Tag: detection
-
Ransomware-Banden geben Opfern immer weniger Zeit
Tags: cyberattack, data, detection, endpoint, extortion, governance, government, malware, ransomware, tool, vulnerability, zero-dayRansomware-Gruppen haben den Zeitraum bis zur Lösegeldübergabe immer mehr verkürzt. Laut einer Analyse des Managed-Detection-and-Response-Unternehmens Huntress von Ransomware-Vorfällen im vergangenen Jahr beträgt die durchschnittliche Zeit bis zur Lösegeldforderung (TTR) etwa 17 Stunden. Bei einigen Gruppen sind es sogar nur vier bis sechs Stunden. Dieses Tempo steht in krassem Gegensatz zu der Vorgehensweise großer Ransomware-Gruppen vor…
-
KI-Beratungstool führt Sicherheitsexperten durch jede Phase einer Bedrohungsuntersuchung
Sophos hat ein neues, auf künstlicher Intelligenz basiertes Beratungstool eingeführt. Der ‘Sophos AI Assistant” führt Sicherheitsexperten aller Qualifikationsstufen durch jede Phase einer Bedrohungsuntersuchung und maximiert die Effizienz sowie Geschwindigkeit bei der Identifikation und Neutralisierung von Angriffen. Der Sophos-AI-Assistant ist Teil der Sophos-XDR-Plattform (Extended-Detection and Response), die bereits seit 2024 generative KI-Funktionen beinhaltet. Das neue Tool…
-
XCSSET macOS malware reappears with new attack strategies, Microsoft sounds alarm
Xcode developers targeted through infected projects: Microsoft reported that XCSSET continues to spread via compromised Xcode projects, a technique that has been in use since the malware’s discovery in 2020. Once an infected project is cloned or downloaded, the malware can embed itself within the developer’s system and further propagate when the infected code is…
-
Earth Preta APT Exploit Microsoft Utility Tool Bypass AV Detection to Control Windows
Researchers from Trend Micro’s Threat Hunting team have uncovered a sophisticated cyberattack campaign by the advanced persistent threat (APT) group Earth Preta, also known as Mustang Panda. The group has been leveraging new techniques to infiltrate systems and evade detection, primarily targeting government entities in the Asia-Pacific region, including Taiwan, Vietnam, Malaysia, and Thailand. Earth…
-
Earth Preta APT Group Evades Detection with Legitimate and Malicious Components
Researchers from Trend Micro’s Threat Hunting team have discovered a new campaign by the advanced persistent threat (APT) First seen on securityonline.info Jump to article: securityonline.info/earth-preta-apt-group-evades-detection-with-legitimate-and-malicious-components/
-
Privacy Roundup: Week 7 of Year 2025
Tags: access, antivirus, api, apple, attack, breach, business, cctv, cve, cybersecurity, data, data-breach, detection, email, exploit, firmware, flaw, google, group, law, leak, malware, microsoft, military, network, password, phishing, privacy, router, scam, service, software, technology, threat, tool, update, virus, vpn, vulnerability, windows, zero-dayThis is a news item roundup of privacy or privacy-related news items for 9 FEB 2025 – 15 FEB 2025. Information and summaries provided here are as-is for warranty purposes. Note: You may see some traditional “security” content mixed-in here due to the close relationship between online privacy and cybersecurity – many things may overlap;…
-
Agentic-AI hilft SOC-Teams, sich auf kritische Bedrohungen zu konzentrieren und schneller zu reagieren
Crowdstrike gab die allgemeine Verfügbarkeit von Charlotte-AI-Detection-Triage bekannt, einer bahnbrechenden Lösung auf dem Gebiet der Agentic-AI-basierten Cybersicherheit. Unter Verwendung einer vom Kunden definierten begrenzten Autonomie triagiert Charlotte-AI Sicherheitsmeldungen mit einer Genauigkeit von über 98 % und eliminiert so durchschnittlich mehr als 40 Stunden manueller Arbeit pro Woche, was die Skalierung von SOC-Operationen und die Beschleunigung…
-
Threat Actors Exploiting Modified SharpHide Tool to Conceal Registry Entries
Threat actors are leveraging a modified version of the SharpHide tool to create hidden registry entries, significantly complicating detection and removal efforts. This technique exploits vulnerabilities in Windows registry handling, using null-terminated strings to obscure malicious entries. The modified SharpHide has been integrated into sophisticated attack chains, enabling malware persistence while evading standard detection mechanisms.…
-
Telegram Used as C2 Channel for New Golang Malware
A Golang backdoor is using Telegram as its command and control (C2) channel, an approach that makes detection harder for defenders, according to Netskope researchers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/telegram-c2-channel-golang-malware/
-
From Tools to Intelligence: The Evolution of SOCaaS
In the early days of cybersecurity, security teams faced a fragmented reality”, juggling multiple tools that operated in isolation. Managed Detection and Response (MDR) solutions watched for threats, while Endpoint Detection and Response (EDR) platforms monitored endpoints. However, these tools often spoke different languages, creating data silos and leaving security teams scrambling to connect the…
-
The Benefits of the M&A Frenzy in Fraud Solutions
Emerging Vendors, Consolidation Drive Innovation in Fraud, AML, Scam Prevention. As cybercriminals exploit AI-generated deepfake scams and synthetic identity fraud, financial institutions are investing heavily in fraud detection, anti-money laundering solutions and identity verification to stay ahead. This demand is driving consolidation in the market. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/benefits-ma-frenzy-in-fraud-solutions-a-27533
-
Ransomware Detection: Attack Types Latest Techniques in 2025
