RECONNAISSANCE Archives - Page 36 of 47 - Cybersecurity News Everyday

Threat Research

Bitter Pill: Third-Party Pharmaceutical Vendor Linked to Pharmacy and Health Clinic Cyberattack

November 10, 2023May 24, 2024 Securonix

In a concerning development within the healthcare sector, Huntress has identified a series of unauthorized access that signifies internal reconnaissance and preparation for additional threat actor activity against multiple healthcare organizations.

The attackers abused a locally hosted instance of a widely-used remote access tool, ScreenConnect—utilized by the company Transaction Data Systems (which recently merged with and was renamed Outcomes), the makers of Rx30 and ComputerRx software — for initial access to victim organizations.…

Threat Research

The Swiss Knife – SystemBC | Coroxy

November 9, 2023May 24, 2024 Securonix

SystemBC, also known as Coroxy or DroxiDat, is a malware categorized as Proxy malware, a Bot, a backdoor, and even a RAT, as its uses can be diverse depending on the attacker, making it a versatile tool for Threat Actors. Active since 2018, it has gained significant popularity, finding a warm reception in underground markets where it can be purchased, and its interest has not waned.…

Threat Research

Hive Ransomware’s Offspring: Hunters International Takes the Stage

November 9, 2023May 24, 2024 Securonix

In January 2023, the FBI collaborated with law enforcement agencies in Germany and the Netherlands to successfully dismantle one of the most notorious ransomware groups known as Hive. Since June 2021, the Hive ransomware collective targeted over 1,500 victims worldwide, extracting over $100 million in ransom payments.…

Threat Research

CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys

November 9, 2023May 24, 2024 Securonix

This post is also available in: 日本語 (Japanese)

Executive Summary

Unit 42 researchers have identified an active campaign we are calling EleKtra-Leak, which performs automated targeting of exposed identity and access management (IAM) credentials within public GitHub repositories. AWS detects and auto-remediates much of the threat of exposed credentials in popular source code repositories by applying a special quarantine policy — but by manually removing that automatic protection, we were able to develop deeper insights into the activities that the actor would carry out in the case where compromised credentials are obtained in some other way.…

Threat Research

IMPERIAL KITTEN Deploys Novel Malware Families

November 8, 2023May 24, 2024 Securonix

CrowdStrike Counter Adversary Operations has been investigating a series of cyberattacks and strategic web compromise (SWC) operations targeting organizations in the transportation, logistics and technology sectors that occurred in October 2023. Based on a detailed examination of the malicious tooling used in these attacks, along with additional reporting and industry reports, CrowdStrike Intelligence attributes this activity to the IMPERIAL KITTEN adversary.…

Threat Research

New Gootloader Variant “GootBot” Changes the Game in Malware Tactics – SOCRadar® Cyber Intelligence Inc.

November 3, 2023May 24, 2024 Securonix

Researchers recently identified a fresh Gootloader malware variant known as “GootBot,” used in SEO poisoning attacks. This variant introduces features that enable threat actors to move laterally within infected systems, and make it challenging for organizations to detect or block.

Gootloader has predominantly served as an initial access provider, with certain infections leading to ransomware incidents.…

Threat Research

D0nut encrypt me, I have a wife and no backups

November 3, 2023May 24, 2024 Securonix

Unveiling the Dark Side: A Deep Dive into Active Ransomware Families Author: Ross Inman (@rdi_x64) Introduction

Our technical experts have written a blog series focused on Tactics, Techniques and Procedures (TTP’s) deployed by four ransomware families recently observed during NCC Group’s incident response engagements.

In case you missed it, last time we analysed an Incident Response engagement involving BlackCat Ransomware.…

Threat Research

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

November 1, 2023February 5, 2025 Securonix

December 2022, the automated synchronized fluxing of dynamic DNS records across Telegram channels and Telegraph sites at scale points to a potential elevation in actor resources and capability devoted to ongoing operations. In addition, by deploying multiple consecutive stages of Hive0051’s exclusive Gamma variant malware, the actor is able to remap victims to separate sets of actor-controlled C2 fluxing clusters.…

Threat Research

Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors

November 1, 2023May 24, 2024 Securonix

This post is also available in: 日本語 (Japanese)

Executive Summary

Unit 42 researchers have investigated a series of destructive cyberattacks beginning in January 2023 and continuing as recently as October 2023, targeting the education and technology sectors in Israel.

