cyber crime

Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Posted on by Admin
Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Introduction In 2022, we discovered a hacking group that has been targeting telecom, technology, and media sectors in Southeast Asia since 2020. We track this particular group as Earth Zhulong. We believe that Earth Zhulong is likely related to the Chinese-linked hacking group 1937CN based on similar code in the custom shellcode loader and victimology. In this post, we’ll introduce Earth Zhulong’s new tactics, techniques, and procedures (TTPs) in the recent campaign and the evolution…

Read More

TgToxic Malware’s Automated Framework Targets Southeast Asia Android Users

Posted on by Admin
TgToxic Malware’s Automated Framework Targets Southeast Asia Android Users

Conclusion Despite having different deployment periods, we found the social media phishing campaigns and network infrastructure targeting Taiwan, Indonesia, and Thailand similar. When the victim downloads the fake app from the website given by the threat actor, or if victim tries to send a direct message to the threat actor through messaging apps such as WhatsApp or Viber, the cybercriminal deceives the user into registering, installing the malware, and enabling the permissions it needs. Once…

Read More

What SOCs Need to Know About Water Dybbuk

Posted on by Admin
What SOCs Need to Know About Water Dybbuk

What SOCs Need to Know About Water Dybbuk Cyber Crime We analyze a BEC campaign targeting large companies around the world that was leveraging open-source tools to stay under the radar. By: Stephen Hilt, Lord Alfred Remorin February 02, 2023 Read time:  ( words) BEC or Business Email Compromise is a significant problem for businesses around the world. According to the Federal Bureau of Investigation (FBI), BEC costs victims more money than ransomware, with an…

Read More

New APT34 Malware Targets The Middle East

Posted on by Admin
New APT34 Malware Targets The Middle East

APT34 Targeting and Arsenal Evolution APT34 has been documented to target organizations worldwide, particularly companies from the financial, government, energy, chemical, and telecommunications industries in the Middle East since at least 2014. Documented as a group primarily involved for cyberespionage, APT34 has been previously recorded targeting government offices and show no signs of stopping with their intrusions. Our continuous monitoring of the group proves it continues to create new and updated tools to minimize the detection…

Read More

Attacking The Supply Chain: Developer

Posted on by Admin
Attacking The Supply Chain: Developer

In 2021, we published an entry identifying the weak parts of the supply chain security. In the face of the surge in documented attacks, the entry gave a summarized overview of how malicious actors found gaps to abuse and take advantage of for possible gains and disruptions. In this entry, we focus on one specific part of the supply chain: the developers themselves. To find a suitable attack model focusing on the developer, we must…

Read More

“Payzero” Scams and The Evolution of Asset Theft in Web3

Posted on by Admin
“Payzero” Scams and The Evolution of Asset Theft in Web3

“Payzero” Scams and The Evolution of Asset Theft in Web3 Cyber Threats In this entry, we discuss a Web3 fraud scenario where scammers target potential victims via fake smart contracts, and then take over their digital assets, such as NFT tokens, without paying. We named this scam “Payzero”. By: Fyodor Yarochkin, Vladimir Kropotov, Jay Liao January 18, 2023 Read time:  ( words) Web3 is a lucrative emerging technology where many participants seek quick profit via…

Read More

Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures

Posted on by Admin
Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures

Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures Malware We discovered an active campaign ongoing since at least mid-2022 which uses Middle Eastern geopolitical-themed lures to distribute NjRAT (also known as Bladabindi) to infect victims across the Middle East and North Africa. By: Peter Girnus, Aliakbar Zahravi January 17, 2023 Read time:  ( words) While threat hunting, we found an active campaign using Middle Eastern geopolitical themes as a lure to target potential…

Read More

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

Posted on by Admin
IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware Malware We analyze the latest changes in IcedID botnet from a campaign that abuses Google pay per click (PPC) ads to distribute IcedID via malvertising attacks. By: Ian Kenefick December 23, 2022 Read time:  ( words) After closely tracking the activities of the IcedID botnet, we have discovered some significant changes in its distribution methods. Since December 2022, we observed the abuse of Google pay per…

Read More

Detecting Windows AMSI Bypass Techniques

Posted on by Admin
Detecting Windows AMSI Bypass Techniques

Techniques bypassing AMSI were primarily used by security researchers and penetration testers. In recent years, however, cybercriminals have abused this and included the method as a feature in malware routines to evade detection that allowed them to continuously operate in a victim’s computer. Prior to AMSI, detections of fileless threats proved difficult. Previously documented methods used to achieve an AMSI bypass were: Obfuscation and/or encryption PowerShell downgrade Hooks and unhooks Memory patching Forcing an error…

Read More

Raspberry Robin Malware Targets Telecom, Governments

Posted on by Admin
Raspberry Robin Malware Targets Telecom, Governments

We noted layers 3 and 5 as capable of anti-analysis techniques. Meanwhile, we found that not all layers have unique packers. The fourth and seventh layers are identical, as well as the tenth and thirteenth. The packing of the eighth and fourteenth layers are also similar. This repeated use of packers implies that the group is using a separate packing program. We are continuing with our analysis to see if this program is their own…

Read More
1 2 3 4 … 9