cyber threats

Attacking The Supply Chain: Developer

Posted on by Admin
Attacking The Supply Chain: Developer

In 2021, we published an entry identifying the weak parts of the supply chain security. In the face of the surge in documented attacks, the entry gave a summarized overview of how malicious actors found gaps to abuse and take advantage of for possible gains and disruptions. In this entry, we focus on one specific part of the supply chain: the developers themselves. To find a suitable attack model focusing on the developer, we must…

Read More

“Payzero” Scams and The Evolution of Asset Theft in Web3

Posted on by Admin
“Payzero” Scams and The Evolution of Asset Theft in Web3

“Payzero” Scams and The Evolution of Asset Theft in Web3 Cyber Threats In this entry, we discuss a Web3 fraud scenario where scammers target potential victims via fake smart contracts, and then take over their digital assets, such as NFT tokens, without paying. We named this scam “Payzero”. By: Fyodor Yarochkin, Vladimir Kropotov, Jay Liao January 18, 2023 Read time:  ( words) Web3 is a lucrative emerging technology where many participants seek quick profit via…

Read More

Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures

Posted on by Admin
Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures

Earth Bogle: Campaigns Target the Middle East with Geopolitical Lures Malware We discovered an active campaign ongoing since at least mid-2022 which uses Middle Eastern geopolitical-themed lures to distribute NjRAT (also known as Bladabindi) to infect victims across the Middle East and North Africa. By: Peter Girnus, Aliakbar Zahravi January 17, 2023 Read time:  ( words) While threat hunting, we found an active campaign using Middle Eastern geopolitical themes as a lure to target potential…

Read More

Abusing a GitHub Codespaces Feature For Malware Delivery

Posted on by Admin
Abusing a GitHub Codespaces Feature For Malware Delivery

GitHub Codespaces, initially in preview for specific users, became widely available for free in November 2022. This cloud-based integrated development environment (IDE) allows developers and organizations to customize projects via configuring dev container files, easing some previous pain points in project development. We investigated the services offered by this cloud IDE and found that one of its features for code development and collaboration – sharing forwarded ports publicly – can be abused by malicious actors…

Read More

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

Posted on by Admin
IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware Malware We analyze the latest changes in IcedID botnet from a campaign that abuses Google pay per click (PPC) ads to distribute IcedID via malvertising attacks. By: Ian Kenefick December 23, 2022 Read time:  ( words) After closely tracking the activities of the IcedID botnet, we have discovered some significant changes in its distribution methods. Since December 2022, we observed the abuse of Google pay per…

Read More

Detecting Windows AMSI Bypass Techniques

Posted on by Admin
Detecting Windows AMSI Bypass Techniques

Techniques bypassing AMSI were primarily used by security researchers and penetration testers. In recent years, however, cybercriminals have abused this and included the method as a feature in malware routines to evade detection that allowed them to continuously operate in a victim’s computer. Prior to AMSI, detections of fileless threats proved difficult. Previously documented methods used to achieve an AMSI bypass were: Obfuscation and/or encryption PowerShell downgrade Hooks and unhooks Memory patching Forcing an error…

Read More

Web3 IPFS Only Used for Phishing – So Far

Posted on by Admin
Web3 IPFS Only Used for Phishing – So Far

Web3 IPFS Only Used for Phishing – So Far Cloud We discuss the use of the InterPlanetary File System (IPFS) in phishing attacks. By: Matsukawa Bakuei, Morton Swimmer December 20, 2022 Read time:  ( words) Web3 has been garnering attention recently, but it has yet to be used for anything practical and widespread except for one thing: phishing. The concept of Web 3 encompasses a variety of technologies. In this article, we will ignore the…

Read More

A Closer Look at Windows Kernel Threats

Posted on by Admin
A Closer Look at Windows Kernel Threats

Windows kernel threats have long been favored by malicious actors because it can allow them to obtain high-privileged access and detection evasion capabilities. These hard-to-banish threats are still crucial components in malicious campaigns’ kill chains to this day. In fact, SentinelOne recently discovered malicious actors abusing Microsoft-signed drivers in targeted attacks against organizations in the telecommunication, business process outsourcing (BPO), managed security service provider (MSSP), and financial services industries. This month, SophosLabs also reported their…

Read More

Trend Helps Google Play Prevent Malicious Apps via ADA

Posted on by Admin
Trend Helps Google Play Prevent Malicious Apps via ADA

Trend Helps Google Play Prevent Malicious Apps via ADA Trend Micro will be joining Google’s App Defense Alliance (ADA) to help improve their ability to identify malicious apps before they are published to the Google Play store. By: Jon Clay December 16, 2022 Read time:  ( words) Google has announced Trend Micro will be joining their App Defense Alliance (ADA) to help improve their ability to identify malicious apps before they are published to the…

Read More

Ransomware Business Models: Future Pivots and Trends

Posted on by Admin
Ransomware Business Models: Future Pivots and Trends

RDP port 3389 remains a popular service abused by ransomware actors to gain initial access to systems located and connected to on-premise infrastructure. However, as more organizations shift to the cloud services for file storage and active directory systems, ransomware groups will look for more opportunities to develop and/or exploit vulnerabilities not yet leveraged at scale. Evolutions Gradual evolutions in the current modern ransomware models as we know them are expected to be tweaked in…

Read More
1 … 4 5 6 7 8 … 18