Tag: apt
-
ToddyCat APT Abuses SMB, Exploits IKEEXT A Exchange RCE To Deploy ICMP Backdoor
ToddyCat is an APT group that has been active since December 2020, and primarily it targets the government and military entities in Europe and Asia. T… First seen on gbhackers.com Jump to article: gbhackers.com/toddycat-apt-exploits/
-
CVE-2024-7971: North Korean APT Citrine Sleet Exploits Chromium Zero-Day
In a recent cybersecurity report, Microsoft Threat Intelligence has revealed that a North Korean threat actor, believed to be Citrine Sleet, has been … First seen on securityonline.info Jump to article: securityonline.info/cve-2024-7971-north-korean-apt-citrine-sleet-exploits-chromium-zero-day/
-
Czech Officials Targeted in Sophisticated Malware Campaign Disguised as NATO Documents
Seqrite Labs APT-Team has uncovered a sophisticated malware campaign, dubbed >>Operation Oxidový,
-
North Korean APT Exploits Novel Chromium, Windows Bugs to Steal Crypto
First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/north-korean-apt-exploits-novel-chromium-windows-bugs-steal-crypto
-
Week in review: SonicWall critical firewalls flaw fixed, APT exploits WPS Office for Windows RCE
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: SonicWall patches critical flaw affecting its firewa… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/09/01/week-in-review-sonicwall-critical-firewalls-flaw-fixed-apt-exploits-wps-office-for-windows-rce/
-
Microsoft Says North Korean Cryptocurrency Thieves Behind Chrome Zero-Day
Redmond’s threat intel team said exploitation of CVE-2024-7971 can be attributed to a North Korean APT targeting the cryptocurrency sector for financi… First seen on securityweek.com Jump to article: www.securityweek.com/microsoft-says-north-korean-cryptocurrency-thieves-behind-chrome-zero-day/
-
Operation DevilTiger: APT12’s Shadowy Tactics and Zero-Day Exploits Unveiled
The QiAnXin Threat Intelligence Center has disclosed the technical details of a sophisticated cyber espionage campaign dubbed >>Operation DevilTiger,
-
North Korea-linked APT Citrine Sleet exploit Chrome zero-day to deliver FudModule rootkit
North Korea-linked APT exploited the recently patched Google Chrome zero-day CVE-2024-7971 to deploy the FudModule rootkit. North Korea-linked group C… First seen on securityaffairs.com Jump to article: securityaffairs.com/167848/breaking-news/north-korea-linked-apt-exploited-chrome-zero-day-cve-2024-7971.html
-
South Korea-linked group APT-C-60 exploited a WPS Office zero-day
South Korea-linked group APT-C-60 exploited a zero-day in the Windows version of WPS Office to target East Asian countries. South Korea-linked group A… First seen on securityaffairs.com Jump to article: securityaffairs.com/167825/hacking/apt-c-60-wps-office-zero-day.html
-
Operation DevilTiger, APT Hackers 0-Day Exploitation Tactics Exposed
The APT-Q-12 group, also known as Pseudo Hunter, is a Northeast Asian threat actor linked to Darkhotel, which primarily targets East Asian countries, … First seen on gbhackers.com Jump to article: gbhackers.com/deviltiger-apt-zero-day/
-
Google Catches Russian APT Reusing Exploits From Spyware Merchants NSO Group, Intellexa
Google TAG publishes evidence showing identical or striking similarities between exploits used by Russia’s APT29 and commercial spyware vendors. The p… First seen on securityweek.com Jump to article: www.securityweek.com/google-catches-russian-apt-re-using-exploits-from-spyware-merchants-nso-group-intellexa/
-
South Korean hackers exploited WPS Office zero-day to deploy malware
The South Korea-aligned cyberespionage group APT-C-60 has been leveraging a zero-day code execution vulnerability in the Windows version of WPS Office… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apt-c-60-hackers-exploited-wps-office-zero-day-to-deploy-spyglace-malware/
-
APT Gruppe Muddy Water attackiert MSPs
r Einblick in die undurchsichtige Welt der Cyberspionage und anderer wachsender Bedrohungen, mit denen Anbieter von Managed Services – und ihre Kunden… First seen on welivesecurity.com Jump to article: www.welivesecurity.com/deutsch/2023/05/02/apt-gruppe-muddy-water-attackiert-msps/
-
ESET Uncovers Zero-Day Vulnerabilities in WPS Office, Exploited by APT-C-60
ESET researchers have identified two severe vulnerabilities in WPS Office for Windows, widely exploited by the APT-C-60 cyberespionage group, which is… First seen on securityonline.info Jump to article: securityonline.info/eset-uncovers-zero-day-vulnerabilities-in-wps-office-exploited-by-apt-c-60/
-
APT Gruppe Evasive Panda verteilt Malware als Updates beliebter chinesischer Software
arch deckt eine Kampagne der als Evasive Panda bekannten APT-Gruppe auf, die eine internationale NGO in China mit Malware angreift. Diese wird über Up… First seen on welivesecurity.com Jump to article: www.welivesecurity.com/deutsch/2023/04/26/apt-gruppe-evasive-panda-verteilt-malware-als-updates-beliebter-chinesischer-software/
-
APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262)
