dates of birth, social security numbers, government IDs, passport numbers, and driver's license numbers.
LockBit Resurfaces After Takedown – February 26th
Arriving days after law enforcement agencies took down LockBit's servers, the ransomware gang resurfaces with a new data leak portal on the dark web. On a public announcement of their re-launch, a LockBit administrator disclosed that their websites were confiscated, however, their operations recovered due to backup servers.
Microsoft’s GitHub: A Growing Platform for Delivering Malicious Payloads – January 12th
A Recorded Future report discloses that Microsoft-owned GitHub is a growing and lucrative platform for threat actors to effectively deliver malicious payloads by blending the payloads with legitimate traffic. The open-source data repository platform's legitimacy is now being leveraged cleverly by threat actors who are "living-off-trusted-sites". However, the limitations in the site's file size and storage stopped large-scale payloads used for data exfiltration from being delivered.