Tag: apt
-
North Korea-linked APT Gleaming Pisces deliver new PondRAT backdoor via malicious Python packages
North Korea-linked APT group Gleaming Pisces is distributing a new malware called PondRAT through tainted Python packages. Unit 42 researchers uncover… First seen on securityaffairs.com Jump to article: securityaffairs.com/168781/apt/gleaming-pisces-malicious-python-packages.html
-
New EAGLEDOOR backdoor spread in suspected Chinese APT attacks against Asia-Pacific
First seen on scmagazine.com Jump to article: www.scmagazine.com/brief/new-eagledoor-backdoor-spread-in-suspected-chinese-apt-attacks-against-asia-pacific
-
Chinese APT Earth Baxia target APAC by exploiting GeoServer flaw
Suspected China-linked APT Earth Baxia targeted a government organization in Taiwan by exploiting a recently patched OSGeo GeoServer GeoTools flaw. Tr… First seen on securityaffairs.com Jump to article: securityaffairs.com/168767/apt/earth-baxia-apt-targets-apac-geotools-flaw.html
-
Iranian APT Operating as Initial Access Provider to Networks in the Middle East
Iranian state-sponsored threat actor UNC1860 is operating as an initial access provider to high-profile networks in the Middle East. The post Iranian … First seen on securityweek.com Jump to article: www.securityweek.com/iranian-apt-operating-as-initial-access-provider-to-networks-in-the-middle-east/
-
Iranian-Linked Group Facilitates APT Attacks on Middle East Networks
The threat group UNC1860, linked to Iran’s security intelligence agency, gains initial access into networks around the region and hands that access of… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/09/iranian-linked-group-facilitates-apt-attacks-on-middle-east-networks/
-
UNC1860 provides Iran-linked APTs with access to Middle Eastern networks
Iran-linked APT group UNC1860 is operating as an initial access facilitator that provides remote access to Middle Eastern Networks. Mandiant researche… First seen on securityaffairs.com Jump to article: securityaffairs.com/168656/apt/unc1860-provides-iran-linked-apts-access-middle-east.html
-
Experts warn of China-linked APT’s Raptor Train IoT Botnet
Researchers warn of a new IoT botnet called Raptor Train that already compromised over 200,000 devices worldwide. Cybersecurity researchers from Lumen… First seen on securityaffairs.com Jump to article: securityaffairs.com/168563/malware/raptor-train-botnet-iot.html
-
US Disrupts ‘Raptor Train’ Botnet of Chinese APT Flax Typhoon
The US government has announced the disruption of Raptor Train, a Flax Typhoon botnet powered by hacked consumer devices. The post US Disrupts ‘Raptor… First seen on securityweek.com Jump to article: www.securityweek.com/us-disrupts-raptor-train-botnet-of-chinese-apt-flax-typhoon/
-
Understanding ToddyCat APT
Tags: aptFirst seen on thefinalhop.com Jump to article: www.thefinalhop.com/understanding-toddycat-apt/
-
Microsoft confirms second 0-day exploited by Void Banshee APT (CVE-2024-43461)
CVE-2024-43461, a spoofing vulnerability affecting Windows MSHTML a software component used by various apps for rendering render web pages on Windows … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/09/16/cve-2024-43461-exploited/
-
Notorious Iranian Hackers Have Been Targeting the Space Industry With a New Backdoor
In addition to its longstanding password spraying attacks, Microsoft says Iran-backed hacker group Peach Sandstorm, or APT 33, has developed custom ma… First seen on wired.com Jump to article: www.wired.com/story/iran-peach-sandworm-tickler-backdoor/
-
Chinese Tag Team APTs Keep Stealing Asian Gov’t Secrets
A PRC threat cluster known as Crimson Palace is demonstrating the benefits of having specialized units carry out distinct stages of a wider attack cha… First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/chinese-tag-team-apts-keep-stealing-asian-govt-secrets
-
Chinese APT Groups Continue to Leverage Open-Source and Custom Reconnaissance Tools in Cyber Espionage Campaigns
The Natto Thoughts team recently uncovered key insights into the reconnaissance techniques used by Chinese state-sponsored threat actors. A deep dive … First seen on securityonline.info Jump to article: securityonline.info/chinese-apt-groups-continue-to-leverage-open-source-and-custom-reconnaissance-tools-in-cyber-espionage-campaigns/
-
Novel payloads deployed in new OilRig APT campaign against Iraq
First seen on scmagazine.com Jump to article: www.scmagazine.com/brief/novel-payloads-deployed-in-new-oilrig-apt-campaign-against-iraq
-
Chinese APT Stately Taurus Exploits Visual Studio Code in Cyberespionage Attacks
In a recent report, cybersecurity researchers at Unit 42 have uncovered a novel and concerning tactic employed by the Chinese advanced persistent thre… First seen on securityonline.info Jump to article: securityonline.info/chinese-apt-stately-taurus-exploits-visual-studio-code-in-cyberespionage-attacks/