ESET researchers discovered a remote code execution vulnerability in WPS Office for Windows (CVE-2024-7262). APT-C-60, a South Korea-aligned cyberespi… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
-
US Sees Iranian Hackers Working Closely With Ransomware Groups
Iranian state-sponsored APT Lemon Sandstorm is working closely with ransomware groups on monetizing network intrusions. The post US Sees Iranian Hacke… First seen on securityweek.com Jump to article: www.securityweek.com/us-sees-iranian-hackers-working-closely-with-ransomware-groups/
-
China-linked APT Volt Typhoon exploited a zero-day in Versa Director
China-linked APT group Volt Typhoon exploited a zero-day flaw in Versa Director to upload a custom webshell in target networks. China-linked APT Volt … First seen on securityaffairs.com Jump to article: securityaffairs.com/167658/apt/volt-typhoon-versa-director-zero-day.html
-
US Intelligence Blames Iran for Hack on Trump Campaign
Feds confirmed Iran’s involvement in the email attack against Roger Stone after Microsoft, Google reported Iranian APT action against both presidentia… First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/us-intelligence-blames-ira-for-hack-on-trump-campaign
-
WPS Office Zero-Day Exploited by South Korea-Linked Cyberspies
A WPS Office zero-day vulnerability tracked as CVEâ -â 2024â -â 7262 was exploited by South Korean hacker group APT-C-60. The post WPS Office Zero… First seen on securityweek.com Jump to article: www.securityweek.com/wps-office-zero-day-exploited-by-south-korea-linked-cyberspies/
-
Censys Finds Hundreds of Exposed Servers as Volt Typhoon APT Targets Service Providers
Amidst Volt Typhoon zero-day exploitation, Censys finds hundreds of exposed servers presenting ripe attack surface for attackers. The post Censys Find… First seen on securityweek.com Jump to article: www.securityweek.com/censys-finds-hundreds-of-exposed-servers-as-volt-typhoon-apt-targets-isps-msps/
-
SEXi / APT Inc ransomware what you need to know
First seen on tripwire.com Jump to article: www.tripwire.com/state-of-security/sexi-apt-inc-ransomware-what-you-need-know
-
Iranian APT GreenCharlie Escalates Threats Against US Political Targets Using GORBLE and POWERSTAR Malware
A recent report from Insikt Group has shed light on the covert operations of GreenCharlie, an Iran-backed Advanced Persistent Threat (APT) group, whic… First seen on securityonline.info Jump to article: securityonline.info/iranian-apt-greencharlie-escalates-threats-against-us-political-targets-using-gorble-and-powerstar-malware/
-
North Korean cyber APT targeting nuclear secrets
Mandiant has upgraded the North Korean threat actor known as Andariel to APT status and warned of coordinated efforts to steal western military IP, in… First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366598869/North-Korean-cyber-APT-targeting-nuclear-secrets
-
Censys Finds Hundreds of Exposed Servers as Volt Typhoon APT Targets ISPs, MSPs
Amidst Volt Typhoon zero-day exploitation, Censys finds hundreds of exposed servers presenting ripe attack surface for attackers. The post Censys Find… First seen on securityweek.com Jump to article: www.securityweek.com/censys-finds-hundreds-of-exposed-servers-as-volt-typhoon-apt-targets-isps-msps/
-
China’s Volt Typhoon Hackers Caught Exploiting Zero-Day in Servers Used by ISPs, MSPs
Malware hunters catch Chinese APT Volt Typhoon exploiting a zero-day in Versa Director servers used by ISPs and MSPs. The post China’s Volt Typhoon Ha… First seen on securityweek.com Jump to article: www.securityweek.com/chinese-apt-volt-typhoon-caught-exploiting-versa-networks-sd-wan-zero-day/
-
Russian national arrested in Argentina for laundering money of crooks and Lazarus APT
A Russian national was arrested in Argentina for laundering proceeds from illicit actors, including North Korea-linked Lazarus Group. This week, the A… First seen on securityaffairs.com Jump to article: securityaffairs.com/167485/cyber-crime/russian-national-arrested-laundering-lazarus-funds.html
-
BlindEagle APT Group: A Persistent Threat in Latin America
Kaspersky Labs has issued a warning about BlindEagle, also known as APT-C-36, a persistent threat actor known for its targeted attacks in Latin Americ… First seen on securityonline.info Jump to article: securityonline.info/blindeagle-apt-group-a-persistent-threat-in-latin-america/
-
China-linked APT Velvet Ant exploited zero-day to compromise Cisco switches
China-linked APT group Velvet Ant exploited a recently disclosed zero-day in Cisco switches to take over the network appliance. Researchers at cyberse… First seen on securityaffairs.com Jump to article: securityaffairs.com/167423/apt/china-velvet-ant-zero-day-cisco-switches.html
-
North Korea-linked APT used a new RAT called MoonPeak
North Korea-linked APT Kimsuky is likely behind a new remote access trojan called MoonPeak used in a recent campaign spotted by Cisco Talos. Cisco Tal… First seen on securityaffairs.com Jump to article: securityaffairs.com/167340/malware/north-korea-apt-moonpeaknorth.html