Tag: CRYPTO

This article provides a comprehensive overview of significant cybersecurity incidents and vulnerabilities reported recently, including outages, data breaches, and exploits targeting various platforms. Affected: Proton Mail, Ivanti VPN, Banshee, BayMark Health Services, Medusind, MirrorFace, STIIIZY, Samsung, GFI KerioControl, Mitel MiCollab, CrowdStrike, Akamai, Casio.

Keypoints :

Proton Mail experienced a worldwide outage due to a surge in database connections during infrastructure migration.…
Read More
PEAKLIGHT: Illuminating the Shadows
PEAKLIGHT is an obfuscated PowerShell downloader identified by Mandiant that delivers malware-as-a-service infostealers through Microsoft Shortcut Files. It utilizes a JavaScript dropper hosted on a CDN to execute malicious payloads, including LummaC2, HijackLoader, and CryptBot. The campaign highlights the use of legitimate tools for malware delivery while evading detection.…
Read More
DoJ Indicts Three Russians for Operating Crypto Mixers Used in Cybercrime Laundering
Summary: The U.S. Department of Justice has indicted three Russian nationals for their roles in operating cryptocurrency mixing services Blender.io and Sinbad.io, which were allegedly used for laundering criminal funds. The mixers facilitated transactions that obscured the origins of funds linked to various cyber crimes, including ransomware and wire fraud.…
Read More
Cybersecurity News Review Week 2
This article discusses recent significant developments in cybersecurity, including vulnerabilities in Ivanti products, phishing scams, data exposure issues, and new government initiatives aimed at improving cyber resilience. Affected: Ivanti Connect Secure, CrowdStrike, Motorola ALPR, Gmail, WordPress, CISA, UK Government

Keypoints :

Ivanti disclosed two high-severity vulnerabilities (CVE-2025–0282, CVE-2025–0283) affecting its products.…
Read More
Russian nationals arrested by US, accused of running crypto mixers Blender and Sinbad
Summary: Three Russian nationals have been indicted for their involvement in operating cryptocurrency mixing services Blender.io and Sinbad.io, which were used to launder funds for cybercriminals, including North Korea’s Lazarus Group. The U.S. Department of Justice, in collaboration with international law enforcement, has taken significant steps to dismantle these platforms and hold the operators accountable.…
Read More
New Web3 attack exploits transaction simulations to steal crypto
Summary: Threat actors are utilizing a new tactic known as “transaction simulation spoofing” to steal cryptocurrency, successfully executing an attack that resulted in the theft of 143.45 Ethereum, valued at around $460,000. This method exploits flaws in transaction simulation mechanisms in Web3 wallets, which are intended to protect users from fraudulent activities.…
Read More
Stealthy Credit Card Skimmer Targets WordPress Checkout Pages via Database Injection
This article discusses a sophisticated credit card skimmer malware targeting WordPress websites, which injects malicious JavaScript into database entries to steal payment information during checkout. The malware operates silently and avoids detection by embedding itself in the WordPress database. Affected: WordPress

Keypoints :

Credit card skimmer malware targets checkout pages on WordPress sites.…
Read More
HexaLocker V2: Skuld Stealer Paving the Way prior to Encryption
HexaLocker V2 is a newly updated ransomware variant that incorporates advanced functionalities such as a persistence mechanism, a data exfiltration process using Skuld Stealer, and enhanced encryption methods. The ransomware targets Windows systems, employing a double extortion tactic by stealing and encrypting files. Affected: HexaLocker, Skuld Stealer

Keypoints :

HexaLocker was first discovered in mid-2024, with version 2 introducing significant updates.…
Read More
Fake CrowdStrike job offer emails target devs with crypto miners
Summary: CrowdStrike has identified a phishing campaign that impersonates the company, targeting job seekers with fake job offer emails to distribute a Monero cryptocurrency miner. The campaign tricks victims into downloading a malicious application disguised as an employee CRM tool.

Threat Actor: Unknown | unknown Victim: Job Seekers | job seekers

Key Point :

Phishing emails impersonate CrowdStrike, thanking candidates for applying for a developer position.…
Read More
The Feed 2025-01-09
This article explores various cyber threats, including voice phishing by the “Crypto Chameleon” group, exploitation of vulnerabilities in Kerio Control and Ivanti Connect Secure VPN, and North Korean hackers targeting cryptocurrency wallets through fake job interviews. The rise of ransomware among state-sponsored APT groups is also highlighted, indicating a troubling trend in modern cyber threats.…
Read More
Examining Redtail Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics Guest Diary – SANS Internet Storm Center
This article discusses the redtail cryptocurrency mining malware, detailing its execution methods, the threat actors behind it, and the implications for cybersecurity. The analysis highlights the malware’s ability to adapt and exploit vulnerabilities, emphasizing the need for robust protective measures against such threats. Affected: honeypot, Palo Alto Networks’ PAN-OS

Keypoints :

redtail is a cryptocurrency mining malware that stealthily installs itself on compromised systems.…
Read More
Zero Day Initiative – ZDI Threat Hunting 2024 Highlights Trends and Challenges
The Zero Day Initiative Threat Hunting team had a productive 2024, identifying numerous zero-day vulnerabilities and their exploitation by threat actors. The team highlighted key achievements and ongoing challenges in vulnerability management, emphasizing the need for prompt and comprehensive patching solutions. Affected: Microsoft, Dropbox

Keypoints :

The ZDI Threat Hunting team identified multiple zero-day vulnerabilities exploited in the wild during 2024.…
Read More
PHP Servers Vulnerability Exploited to Inject PacketCrypt Cryptocurrency Miner
Researchers have identified a URL that exploits a server-side vulnerability in PHP scripts, allowing attackers to download and execute malicious executables. The malware, dr0p.exe, subsequently downloads pkt1.exe, which acts as a cryptocurrency miner, targeting vulnerable PHP servers. This incident emphasizes the importance of regular security updates to mitigate such threats.…
Read More
Cyber Briefing: January 7, 2025
This article discusses various recent cyber threats and incidents, including advanced backdoor attacks targeting AI models, data-stealing plugins, critical vulnerabilities in routers, and cyber espionage campaigns. It highlights the need for vigilance and updated security measures across multiple sectors. Affected Platform: Android, WordPress, Discord, various routers, telecommunications companies

Keypoints :

BARWM is a new backdoor attack method targeting deep learning models on mobile devices.…
Read More