Tag: VPN

Healthcare Malware Hunt, Part 1: Philips DICOM Viewers
The article discusses a campaign by the China-based Advanced Persistent Threat (APT) group Silver Fox, which exploited vulnerabilities in Philips DICOM viewers to deploy malware such as a Remote Access Tool (RAT), keyloggers, and crypto miners targeting healthcare organizations. The healthcare sector remains a significant target for cyberattacks, necessitating robust security measures.…
Read More
Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors
The Lazarus Group from North Korea continues to use Astrill VPN to obscure their IP addresses during cyber attacks. Recent findings confirm that both the “Contagious Interview” subgroup and DPRK Fake IT workers employ this VPN to hide their activities. Silent Push has compiled a real-time updated list of Astrill VPN IP addresses to help protect users from these threats.…
Read More
Threat Context Monthly: Executive Intelligence Briefing for February 2025 – Black Basta, & M_A_G_A
This article highlights the recent activities of the Black Basta ransomware group, focusing on their internal operations and significant data leaks. Furthermore, it discusses another threat actor, M_A_G_A, who is engaged in distributing malware. The insights provided shed light on the evolving tactics and techniques employed by these cybercriminals.…
Read More
Privacy tech firms warn France’s encryption and VPN laws threaten privacy
Summary: Privacy-focused email provider Tuta and the VPN Trust Initiative are voicing concerns over proposed French laws that would impose backdoors in encrypted communication systems and restrict VPN access to pirate sites. The amendments, supported by law enforcement, threaten user privacy and security, with potential legal conflicts against European GDPR and Germany’s IT security regulations.…
Read More
Chinese APT Uses VPN Bug to Exploit Worldwide OT Orgs
Summary: Chinese cybercriminals, attributed to APT41, have exploited a high-severity vulnerability in Check Point security gateways, targeting sensitive operational technology organizations globally. The attackers utilized a VPN bug to gain access to valuable intellectual property, primarily affecting manufacturing companies, including many small businesses that lack robust cybersecurity measures.…
Read More
Resecurity | DragonForce Ransomware Group is Targeting Saudi Arabia
The DragonForce ransomware group has recently targeted organizations in the Kingdom of Saudi Arabia, resulting in the significant exfiltration of over 6 TB of confidential data from a major real estate and construction firm. The incident highlights a worrying trend of cyber threats against critical infrastructure in the region, indicating a potential expansion beyond the MENA area.…
Read More

https://github.com/jivoi/awesome-osint

A curated list of amazingly awesome open source intelligence tools and resources. Open-source intelligence (OSINT) is intelligence collected from publicly available sources. In the intelligence community (IC), the term “open” refers to overt, publicly available sources (as opposed to covert or clandestine sources).

This list is to help all of those who are into Cyber Threat Intellience (CTI), threat hunting, or OSINT.…

Read More

https://github.com/notthehiddenwiki/NTHW/tree/nthw

There are already 2853 links on our wiki!

💥 Intro

We believe that knowledge should be free! So we collected many valuable links from various specialists in their fields and created this wiki. Regardless of whether you are just starting your adventure with cybersecurity or you have been in this world for a long time, you will definitely find something for yourself on this wiki.…

Read More
Summary: A new threat actor, LARVA-208 (EncryptHub), has been conducting sophisticated spear-phishing attacks since June 2024, utilizing innovative techniques like smishing and vishing to gain access to corporate networks. They have obtained 70 domain names to impersonate legitimate VPN login pages and exploit vulnerabilities to harvest user credentials, followed by deploying ransomware to demand payments.…
Read More
EncryptHub breaches 618 orgs to deploy infostealers, ransomware
Summary: The threat actor known as ‘EncryptHub’ has been actively targeting organizations globally since June 2024, using spear-phishing and social engineering tactics to gain access to corporate networks. Upon infiltration, EncryptHub installs remote access tools and deploys data-stealing malware, often culminating in ransomware attacks. This sophisticated group also engages in domain purchasing for phishing, demonstrating advanced cyber-attack techniques to evade detection and compromise high-value targets.…
Read More
Leaked Black Basta Ransomware Chat Logs Reveal Inner Workings and Internal Conflicts
Summary: A leak of more than a year’s worth of internal chat logs from the Black Basta ransomware gang reveals insights into their operations and internal conflicts. The Russian-language conversations from 2023 to 2024 expose the group’s targeting of entities, including Russian banks, and highlight their tactics, such as exploiting security vulnerabilities and social engineering.…
Read More
Linux Detection Engineering – The Grand Finale on Linux Persistence – Elastic Security Labs
This article concludes the “Linux Persistence Detection Engineering” series by exploring advanced persistence mechanisms in Linux. Key topics include manipulation of GRUB and initramfs for persistence, exploitation of PolicyKit (Polkit) permissions, D-Bus configuration for unauthorized access, and NetworkManager dispatcher scripts. Readers are equipped with practical examples and detection strategies to bolster their defenses against Linux persistence threats.…
Read More
The Lurking Threat of Edge Security Products
Recent weeks have seen a surge in severe vulnerabilities affecting edge security products, which are now being exploited by attackers seeking easy access to networks. Vulnerabilities in devices like VPNs and firewalls have drawn attention as viable alternatives to phishing attacks. Notably, the Cybersecurity and Infrastructure Security Agency (CISA) has identified several significant vulnerabilities, including authentication bypasses in products from Palo Alto Networks and SonicWall.…
Read More
Malicious LNK Analysis
A detailed analysis of a malicious LNK file that executes a PowerShell script to download additional malware. The analysis reveals the structure of the LNK file, the payload it carries, and the indicators of compromise associated with it. The piece emphasizes the importance of understanding the attributes of the malicious file and the steps taken by the attacker to execute their plan.…
Read More
Silent Push Pivots into New Lazarus Group Infrastructure, Acquires Sensitive Intel Related to .4B ByBit Hack and Past Attacks
Silent Push analysts uncovered critical infrastructure used by the Lazarus APT Group, linking them to the historic .4 billion Bybit crypto heist through a recently registered domain. They identified an email connected to past attacks and noted the group’s preference for particular VPN IP addresses while exploiting fake job interviews on LinkedIn to deploy malware.…
Read More
PolarEdge: Unveiling an uncovered ORB network
The article discusses the PolarEdge botnet, which exploits the CVE-2023-20118 vulnerability in various Cisco Small Business Routers and causes compromised devices to launch coordinated attacks. The botnet has infected over 2,000 assets globally using sophisticated methods including web shells and a TLS backdoor. The research emphasizes the need for monitoring edge devices due to their vulnerability and operational importance to threat actors.…
Read More
In Focus: Dpose Ransomware – Technical Analysis and Mitigation Strategies
The article discusses the emergence of a new ransomware variant called Dpose, highlighting its sophisticated encryption techniques and stealth strategies aimed at maximizing damage. Dpose employs random four-character file extensions, disrupts recovery options, and operates under the Ransomware-as-a-Service model, mirroring trends in modern cyber threats. The article also outlines its financial impacts on various sectors, mitigation strategies, and the future of ransomware, particularly focusing on advanced AI techniques.…
Read More
FBI-CISA Ghost Ransomware Warning Shows Staying Power of Old Vulnerabilities 
A recent advisory from the FBI and CISA highlights the ongoing threat posed by the Ghost (Cring) ransomware group, which continues to exploit unpatched vulnerabilities in outdated software. The group, primarily motivated by financial gain, targets organizations globally and utilizes established techniques from previous years. The report underscores the critical importance of maintaining cybersecurity hygiene and patching known vulnerabilities to protect against these persistent threats.…
Read More