Ransomware continues to be a formidable threat in the cybersecurity landscape, evolving in complexity and sophistication. It is a type of malicious software that encrypts a victim’s files or restricts access to their system, demanding payment for decryption or restoration. These attacks can lead to significant financial losses, operational disruptions, and reputational damage. As we…
-
Fake BSOD Attack Launched via Malicious Python Script
A peculiar malicious Python script has surfaced, employing an unusual and amusing anti-analysis trick to mimic a fake Blue Screen of Death (BSOD). The script, which has a low detection rate of 4/59 on VirusTotal (SHA256: d716c2edbcdb76c6a6d31b21f154fee7e0f8613617078b69da69c8f4867c9534), drew the attention of security researchers for its creative use of Python’s Tkinter library. The Execution and Impact…
-
What is anomaly detection? Behavior-based analysis for cyber threats
a priori the bad thing that you’re looking for,” Bruce Potter, CEO and founder of Turngate, tells CSO. “It’ll just show up because it doesn’t look like anything else or doesn’t look like it’s supposed to. People have been tilting at that windmill for a long time, since the 1980s, trying to figure out what…
-
Cybercriminals Exploit Pyramid Pentesting Tool for Covert C2 Communications
Cybersecurity analysts have identified that hackers are leveraging the open-source Pyramid pentesting tool to establish stealthy command-and-control (C2) communications. Originally designed as a post-exploitation framework for penetration testers, Pyramid has become an attractive option for malicious actors due to its ability to evade detection by endpoint security tools. The tool, first released on GitHub in…
-
Ransomware gangs shifting tactics to evade enterprise defenses
Threat actors adapted to improved threat detection, law enforcement actions, new Huntress research finds. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-gangs–tactics-/739937/
-
The Current AI Revolution Will (Finally) Transform Your SOC
Artificial intelligence (AI) is profoundly transforming cybersecurity, reimagining detection through remediation. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/02/the-current-ai-revolution-will-finally-transform-your-soc/
-
Getting the Most Value out of the OSCP: Pre-Course Prep
Tags: access, antivirus, attack, compliance, control, credentials, cyber, cybersecurity, detection, exploit, finance, framework, guide, hacker, hacking, infosec, infrastructure, jobs, kali, linux, mandiant, metric, microsoft, mitre, network, organized, password, penetration-testing, PurpleTeam, RedTeam, risk, service, skills, software, tactics, technology, tool, training, vulnerability, windowsThe first post in a five-part practical guide series on maximizing the professional, educational, and financial value of the OffSec certification pursuit for a successful career in offensive cybersecurity consulting Disclaimer: All opinions expressed in this article are solely my own. I have reviewed the content to ensure compliance with OffSec’s copyright policies and agreements.…
-
Enhancing Threat Detection With Improved Metadata MITRE ATTCK tags
The cybersecurity landscape continues to evolve rapidly, demanding more sophisticated tools and methodologies to combat emerging threats. In response, Proofpoint’s Emerging Threats (ET) team has implemented significant updates to its ruleset, enhancing metadata coverage and integrating MITRE ATT&CK tags. These advancements aim to provide security teams with actionable intelligence and improved context for detecting and…
-
Logpoint und Netheimur verstärken den Unternehmensschutz in Island
Logpoint hat auch sein Produktportfolio erweitert und vor kurzem das dänische Network Detection and Response (NDR)-Unternehmen Muninn übernommen, um Unternehmen dabei zu helfen, ihre Sicherheitsleistung durch verbesserte Cybersecurity-Transparenz zu verbessern. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/logpoint-und-netheimur-verstaerken-den-unternehmensschutz-in-island/a39784/
-
Security Detection Tech Failing, Say Cyber Leaders in Regulated Industries
A new Everfox survey shows a growing consensus among regulated organizations in favor of a strategic shift away from detecting cyber threats to preventing them First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/security-detection-tech-failing/
-
SystemBC RAT Now Targets Linux, Spreading Ransomware and Infostealers
SystemBC RAT now targets Linux, enabling ransomware gangs like Ryuk Conti to spread, evade detection, and maintain encrypted C2 traffic for stealthy cyberattacks. First seen on hackread.com Jump to article: hackread.com/systembc-rat-targets-linux-ransomware-infostealers/
-
EARLYCROW: Detecting APT Malware Command and Control Activities Over HTTPS
Tags: apt, communications, control, cyber, cyberattack, detection, malware, network, tactics, threatAdvanced Persistent Threats (APTs) represent a sophisticated and stealthy category of cyberattacks targeting critical organizations globally. Unlike common malware, APTs employ evasive tactics, techniques, and procedures (TTPs) to remain undetected for extended periods. Their command-and-control (C&C) communications often mimic legitimate web traffic, making detection particularly challenging for traditional Network Intrusion Detection Systems (NIDS). To address…
-
Top 5 ways attackers use generative AI to exploit your systems
Tags: access, ai, attack, authentication, awareness, banking, captcha, chatgpt, china, control, cyber, cybercrime, cybersecurity, defense, detection, exploit, extortion, finance, flaw, fraud, group, hacker, intelligence, LLM, malicious, malware, network, phishing, ransomware, resilience, service, spam, tactics, theft, threat, tool, vulnerability, zero-dayFacilitating malware development: Artificial intelligence can also be used to generate more sophisticated or at least less labour-intensive malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s…