cyber threats

S4x23 Review Part 1: What’s New in OT Security

Posted on March 3, 2023March 3, 2023 by Admin

In this blog, I will introduce discussions from S4 over several posts. The first installment will cover two topics from the academic interviews. Interview with Michael Fischerkeller – Author of Cyber Persistence Theory Fischerkeller is a senior researcher in the Institute for Defense Analyses and has been involved in shaping US government security policy for over 25 years. Based on this experience, he published “Cyber Persistence Theory” with two co-authors, aiming to bridge the gap…

Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting

Posted on March 1, 2023March 1, 2023 by Admin

The persistence is ensured by copying a script similarly named as the current filename to the /usr/lib/systemd/system/ directory, and creating a symlink to this file in the /etc/ystem/system/multi-user.target.wants/ directory. Thus, this method only works if the current process has root privileges. The content of the script is: [Unit]Description=xxx[Service]Type=forkingExecStart=<path to current file> -xExecStop=/usr/bin/id[Install]WantedBy=multi-user.target After running the code dependent on the parameters, if the operator has not chosen a GUID with the “-f” parameter, the malware generates…

A Deep Dive into the Evolution of Ransomware Part 2

Posted on February 23, 2023February 23, 2023 by Admin

Ransomware has become an increasingly damaging presence, wreaking havoc on organizations of all sizes and across industries. Without understanding the traditions that underpin these malicious strategies, combatting them can feel like a daunting task. In part one, we explore ransomware’s evolution to gain perspective on how cybercriminals adapt their tactics in response to changing threats. This entry looks into factors that trigger changes in cyber criminals’ business models. Triggers for a paradigm shift Cybercriminals are…

In Review: What GPT-3 Taught ChatGPT in a Year

Posted on February 21, 2023February 21, 2023 by Admin

ChatGPT spotted and called the error, recognizing not only the difference between the previous and latest uploaded code but also that the new code would not work altogether. The reason is in ChatGPT’s stateful session: By “remembering” the previously input correct snippet of code, the system is able to draw a direct comparison — something that GPT-3 was unable to do unless we provided the input ourselves. As further proof, we retried the experiment in…

A Deep Dive into the Evolution of Ransomware Part 1

Posted on February 21, 2023February 21, 2023 by Admin

A Deep Dive into the Evolution of Ransomware Part 1 Ransomware This 3-part blog series takes an in-depth look at the evolution of ransomware business models, from the early stages to current trends. By: Trend Micro February 21, 2023 Read time: ( words) Ransomware has become a notorious and damaging form of malware, inflicting financial losses on enterprises, governments, healthcare organizations and core infrastructure. Ransomware has been a very profitable activity for malicious actors. However,…

Invitation to a Secret Event: Uncovering Earth Yako’s Campaigns

Posted on February 16, 2023February 16, 2023 by Admin

Technical perspectives Based on the arsenals and TTPs, we believe Earth Yako may be related to a number of existing groups. However, since we could only observe partial technical overlaps between Earth Yako and the following groups, we note that this is not our final attribution. We found the overlaps similar with the following groups: 1. Darkhotel Darkhotel (a.k.a. DUBNIUM) is a threat actor observed to frequently target Japanese organizations in the past. Earth Yako’s…

TgToxic Malware’s Automated Framework Targets Southeast Asia Android Users

Posted on February 3, 2023February 3, 2023 by Admin

Conclusion Despite having different deployment periods, we found the social media phishing campaigns and network infrastructure targeting Taiwan, Indonesia, and Thailand similar. When the victim downloads the fake app from the website given by the threat actor, or if victim tries to send a direct message to the threat actor through messaging apps such as WhatsApp or Viber, the cybercriminal deceives the user into registering, installing the malware, and enabling the permissions it needs. Once…

« 1 … 3 4 5 6 7 … 18 »

S4x23 Review Part 1: What’s New in OT Security

Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting

A Deep Dive into the Evolution of Ransomware Part 2

In Review: What GPT-3 Taught ChatGPT in a Year

A Deep Dive into the Evolution of Ransomware Part 1

Invitation to a Secret Event: Uncovering Earth Yako’s Campaigns

TgToxic Malware’s Automated Framework Targets Southeast Asia Android Users

VMWARE

Helping Public Sector Organisations Define Cloud Strategy

How to change the VLAN ID of the Service Console in ESX from the command line/console

Cisco UCS and Vmware Interfaces (Vnics) HA Design Considerations

Troubleshooting network and TCP/UDP port connectivity issues on ESX/ESXi(2020669)

vSphere Client Parameters

Configuration Templates

CUE Licenses

Trouble shooting Unity Express with Call Manager Integeration & Operational Issues

CME Configuration Example: SIP Trunks to Viatalk and VoIP.ms

SIP Phone registration – CME Configuration

CUE Voicemail + VPIM networking (CUE to unity)