Tag: apt
-
Fancy Bear ‘Nearest Neighbor’ Attack Uses Nearby Wi-Fi Network
In a new class of attack, the Russian APT breached a target in Washington, DC, by credential-stuffing wireless networks in close proximity to it and daisy-chaining a vector together in a resourceful and creative way, according to researchers. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/fancy-bear-nearest-neighbor-attack-wi-fi
-
Russia-linked APT TAG-110 uses targets Europe and Asia
Russia-linked threat actors TAG-110 employed custom malware HATVIBE and CHERRYSPY to target organizations in Asia and Europe. Insikt Group researchers uncovered an ongoing cyber-espionage campaign by Russia-linked threat actor TAG-110 that employed custom malware tools HATVIBE and CHERRYSPY. The campaign primarily targeted government entities, human rights groups, and educational institutions in Central Asia, East Asia,…
-
WolfsBane: Gelsemium APT Group’s Linux Backdoor Debut
ESET researchers have unveiled WolfsBane, the Linux counterpart to the Windows-based Gelsevirine backdoor, marking a significant milestone in the evolution of the Gelsemium Advanced Persistent Threat (APT) group. Known for... First seen on securityonline.info Jump to article: securityonline.info/wolfsbane-gelsemiums-linux-backdoor-debut/
-
Asyncshell: The Evolution of APT47’s Cyber Arsenal
The Knownsec 404 Advanced Threat Intelligence team has uncovered a sophisticated and evolving threat from the APT-K-47 group, also known as Mysterious Elephant. This South Asia-based Advanced Persistent Threat (APT)... First seen on securityonline.info Jump to article: securityonline.info/asyncshell-the-evolution-of-apt-k-47s-cyber-arsenal/
-
Security Affairs newsletter Round 499 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. A cyberattack on gambling giant IGT disrupted portions of its IT systems China-linked APT Gelsemiumuses a new Linux…
-
China-linked APT Gelsemium uses a new Linux backdoor dubbed WolfsBane
China-linked APT Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane in attacks targeting East and Southeast Asia. China-linked APT Gelsemium has deployed a previously unknown Linux backdoor, WolfsBane, in attacks targeting East and Southeast Asia, according to ESET. Victims include entities in Taiwan, the Philippines, and Singapore, as seen in VirusTotal samples from…
-
Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks
Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as >>GruesomeLarch>Nearest Neighbor Attack.
-
APT47 Uses Hajj-Themed Lures to Deliver Advanced Asyncshell Malware
The threat actor known as Mysterious Elephant has been observed using an advanced version of malware called Asynshell.The attack campaign is said to have used Hajj-themed lures to trick victims into executing a malicious payload under the guise of a Microsoft Compiled HTML Help (CHM) file, the Knownsec 404 team said in an analysis published…
-
In Other News: Nvidia Fixes Critical Flaw, Chinese Linux Backdoor, New Details in WhatsApp-NSO Lawsuit
Noteworthy stories that might have slipped under the radar: Nvidia fixes vulnerability with rare ‘critical’ severity, Chinese APT’s first Linux backdoor, new details emerge from the WhatsApp-NSO lawsuit. The post In Other News: Nvidia Fixes Critical Flaw, Chinese Linux Backdoor, New Details in WhatsApp-NSO Lawsuit appeared first on SecurityWeek. First seen on securityweek.com Jump to…
-
Chinese APTs Shift Tactics to Evade Detection and Maintain Stealth
In light of increasing global tensions and heightened scrutiny, Chinese Advanced Persistent Threat (APT) groups are adapting their strategies to avoid detection and maintain stealth in their cyber espionage operations.... First seen on securityonline.info Jump to article: securityonline.info/chinese-apts-shift-tactics-to-evade-detection-and-maintain-stealth/
-
Volt Typhoon: Chinese State-Sponsored APT Targets U.S. Critical Infrastructure
The Tenable Security Response Team has uncovered critical details about Volt Typhoon, a state-sponsored Advanced Persistent Threat (APT) group linked to the People’s Republic of China. The group has been... First seen on securityonline.info Jump to article: securityonline.info/volt-typhoon-chinese-state-sponsored-apt-targets-u-s-critical-infrastructure/
-
Chinese APT Gelsemium Deploys ‘Wolfsbane’ Linux Variant
In a sign of the times, a backdoor malware whose ancestors date back to 2005 has morphed to target Linux systems. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/chinese-apt-gelsemium-wolfsbane-linux-variant
-
Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor
The China-aligned advanced persistent threat (APT) actor known as Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane as part of cyber attacks likely targeting East and Southeast Asia.That’s according to findings from cybersecurity firm ESET based on multiple Linux samples uploaded to the VirusTotal platform from Taiwan, the Philippines, and Singapore in…
-
Linux Malware WolfsBane and FireWood Linked to Gelsemium APT
New Linux malware WolfsBane and FireWood have been linked to Gelsemium APT, a cyber-espionage group targeting critical systems First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/linux-malware-wolfsbane-firewood/
-
China’s ‘Liminal Panda’ APT Attacks Telcos, Steals Phone Data
