research

Royal ransomware expands attacks by targeting Linux ESXi servers

Posted on by Admin
Royal ransomware expands attacks by targeting Linux ESXi servers

Royal ransomware expands attacks by targeting Linux ESXi servers Ransomware actors have been observed to expand their targets by increasingly developing Linux-based versions. Royal ransomware is following in the same path, a new variant targeting Linux systems emerged and we will provide a technical analysis on this variant in this blog. By: Nathaniel Morales, Ivan Nicole Chavez, Byron Gelera February 20, 2023 Read time:  ( words) Ransomware actors have been observed to expand their targets by…

Read More

Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack

Posted on by Admin
Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack

Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack APT & Targeted Attacks We discovered a new backdoor which we have attributed to the advanced persistent threat actor known as Earth Kitsune, which we have covered before. Since 2019, Earth Kitsune has been distributing variants of self-developed backdoors to targets, primarily individuals who are interested in North Korea. By: Joseph C Chen, Jaromir Horejsi February 17, 2023 Read time:  ( words) We discovered a…

Read More

Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs

Posted on by Admin
Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs

Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs Malware We discovered an active campaign targeting Eastern Europeans in the cryptocurrency industry using fake job lures. By: Aliakbar Zahravi, Peter Girnus February 09, 2023 Read time:  ( words) We recently found an active campaign that uses a fake employment pretext targeting Eastern Europeans in the cryptocurrency industry to install an information stealer. In this campaign, the suspected Russian threat actors, use several highly obfuscated and underdevelopment…

Read More

Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Posted on by Admin
Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Introduction In 2022, we discovered a hacking group that has been targeting telecom, technology, and media sectors in Southeast Asia since 2020. We track this particular group as Earth Zhulong. We believe that Earth Zhulong is likely related to the Chinese-linked hacking group 1937CN based on similar code in the custom shellcode loader and victimology. In this post, we’ll introduce Earth Zhulong’s new tactics, techniques, and procedures (TTPs) in the recent campaign and the evolution…

Read More

Earth Zhulong Familiar Patterns Target Vietnam

Posted on by Admin
Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Introduction In 2022, we discovered a hacking group that has been targeting telecom, technology, and media sectors in Vietnam since 2020. We track this particular group as Earth Zhulong. We believe that Earth Zhulong is likely related to the Chinese-linked hacking group 1937CN based on similar code in the custom shellcode loader and victimology. In this post, we’ll introduce Earth Zhulong’s new tactics, techniques, and procedures (TTPs) in the recent campaign and the evolution of…

Read More

Hijacking Your Bandwidth How Proxyware Apps Open You Up to Risk

Posted on by Admin
Hijacking Your Bandwidth How Proxyware Apps Open You Up to Risk

But is this true? To examine and understand the kind of risks a potential user might be exposed to by joining such programs, we recorded and analyzed network traffic from a large number of exit nodes of several different network bandwidth sharing services (exit nodes are computers who had these network bandwidth sharing services installed).   From January to September 2022, we recorded traffic coming from exit nodes of some of these passive income companies…

Read More

What SOCs Need to Know About Water Dybbuk

Posted on by Admin
What SOCs Need to Know About Water Dybbuk

What SOCs Need to Know About Water Dybbuk Cyber Crime We analyze a BEC campaign targeting large companies around the world that was leveraging open-source tools to stay under the radar. By: Stephen Hilt, Lord Alfred Remorin February 02, 2023 Read time:  ( words) BEC or Business Email Compromise is a significant problem for businesses around the world. According to the Federal Bureau of Investigation (FBI), BEC costs victims more money than ransomware, with an…

Read More

8 companies per day have data uploaded to dedicated leak sites

Posted on by Admin
8 companies per day have data uploaded to dedicated leak sites

8 companies per day have data uploaded to dedicated leak sites | Security Magazine This website requires certain cookies to work and uses other cookies to help you have the best experience. By visiting this website, certain cookies have already been set, which you may delete and block. By closing this message or continuing to use our site, you agree to the use of cookies. Visit our updated privacy and cookie policy to learn more….

Read More

New Mimic Ransomware Abuses Everything APIs for its Encryption Process

Posted on by Admin
New Mimic Ransomware Abuses Everything APIs for its Encryption Process

New Mimic Ransomware Abuses Everything APIs for its Encryption Process Ransomware Trend Micro researchers discovered a new ransomware that abuses the APIs of a legitimate tool called Everything, a Windows filename search engine developed by Voidtools that offers quick searching and real-time updates for minimal resource usage. By: Nathaniel Morales, Earle Maui Earnshaw, Don Ovid Ladores, Nick Dai, Nathaniel Gregory Ragasa January 26, 2023 Read time:  ( words) Trend Micro researchers discovered a new ransomware…

Read More

Vice Society Ransomware Group Targets Manufacturing Companies

Posted on by Admin
Vice Society Ransomware Group Targets Manufacturing Companies

Vice Society Ransomware Group Targets Manufacturing Companies Ransomware In this blog entry, we’d like to highlight our findings on Vice Society, which includes an end-to-end infection diagram that we were able to create using Trend Micro internal telemetry. By: Ieriz Nicolle Gonzalez, Paul Pajares, Arianne Dela Cruz, Warren Sto.Tomas January 24, 2023 Read time:  ( words) The Vice Society ransomware group made headlines in late 2022 and early 2023 during a spate of attacks against several targets, such as the one…

Read More
1 2 3 4 5 6 … 18