DEFENSE EVASION Archives - Page 4 of 49 - Cybersecurity News Everyday

Turkey’s Attacking APT Groups and Attack Analyses

Threat Research

Turkey’s Attacking APT Groups and Attack Analyses

March 2, 2025March 2, 2025 iocOne

This study offers a comprehensive examination of Advanced Persistent Threats (APTs), focusing on their dynamics, techniques employed, and preventive measures. The article discusses the identification of APTs, the reasons behind attacks on Turkey, and their geopolitical and economic impacts. Furthermore, it explains the concept of Tactics, Techniques, and Procedures (TTP), their subdivision into sub-techniques, and details effective strategies to mitigate APT attacks.…

Fake CAPTCHA Delivers Lumma Stealer Malware

Threat Research

Fake CAPTCHA Delivers Lumma Stealer Malware

March 2, 2025March 2, 2025 Securonix

A new malware campaign has been discovered that utilizes fake CAPTCHA pages to deliver Lumma Stealer. The attackers employ phishing techniques with misleading Cloudflare verification prompts, tricking victims into executing malicious commands. The attack heavily relies on social engineering tactics and various Windows utilities. Affected: Lumma Stealer, phishing sectors, cybersecurity.…

Healthcare Malware Hunt, Part 1: Philips DICOM Viewers

Threat Research

Healthcare Malware Hunt, Part 1: Philips DICOM Viewers

March 1, 2025March 1, 2025 Securonix

The article discusses a campaign by the China-based Advanced Persistent Threat (APT) group Silver Fox, which exploited vulnerabilities in Philips DICOM viewers to deploy malware such as a Remote Access Tool (RAT), keyloggers, and crypto miners targeting healthcare organizations. The healthcare sector remains a significant target for cyberattacks, necessitating robust security measures.…

Cellebrite zero-day exploit used to target phone of Serbian student activist – Amnesty International Security Lab

Threat Research

Cellebrite zero-day exploit used to target phone of Serbian student activist – Amnesty International Security Lab

February 28, 2025February 28, 2025 iocOne

Amnesty International’s Security Lab revealed a case of Cellebrite’s forensic tools being misused to surveil a youth activist in Serbia. Subsequent investigations indicated that the Serbian authorities continue to exploit such tools for illegitimate surveillance of civil society despite international criticism. Further research highlighted zero-day vulnerabilities in Android USB drivers potentially affecting over a billion devices.…

Securonix Threat Labs Monthly Intelligence Insights – January 2025

Threat Research

Securonix Threat Labs Monthly Intelligence Insights – January 2025

February 28, 2025 Securonix

The Monthly Intelligence Insights report for November 2024 by Securonix Threat Labs highlights critical cybersecurity threats, incidents, and responses, including notable breaches involving Cyberhaven and the exploitation of Ivanti vulnerabilities. Organizations are urged to enhance their security measures, such as updating software and implementing more vigilant monitoring systems.…

Resecurity | DragonForce Ransomware Group is Targeting Saudi Arabia

Threat Research

Resecurity | DragonForce Ransomware Group is Targeting Saudi Arabia

February 27, 2025 iocOne

The DragonForce ransomware group has recently targeted organizations in the Kingdom of Saudi Arabia, resulting in the significant exfiltration of over 6 TB of confidential data from a major real estate and construction firm. The incident highlights a worrying trend of cyber threats against critical infrastructure in the region, indicating a potential expansion beyond the MENA area.…

Play Ransomware: Exposing One of 2024’s Greediest Cyber Extortionists

Threat Research

Play Ransomware: Exposing One of 2024’s Greediest Cyber Extortionists

February 26, 2025 Picussecurity

Play ransomware, also known as PlayCrypt, is a cybercrime organization that has surfaced since 2022, targeting organizations globally through sophisticated double-extortion tactics. They encrypt systems after exfiltrating sensitive data, demanding communication via email without revealing ransom amounts. The group has stricken over 300 entities across multiple sectors such as telecommunications, healthcare, and government.…

Linux Detection Engineering – The Grand Finale on Linux Persistence – Elastic Security Labs

Threat Research

Linux Detection Engineering – The Grand Finale on Linux Persistence – Elastic Security Labs

February 26, 2025February 26, 2025 iocOne

This article concludes the “Linux Persistence Detection Engineering” series by exploring advanced persistence mechanisms in Linux. Key topics include manipulation of GRUB and initramfs for persistence, exploitation of PolicyKit (Polkit) permissions, D-Bus configuration for unauthorized access, and NetworkManager dispatcher scripts. Readers are equipped with practical examples and detection strategies to bolster their defenses against Linux persistence threats.…

The Ultimate Black Basta Chat Leak Part 2 – Veeam & Confluence

Threat Research

The Ultimate Black Basta Chat Leak Part 2 – Veeam & Confluence

February 26, 2025February 26, 2025 iocOne

This article analyzes the tactics, techniques, and procedures (TTPs) of the LockBit and Black Basta ransomware groups, specifically focusing on their exploitation of Confluence software. Their similarities and differences are explored, along with methods for detection and incident response. Tools used for attacks, the attack flow, and risks involved are highlighted, along with suggestions for monitoring and protection strategies.…

North Korean Hacking Group Konni’s Malware – Direction for Money Laundering Prevention Supervision for Virtual Asset Operators (2025.2.18)

Threat Research

North Korean Hacking Group Konni’s Malware – Direction for Money Laundering Prevention Supervision for Virtual Asset Operators (2025.2.18)