In US Senate testimony, a CrowdStrike exec explained how this advanced persistent threat penetrated telcos in Asia and Africa, gathering SMS messages, unique identifiers, and other metadata along the way. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/china-liminal-panda-telcos-phone-data
-
Chinese APT Group Targets Telecom Firms Linked to Belt and Road Initiative
CrowdStrike unveiled a new Chinese-aligned hacking group allegedly spying on telecom providers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-apt-targets-telecoms-bri/
-
DONOT APT Group Targets Pakistan’s Maritime and Defense Sectors in New Campaign
A recent report from Cyble Research and Intelligence Labs (CRIL) has exposed a new campaign orchestrated by the Advanced Persistent Threat (APT) group DONOT, also known as APT-C-35. This campaign... First seen on securityonline.info Jump to article: securityonline.info/donot-apt-group-targets-pakistans-maritime-and-defense-sectors-in-new-campaign/
-
18th November Threat Intelligence Report
The FBI and CISA issued a joint statement detailing a major Chinese cyber-espionage campaign targeting U.S. telecommunications infrastructure, led by the APT group Salt Typhoon. This operation compromised networks to steal call […] First seen on research.checkpoint.com Jump to article: research.checkpoint.com/2024/18th-november-threat-intelligence-report/
-
Zero-Day Vulnerability in FortiClient Exploited by BrazenBamboo APT
Cybersecurity firm Volexity has uncovered a zero-day vulnerability in Fortinet’s Windows VPN client, FortiClient, being exploited by the BrazenBamboo Advanced Persistent Threat (APT) group. This vulnerability, detailed in Volexity’s latest... First seen on securityonline.info Jump to article: securityonline.info/zero-day-vulnerability-in-forticlient-exploited-by-brazenbamboo-apt/
-
LightSpy Spyware Operation Expands to Windows
The Chinese APT behind the LightSpy iOS backdoor has expanded its toolset with DeepData, a modular Windows-based surveillance framework. The post LightSpy Spyware Operation Expands to Windows appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/lightspy-ios-spyware-operation-expands-to-windows/
-
BSI’s 2024 Cybersecurity Report: How Germany Is Battling Ransomware, APTs, and Election Security Challenges
Germany’s Federal Office for Information Security (BSI) recently published the First seen on thecyberexpress.com Jump to article: thecyberexpress.com/germany-state-of-cybersecurity-2024-report/
-
Volt Typhoon APT Group Resurfaces: A Persistent Threat to Critical Infrastructure
SecurityScorecard’s STRIKE Team uncovers the resurgence of Volt Typhoon, a state-sponsored advanced persistent threat (APT) actor leveraging compromised legacy devices to target critical infrastructure. A new report from SecurityScorecard’s STRIKE... First seen on securityonline.info Jump to article: securityonline.info/volt-typhoon-apt-group-resurfaces-a-persistent-threat-to-critical-infrastructure/
-
Hamas Hackers Spy on Mideast Gov’ts, Disrupt Israel
APT Wirte is doing double duty, adding all manner of supplemental malware to gain access, eavesdrop, and wipe data, depending on the target. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/hamas-hackers-spy-mideast-govts-disrupt-israel
-
APT-Akteure betten Malware in macOS-Flutter-Anwendungen ein
Flutter ist ein App-Entwickler-Kit von Google für einheitliche, plattformübergreifende Anwendungen. Apps, die mit Flutter erstellt wurden, verfügen über ein App-Layout, das den Code weitgehend verschleiert. Zudem erschwert die Komplexität der Flutter-Architektur die Analyse und Erkennung von Malware erhe First seen on infopoint-security.de Jump to article: www.infopoint-security.de/apt-akteure-betten-malware-in-macos-flutter-anwendungen-ein/a38950/
-
RustyAttr Trojan: Lazarus Group’s New macOS Malware Evades Antivirus with Ease
Researchers at Group-IB have discovered a new stealth technique employed by the North Korean APT group Lazarus, targeting macOS systems through a unique code-smuggling method. Known for its sophisticated cyber-espionage... First seen on securityonline.info Jump to article: securityonline.info/rustyattr-trojan-lazarus-groups-new-macos-malware-evades-antivirus-with-ease/
-
China’s Volt Typhoon botnet has re-emerged
China’s Volt Typhoon botnet has re-emerged, using the same core infrastructure and techniques, according to SecurityScorecard researchers. The China-linked Volt Typhoon’s botnet has resurfaced using the same infrastructure and techniques, per SecurityScorecard researchers. In May 2023, Microsoft reported that the Volt Typhoon APT infiltrated critical infrastructure organizations in the U.S. and Guam without being detected. The group…
-
Lazarus Group Uses Extended Attributes for Code Smuggling in macOS
Lazarus APT has been found smuggling malware onto macOS devices using custom extended attributes, evading detection First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/lazarus-extended-attributes-macos/
-
Iranian APT Group Targets IP Cameras, Extends Attacks Beyond Israel
The Iran-linked group Emennet Pasargad aims to undermine public confidence in Israeli and Western nations by using hack-and-leak campaigns and disrupt… First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/iranian-group-targets-ip-cameras-extends-attacks-beyond-israel