The attacks are characterized by attempts to steal sensitive data, such as personally identifiable information (PII) and intellectual property.…

Threat Research

Popping Blisters for research: An overview of past payloads and exploring recent developments

October 30, 2023May 24, 2024 Securonix

Blister is a piece of malware that loads a payload embedded inside it. We provide an overview of payloads dropped by the Blister loader based on 137 unpacked samples from the past one and a half years and take a look at recent activity of Blister.…

Threat Research

StripedFly: Perennially flying under the radar

October 26, 2023May 24, 2024 SecureList

Introduction

It’s just another cryptocurrency miner… Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows. It comes equipped with a built-in TOR network tunnel for communication with command servers, along with update and delivery functionality through trusted services such as GitLab, GitHub, and Bitbucket, all using custom encrypted archives.…

Threat Research

Ransomware Roundup – Knight | FortiGuard Labs

October 25, 2023May 24, 2024 Securonix

On a bi-weekly basis, FortiGuard Labs gathers data on ransomware variants of interest that have been gaining traction within our datasets and the OSINT community. The Ransomware Roundup report aims to provide readers with brief insights into the evolving ransomware landscape and the Fortinet solutions that protect against those variants.…

Threat Research

NetSupport Intrusion Results in Domain Compromise

October 23, 2023May 24, 2024 Securonix

NetSupport Manager is one of the oldest third-party remote access tools still currently on the market with over 33 years of history. This is the first time we will report on a NetSupport RAT intrusion, but malicious use of this tool dates back to at least 2016.…

Threat Research

Discord, I Want to Play a Game

October 18, 2023May 24, 2024 Securonix

By Ernesto Fernández Provecho and David Pastor Sanz (Threatray) · October 16, 2023

Discord is the first choice for gamers when they want to chat with some friends while playing an online computer game. Moreover, it is also a major choice for users that simply want to communicate with their friends and family.…

Threat Research

Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities

October 12, 2023May 24, 2024 Securonix

Updates

Nov. 02: Identified a third version of the BadCandy implant. Added expected response from the new version of the implant against one of the HTTP requests used to check for infected device.

Nov. 1: Observed increase in exploitation attempts since the publication of the proofs-of-concept (POCs) of the exploits involved.…

Threat Research

X-Force uncovers global NetScaler Gateway credential harvesting campaign

September 30, 2023May 24, 2024 Securonix

X-Force uncovers global NetScaler Gateway credential harvesting campaign

advisory document containing guidance on detection, incident response, mitigations and validating security controls. However, through multiple incident response investigations, X-Force discovered a new exploitation artifact related to CVE2-2023-3519 and developed additional guidance to be used in conjunction with CISA’s detection and response recommendations.…

Threat Research

Increase in Adversary-in-the-Middle Phishing Attacks

September 29, 2023May 24, 2024 Securonix

THE THREAT

eSentire has observed an increase in Adversary-in-the-Middle (AitM) phishing attacks, starting in mid-September 2023. AitM phishing attacks involve socially-engineering end-users into opening malicious links contained in emails. Data is then proxied or relayed through attacker-controlled infrastructure, leading to the theft of user credentials, including Multi-Factor Authentication (MFA) codes and session cookies that would grant access to various accounts.…

Threat Research

Threat Actors Exploit the Tensions Between Azerbaijan and Armenia | FortiGuard Labs

September 28, 2023May 24, 2024 Fortinet

A Short History Lesson

In 1923, the Soviet Union created the Nagorno-Karabakh Autonomous Oblast (an oblast is an administrative region or province) within the Azerbaijan Soviet Socialist Republic. This oblast has a 95% ethnically Armenian population. In 1988, Nagorno-Karabakh declared its intention to leave Azerbaijan and join the neighboring Republic of Armenia.…

Threat Research

Chinese State-Sponsored Cyber Espionage Activity Targeting Semiconductor Industry in East Asia

September 28, 2023May 24, 2024 Securonix

Executive Summary

EclecticIQ analysts identified a cyber espionage campaign where threat actors used a variant of HyperBro loader with a Taiwan Semiconductor Manufacturing (TSMC) lure, likely to target the semiconductor industry in Mandarin/Chinese speaking East Asian regions (Taiwan, Hong Kong, Singapore). Operational tactics, techniques, and procedures (TTPs) overlap with previously reported activities attributed to People’s Republic of China (PRC) backed cyber espionage group. …