Tag: apt
-
Russian APT Hackers Co-Opt Pakistani Infrastructure
FSB Hackers Have Hijacked Others’ Command and Control Before. A Russian state hacking group hijacked the command and control infrastructure of a Pakistan-based espionage network as part of an ongoing intelligence-gathering operation targeting victims in Asia, finds a report from Microsoft and Black Lotus Labs. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/russian-apt-hackers-co-opt-pakistani-infrastructure-a-26982
-
Russian FSB Hackers Breach Pakistani APT Storm-0156
Parasitic advanced persistent threat (APT) Secret Blizzard accessed another APT’s infrastructure, and stole the same kinds of info it targets in South Asian government and military victims. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/russian-fsb-hackers-breach-pakistan-storm-0156
-
Russian Hackers Exploit Rival Attackers’ Infrastructure for Espionage
Tags: apt, blizzard, cyber, cybercrime, espionage, exploit, hacker, infrastructure, microsoft, russiaMicrosoft has found that Russian APT Secret Blizzard piggybacks on other cybercriminals’ infr4asytructure to conduct cyber espionage First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russia-hackers-exploit-rival/
-
Russia-linked APT Secret Blizzard spotted using infrastructure of other threat actors
Russia-linked APT group Secret Blizzard has used the tools and infrastructure of at least 6 other threat actors during the past 7 years. Researchers from Microsoft Threat Intelligence collected evidence that the Russia-linked ATP group Secret Blizzard (aka Turla,Snake,Uroburos,Waterbug,Venomous BearandKRYPTON) has used the tools and infrastructure of at least 6 other threat actors during the…
-
China-linked APT Salt Typhoon has breached telcos in dozens of countries
China-linked APT group Salt Typhoon has breached telecommunications companies in dozens of countries, US govt warns. President Biden’s deputy national security adviser Anne Neuberger said that China-linked APT group Salt Typhoon has breached telecommunications companies in dozens of countries. The Wall Street Journal reported that the senior White House official revealed that at least eight…
-
Russian FSB Hackers Breach Pakistan’s APT Storm-0156
Parasitic advanced persistent threat Secret Blizzard accesses another APT’s infrastructure and steals what it has stolen from South Asian government and military targets. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/russian-fsb-hackers-breach-pakistan-storm-0156
-
Spy v Spy: Russian APT Turla Caught Stealing from Pakistani APT
Russia’s Turla hackers hijacked 33 command servers operated by Pakistani hackers who had themselves breached Afghanistan and Indian targets. The post Spy v Spy: Russian APT Turla Caught Stealing from Pakistani APT appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/spy-v-spy-russian-apt-turla-caught-stealing-from-pakistani-apt/
-
Russian-linked Turla caught using Pakistani APT infrastructure for espionage
Both Microsoft and Lumen’s BlackLotus Labs found Turla spying on Afghanistan and India via Pakistani infrastructure. First seen on cyberscoop.com Jump to article: cyberscoop.com/turla-infiltrates-pakistani-apt-networks-microsoft-lumen/
-
Poison Ivy APT Launches Continuous Cyber Attack on Defense, Gov, Tech Edu Sectors
Researchers uncovered the resurgence of APT-C-01, also known as the Poison Ivy group, an advanced persistent threat organization notorious for its sustained cyber attacks. This group has been actively targeting sectors such as defense, government, technology, and education since 2007, utilizing sophisticated phishing techniques including watering hole phishing and spear phishing. Recent threat-hunting activities have…
-
BadBazaar: Android-Spyware durch trojanisierte Signal und Telegram Apps
cher haben aktive Kampagnen entdeckt, die mit der aus China stammenden APT-Gruppe GREF in Verbindung stehen und Spionagecode verbreiten, der zuvor auf… First seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/badbazaar-android-spyware-durch-trojanisierte-signal-und-telegram-apps/
-
ESET APT Activity Report Q2-Q3 2023
Tags: aptFirst seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/eset-apt-activity-report-q2-q3-2023/
-
PBR and Kittens: A Case Involving APT 35 Presented @ CactusCon 11
At the end of January 2023, James Navarro and Jacob Wellnitz from Kudelski Security’s US Incident Response team spoke at CactusCon 11 in Mesa, Arizona… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2023/02/09/pbr-and-kittens-a-case-involving-apt-35-presented-cactuscon-11/
-
Navigating the Evolving Threat Landscape: APT Trends in Q1 2024
First seen on thefinalhop.com Jump to article: www.thefinalhop.com/navigating-the-evolving-threat-landscape-apt-trends-in-q1-2024/
-
Turla APT Exploits New Backdoors to Infiltrate the EU Ministry of Defense
First seen on thefinalhop.com Jump to article: www.thefinalhop.com/turla-apt-exploits-new-backdoors-to-infiltrate-the-eu-ministry-of-defense/
-
Kimsuky APT Group Deploys New Linux Backdoor: Gomir
First seen on thefinalhop.com Jump to article: www.thefinalhop.com/kimsuky-apt-group-deploys-new-linux-backdoor-gomir/
-
Zero Day Exploit Reuse and A Busy Week for Iranian APTs
The focus was on Iranian APTs this week, both from private threat intelligence teams and CISA, exposing new operations from UNC757 and other groups ta… First seen on duo.com Jump to article: duo.com/decipher/zero-day-exploit-reuse-and-a-busy-week-for-iranian-apts
-
Russian APT RomCom combines Firefox and Windows zero-day flaws in drive-by exploit