-
Chinese ‘Tropic Trooper’ APT Targets Mideast Governments
In the past, the group has targeted different sectors in East and Southeast Asia, but recently has pivoted its focus to the Middle East, specifically … First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/chinese-tropic-trooper-apt-targets-mideast-governments
-
BlindEagle APT Targets Colombian Insurance with BlotchyQuasar RAT
Cybersecurity researchers at Zscaler ThreatLabz have uncovered a new wave of attacks by the BlindEagle APT group, this time zeroing in on the Colombia… First seen on securityonline.info Jump to article: securityonline.info/blindeagle-apt-targets-colombian-insurance-with-blotchyquasar-rat/
-
Taiwanese drone makers subjected to TIDRONE APT intrusions
Tags: aptFirst seen on scmagazine.com Jump to article: www.scmagazine.com/brief/taiwanese-drone-makers-subjected-to-tidrone-apt-intrusions
-
North Korea’s ‘Citrine Sleet’ APT Exploits Zero-Day Chromium Bug
Microsoft warned that the DPRK’s latest innovative tack chains together previously unknown browser issues, then adds a rootkit to the mix to gain deep… First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/north-korean-apt-exploits-novel-chromium-windows-bugs-steal-crypto
-
Chinese APT Exploits Versa Networks Zero-Day Flaw
The vulnerability impacts versions of Versa Director prior to 22.1.4, and Versa Networks recommends that impacted users update to the fixed version as… First seen on duo.com Jump to article: duo.com/decipher/chinese-apt-exploits-versa-networks-zero-day-flaw
-
TIDRONE APT targets drone manufacturers in Taiwan
A previously undocumented threat actor tracked TIDRONE targets organizations in military and satellite industries in Taiwan. Trend Micro spotted an al… First seen on securityaffairs.com Jump to article: securityaffairs.com/168210/apt/tidrone-targets-organizations-taiwan.html
-
Commercial Spyware Vendors Have a Copycat in Top Russian APT
First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/commercial-spyware-vendors-copycat-russian-apt
-
Tropic Trooper Attacks Government Organizations to Steal Sensitive Data
Tropic Trooper (aka KeyBoy, Pirate Panda, and APT23) is a sophisticated cyberespionage APT group, and it has been active since 2011. This APT group pr… First seen on gbhackers.com Jump to article: gbhackers.com/tropic-trooper-attack-steal-sensitive-data/
-
Chinese cyber attack sparks alert over six-year-old MS vuln
After a proof-of-concept for a six-year-old Microsoft vulnerability emerged in a Chinese APT attack chain, defenders should be on the look-out for exp… First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366599914/Chinese-cyber-attack-sparks-alert-over-six-year-old-MS-vuln
-
South Korean APT Exploits 1-Click WPS Office Bug, Nabs Chinese Intel
The most popular office software suite in China actually has two critical vulnerabilities, which allowed hackers the opportunity for remote code execu… First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/south-korean-apt-exploits-1-click-wps-office-bug-nabs-chinese-intel
-
Gamaredon APT Launches Spear-Phishing Campaign Targeting Ukrainian Military
A sophisticated spear-phishing campaign orchestrated by the Gamaredon APT group has emerged as a threat to Ukrainian military personnel. Cyble Researc… First seen on thecyberexpress.com Jump to article: thecyberexpress.com/gamaredon-campaign/
-
Researchers Unpacked AvNeutralizer EDR Killer Used By FIN7 Group
FIN7 (aka Carbon Spider, ELBRUS, Sangria Tempest) is a Russian APT group that is primarily known for targeting the U.S. retail, restaurant, and hospit… First seen on gbhackers.com Jump to article: gbhackers.com/avneutralizer-edr-killer-unpacked/
-
APT60 Group Exploit WPS Office Flaw to Deploy SpyGlace Backdoor
A South Korea-aligned cyber espionage has been linked to the zero-day exploitation of a now-patched critical remote code execution flaw in Kingsoft WP… First seen on thehackernews.com Jump to article: thehackernews.com/2024/08/apt-c-60-group-exploit-wps-office-flaw.html
-
Chinese APT sets sights on Middle East government orgs
First seen on scmagazine.com Jump to article: www.scmagazine.com/brief/chinese-apt-sets-sights-on-middle-east-government-orgs
-
Researcher Identifies ToddyCat-Inspired APT Attack Leveraging ICMP Backdoor and Microsoft Exchange Flaws
Cybersecurity researchers at Kaspersky’s Global Emergency Response Team (GERT) have uncovered a sophisticated attack involving an ICMP backdoor, beari… First seen on securityonline.info Jump to article: securityonline.info/researcher-identifies-toddycat-inspired-apt-attack-leveraging-icmp-backdoor-and-microsoft-exchange-flaws/