February 26, 2025February 26, 2025 iocOne

This article discusses a malware linked to the North Korean hacking group Konni, which is disguised as a file related to virtual asset operators’ anti-money laundering guidelines. The malware utilizes PowerShell commands embedded within a LNK file to execute further malicious activities, including data theft and persistence techniques.…

IntelBroker: The Rising Threat Actor in the Cybercrime Landscape

Threat Research

IntelBroker: The Rising Threat Actor in the Cybercrime Landscape

February 26, 2025February 26, 2025 iocOne

IntelBroker is a sophisticated cyber adversary linked to various high-profile data breaches and illicit data trading, operating primarily through BreachForums. The actor has developed ransomware, conducted significant breaches, and engaged in dark web data sales. Their evolving techniques present ongoing challenges to various sectors. Affected: Cybersecurity, E-commerce, Government, Technology, Aviation

Keypoints :

IntelBroker is a highly active cybercriminal responsible for numerous data breaches and ransomware campaigns.…

5 Active Malware Campaigns in Q1 2025

February 25, 2025 LeakNews

Summary: The first quarter of 2025 saw intensified cyber threats as cybercriminals launched sophisticated malware attacks, including the NetSupport RAT and Lynx Ransomware. A range of malware families employed advanced tactics for infiltration, persistence, and data exfiltration, leaving organizations vulnerable to significant breaches. Utilizing real-time analysis tools like ANY.RUN…

LCRYX Ransomware: How a VB Ransomware Locks Your System

Threat Research

LCRYX Ransomware: How a VB Ransomware Locks Your System

February 25, 2025 K7computing

The article discusses the resurgence of LCRYX ransomware, a VBScript-based malware that encrypts files with the ‘.lcryx’ extension and demands a ransom for decryption. Key features of its operation include elevating privileges, blocking user controls, modifying the Windows registry, and encrypting files while deleting backup traces.…

Black Basta Playbook Chat Leak

Threat Research

Black Basta Playbook Chat Leak

February 24, 2025February 24, 2025 iocOne

This article provides insights into the Black Basta ransomware group, detailing their structure, attack tactics, and associated tools. Through a recent leak of their chats, critical information about their operational methods has been revealed, allowing for the development of effective threat hunting and incident response strategies.…

Ghost in the Shell: Null-AMSI Evading Traditional Security to Deploy AsyncRAT

Threat Research

Ghost in the Shell: Null-AMSI Evading Traditional Security to Deploy AsyncRAT

February 23, 2025 Cyble

A recently identified campaign utilizes malicious LNK files disguised as wallpapers to deceive users into executing malware. The attack leverages obfuscated PowerShell scripts and employs advanced techniques like Null-AMSI to bypass security measures. The final payload, AsyncRAT, allows attackers to gain remote control over victim systems.…

SPYLEND: The Android App Available on Google Play Store: Enabling Financial Cyber Crime & Extortion

Threat Research

SPYLEND: The Android App Available on Google Play Store: Enabling Financial Cyber Crime & Extortion

February 22, 2025 Cyfirma

This report discusses the malicious Android app “SpyLend,” disguised as a legitimate finance application. It exploits location-based targeting to facilitate predatory lending practices against Indian users, leading to data harvesting and potential extortion. The findings emphasize the ongoing risks associated with questionable mobile applications available on platforms like the Google Play Store.…

Fake CAPTCHA Malware Campaign: How Cybercriminals Use Deceptive Verifications to Distribute Malware

Threat Research

Fake CAPTCHA Malware Campaign: How Cybercriminals Use Deceptive Verifications to Distribute Malware

February 21, 2025 Cyfirma

The rise of the “ClickFix” technique has enabled cybercriminals to exploit fake CAPTCHA verification processes, facilitating sophisticated phishing and malware distribution campaigns. Through deceptive methods, such as mimicking legitimate security checks, threat actors can deliver malware like Lumma Stealer, steal sensitive information, and bypass security measures.…

Escape | VulnLab – Ever Heard of Windows Kiosk Mode? No? Well, It’s Time to Learn!

Threat Research

Escape | VulnLab – Ever Heard of Windows Kiosk Mode? No? Well, It’s Time to Learn!

February 21, 2025February 22, 2025 Infosecwriteups

This article outlines a penetration testing experience on a VulnLab machine utilizing Kiosk Mode. The author showcases methods to gain access and escalate privileges, particularly through RDP and exploiting Microsoft Edge. The journey includes discovering sensitive files, using tools like BulletsPassView, and successfully bypassing User Account Control (UAC) to achieve SYSTEM-level access.…

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Threat Research

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

February 21, 2025 Unit42

The article discusses the Stately Taurus cyber activity targeting organizations in ASEAN-affiliated countries, revealing its connection to the Bookworm malware. Unit 42 has identified the use of DLL sideloading techniques in these attacks, confirming the attribution of Bookworm to the Stately Taurus group after nearly a decade of unlinked observations.…

Ransomware 2025: Attacks Keep Rising as Threat Shows its Resilience

Threat Research

Ransomware 2025: Attacks Keep Rising as Threat Shows its Resilience

February 21, 2025 Symantec

Qilin ransomware, initially developed in Go and later in Rust, targets various platforms like Windows, Linux, and ESXi. In June 2024, a significant attack on London hospitals was claimed by Stinkbug, leading to considerable disruptions. The updated version, Qilin.B, introduced advanced encryption and evasion techniques, while attackers increasingly utilize living-off-the-land tools for data exfiltration and security software impairment.…