PAYLOAD Archives - Page 120 of 147 - Cybersecurity News Everyday

Threat Research

The slow Tick-ing time bomb: Tick APT group compromise of a DLP software developer in East Asia

March 8, 2023May 24, 2024 Securonix

ESET researchers discovered a campaign that we attribute with high confidence to the APT group Tick. The incident took place in the network of an East Asian company that develops data-loss prevention (DLP) software.

The attackers compromised the DLP company’s internal update servers to deliver malware inside the software developer’s network, and trojanized installers of legitimate tools used by the company, which eventually resulted in the execution of malware on the computers of the company’s customers.…

Threat Research

Prometei botnet improves modules and exhibits new capabilities in recent updates

March 7, 2023May 24, 2024 Securonix

Prometei botnet continued its activity since Cisco Talos first reported about it in 2020. Since November 2022, we have observed Prometei improving the infrastructure components and capabilities. More specifically, the botnet operators updated certain submodules of the execution chain to automate processes and challenge forensic analysis methods.…

Threat Research

Overview of a Mirai Payload Generator

March 7, 2023May 24, 2024 Securonix

The Mirai[1] botnet is active for years. It was the first botnet targeting devices running Linux like camera recorders. Our first diary about it was in 2016![2]. Still today, my honeypot is hit by hundreds of Mirai requests every day! I found a Python script that generates a Mirai payload (SHA256:f56391e9645df1058847e28af6918c64ddc344d9f328b3dde9015213d5efdc7e[3]) and deploys networking services to serve it via FTP, HTTP, and TFTP.…

Threat Research

BatLoader Continues to Abuse Google Search Ads to Deliver Vidar…

March 6, 2023May 24, 2024 Securonix

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.…

Threat Research

IceFire Ransomware Returns | Now Targeting Linux Enterprise Networks

March 6, 2023May 24, 2024 Securonix

Executive SummaryIn recent weeks SentinelLabs observed novel Linux versions of IceFire ransomware being deployed within the enterprise network intrusions of several media and entertainment sector organizations worldwide. Currently observations indicate the attackers deployed the ransomware by exploiting CVE-2022-47986, a deserialization vulnerability in IBM Aspera Faspex file sharing software.…

Threat Research

Old Cyber Gang Uses New Crypter – ScrubCrypt | FortiGuard Labs

March 4, 2023May 24, 2024 Securonix

Affected platforms: WindowsImpacted parties: Any organizationImpact: Cryptojacks vulnerable systemsSeverity level: Critical

Between January and February 2023, FortiGuard Labs observed a payload targeting an exploitable Oracle Weblogic Server in a specific URI. This payload extracts ScrubCrypt, which obfuscates and encrypts applications and makes them able to dodge security programs.…

Threat Research

Qakbot Evolves to OneNote Malware Distribution

March 1, 2023May 24, 2024 Securonix

By Pham Duy Phuc, John Fokker J.E., Alejandro Houspanossian and Mathanraj Thangaraju · March 07, 2023This blog was also written by Raghav Kapoor

Qakbot (aka QBot, QuakBot, and Pinkslipbot) is a sophisticated piece of malware that has been active since at least 2007. Since the end of January 2023, there has been an upsurge in the number of Qakbot campaigns using a novel delivery technique: OneNote documents for malware distribution.…

Threat Research

Pandas with a Soul: Chinese Espionage Attacks Against Southeast Asian Government Entities – Check Point Research

March 1, 2023May 24, 2024 Securonix

Executive summary

In 2021, Check Point Research published a report on a previously undisclosed toolset used by Sharp Panda, a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities. Since then, we have continued to track the use of these tools across several operations in multiple Southeast Asian countries, in particular nations with similar territorial claims or strategic infrastructure projects such as Vietnam, Thailand, and Indonesia.…

Threat Research

Spike in LokiBot Activity During Final Week of 2022

February 28, 2023May 24, 2024 Securonix

This post is also available in: 日本語 (Japanese)

Executive Summary

Unit 42 researchers have uncovered a malware distribution campaign that is delivering the LokiBot information stealer via business email compromise (BEC) phishing emails. This malware is designed to steal sensitive information from victims’ systems, such as passwords and banking information, as well as other sensitive data.…

Threat Research

Cyble – New WhiteSnake Stealer Offered For Sale Via MaaS Model

February 28, 2023May 24, 2024 Securonix

A Stealer Capable of Targeting Both Windows and Linux Users

Cyble Research and Intelligence Labs (CRIL) came across a new malware strain called “WhiteSnake” Stealer. The stealer was first identified on cybercrime forums at the beginning of this month. It is designed to extract sensitive information from the victim’s computer.…

Threat Research

Cybercrime Takes Advantage of 2023-Recession with Job-Themed Scams

February 28, 2023May 24, 2024 Securonix

By Daksh Kapur · February 28, 2023

Figure 1 (image from freepik.com and flaticon.com)

The current economic climate globally is grim because of the ongoing recession. In this environment, job-themed emails have become a prime target for cybercriminals looking to exploit vulnerable individuals.