Tags: access, antivirus, apt, attack, backdoor, browser, business, computer, cve, cybercrime, cyberespionage, defense, endpoint, exploit, flaw, germany, government, group, insurance, intelligence, malicious, microsoft, msp, password, powershell, russia, software, threat, ukraine, vulnerability, windows, zero-dayA Russia-aligned group that engages in both cybercrime and cyberespionage operations used a zero-click exploit chain last month that combined previously unknown and unpatched vulnerabilities in Firefox and Windows.The campaign, whose goal was to deploy the group’s RomCom backdoor on computers, targeted users from Europe and North America. The APT group, also known as Storm-0978,…
-
Attack Group APT60 Targets Japan Using Trusted Platforms
APT-C-60 targets Japan with phishing emails, using job application ruse and malware via Google Drive First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/aptc60-targets-japan-using-trusted/
-
APT60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign
The threat actor known as APT-C-60 has been linked to a cyber attack targeting an unnamed organization in Japan that used a job application-themed lure to deliver the SpyGlace backdoor.That’s according to findings from JPCERT/CC, which said the intrusion leveraged legitimate services like Google Drive, Bitbucket, and StatCounter. The attack was carried out around August…
-
APT60 Exploits WPS Office Vulnerability to Deploy SpyGlace Backdoor
The threat actor known as APT-C-60 has been linked to a cyber attack targeting an unnamed organization in Japan that used a job application-themed lure to deliver the SpyGlace backdoor.That’s according to findings from JPCERT/CC, which said the intrusion leveraged legitimate services like Google Drive, Bitbucket, and StatCounter. The attack was carried out around August…
-
Russian RomCom APT Group Leverages Zero-Day Flaws in Firefox and Windows
Russia-backed hackers, known as RomCom, have exploited critical zero-day vulnerabilities in Mozilla Firefox and Windows to launch targeted attacks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/romcom-apt-zeroday-flaws-firefox/
-
Russian APT Chained Firefox and Windows Zero-Days Against US and European Targets
The Russia-linked RomCom APT has been observed chaining two zero-days in Firefox and Windows for backdoor delivery. The post Russian APT Chained Firefox and Windows Zero-Days Against US and European Targets appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/russian-apt-chained-firefox-and-windows-zero-days-against-us-and-european-targets/
-
CVE-2024-21887 and More: How Earth Estries APT Group Exploits VPNs Servers
In a detailed report from Trend Micro, the Chinese advanced persistent threat (APT) group Earth Estries, also known by aliases like Salt Typhoon and GhostEmperor, has emerged as a significant... First seen on securityonline.info Jump to article: securityonline.info/cve-2024-21887-and-more-how-earth-estries-apt-group-exploits-vpns-servers/
-
‘RomCom’ APT Mounts Zero-Day, Zero-Click Browser Escapes in Firefox, Tor
The innocuously named Russian-sponsored cyber threat actor has combined critical and serious vulnerabilities in Windows and Firefox products in a zero-click code execution exploit. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/romcom-apt-zero-day-zero-click-browser-escapes-firefox-tor
-
Salt Typhoon Builds Out Malware Arsenal With GhostSpider
The APT, aka Earth Estries, is one of China’s most effective threat actors, performing espionage for sometimes years on end against telcos, ISPs, and governments before being detected. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/salt-typhoon-malware-arsenal-ghostspider
-
Chinese APT Hackers Using Multiple Tools And Vulnerabilities To Attack Telecom Orgs
Tags: apt, attack, backdoor, china, control, cyber, exploit, government, group, hacker, infrastructure, rat, tool, vulnerabilityEarth Estries, a Chinese APT group, has been actively targeting critical sectors like telecommunications and government entities since 2023. They employ advanced techniques, including exploiting vulnerabilities, lateral movement, and deploying multiple backdoors like GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, which have impacted Southeast Asia significantly. The group makes use of a sophisticated command and control infrastructure…
-
Aggressive Chinese APT Group Targets Governments with New Backdoors
A Trend Micro analysis of Earth Estries found that the Chinese threat actor is using new backdoors to avoid detection during espionage operations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-apt-governments-backdoors/
-
RomCom hackers chained Firefox and Windows zero-days to deliver backdoor
Russia-aligned APT group RomCom was behind attacks that leveraged CVE-2024-9680, a remote code execution flaw in Firefox, and CVE-2024-49039, an elevation of privilege … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/11/26/romcom-backdoor-cve-2024-9680-cve-2024-49039/
-
Unveiling the >>Nearest Neighbor Attack<<: A Russian APT's Covert Tactic to Weaponize Wi-Fi
Volexity, a leading cybersecurity firm, has revealed a novel attack technique employed by the Russian APT group GruesomeLarch (also known as APT28, Fancy Bear, etc.). Dubbed the >>Nearest Neighbor Attack,
-
Mysterious Elephant Using Hajj-Themed Bait in Attacks
Group Deploys Upgraded Malware Disguised as Microsoft File on Pilgrimage Goers. A South Asian threat actor identified as Mysterious Elephant or APT-K-47 by Knownsec 404 researchers is using a Hajj-themed lure to trick victims into malicious payload disguised as a Windows file. The hacker is using upgraded Asyncshell malware disguised as a Microsoft Compiled HTML…