Trellix Advanced Research Center has observed cybercriminals using phishing and malware campaigns to target job seekers in a bid to steal sensitive information.…

Threat Research

MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT

February 27, 2023May 24, 2024 Securonix

ESET researchers have analyzed MQsTTang, a new custom backdoor that we attribute to the Mustang Panda APT group. This backdoor is part of an ongoing campaign that we can trace back to early January 2023. Unlike most of the group’s malware, MQsTTang doesn’t seem to be based on existing families or publicly available projects.…

Threat Research

Managed XDR Exposes Spear-Phishing Campaign Targeting Hospitality Industry Using RedLine Stealer

February 24, 2023May 24, 2024 Securonix

Find out how the Managed XDR team uncovered RedLine Stealer’s evasive spear-phishing campaign that targets the hospitality industry.

Recently, we noticed a spike in the number of emails received by one of our customers. After further investigation, we found that three other customers in the hospitality industry were also affected.…

Threat Research

OneNote: A Growing Threat for Malware Distribution

February 23, 2023May 24, 2024 Securonix

Introduction

Attackers are increasingly using OneNote documents to distribute malware, due to the heightened security measures against macro-based attacks and the widespread adoption and popularity of the platform. Analyzing several related case studies, this article showcases the obfuscation techniques used by threat actors to bypass threat detection measures and deceive users into executing malware on their systems via OneNote.…

Threat Research

New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign

February 23, 2023May 24, 2024 Securonix

Since December 2022, Cisco Talos has been observing an unidentified actor deploying two relatively new threats, the recently discovered MortalKombat ransomware and a GO variant of the Laplas Clipper malware, to steal cryptocurrency from victims. Talos observed the actor scanning the internet for victim machines with an exposed remote desktop protocol (RDP) port 3389, using one of their download servers that run an RDP crawler and also facilitates MortalKombat ransomware.…

Threat Research

EXFILTRATOR-22 – An Emerging Post-Exploitation Framework – CYFIRMA

February 23, 2023May 24, 2024 Securonix

Published On : 2023-02-24

Executive Summary

The CYFIRMA Research team has provided a preliminary analysis of a new post- exploitation framework called EXFILTRATOR-22 a.k.a. EX-22. After analyzing the available information, it is moderately certain that the individuals responsible for creating the malware are operating from North, East, or South-East Asia (possible countries include China, Taiwan, Hong Kong, Malaysia, Singapore, Philippines, etc.).…

Threat Research

Can You See It Now? An Emerging LockBit Campaign | FortiGuard Labs

February 23, 2023May 24, 2024 Securonix

FortiGuard Labs has observed a new LockBit ransomware campaign during last December and January using a combination of techniques effective against AV and EDR solutions. LockBit has been one of the more dangerous ransomware, active since 2019. It was part of several successful attacks against a large variety of industries, including critical infrastructure.…

Threat Research

BlackLotus UEFI bootkit: Myth confirmed

February 23, 2023May 24, 2024 Securonix

The number of UEFI vulnerabilities discovered in recent years and the failures in patching them or revoking vulnerable binaries within a reasonable time window hasn’t gone unnoticed by threat actors. As a result, the first publicly known UEFI bootkit bypassing the essential platform security feature – UEFI Secure Boot – is now a reality.…

Threat Research

Malware: The Rise of Threat Actors Using OneNote for Campaigns – InQuest

February 23, 2023May 24, 2024 Securonix

Microsoft OneNote is a file type now entrenched in the ongoing saga of abused file formats leveraged by adversaries to reach through defenses and deliver malware payloads to end users. Recently, we have seen OneNote’s sudden rise to prominence, following a pattern of other types of files used in the same capacity.…

Threat Research

Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting

February 23, 2023May 24, 2024 Securonix

We detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems.

Iron Tiger is an advanced persistent threat (APT) group that has been focused primarily on cyberespionage for more than a decade.…