- Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors
May 15, 2023
The Lancefly advanced persistent threat (APT) group is using a custom-written backdoor in attacks targeting organizations in South and Southeast Asia, in activity that has been ongoing for several years. Lancefly may have some links to previously known groups, but these are low confidence, which led researchers at Symantec, by Broadcom Software, to classify this activity ...
- CISA and Partners Disclose Snake Malware Threat From Russian Cyber Actors
May 9, 2023
Today, CISA and partners released a joint advisory for a sophisticated cyber espionage tool used by Russian cyber actors. Hunting Russian Intelligence “Snake” Malware provides technical descriptions of the malware’s host architecture and network communications, and mitigations to help detect and defend against this threat. CISA urges organizations to review the advisory for more information and ...
- Ukraine ‘testing ground’ for Australian cyber defences
April 27, 2023
Ukraine’s ambassador says cyber security assistance to help combat Russian aggression would also help boost Australia’s own capabilities. Vasyl Myroshnychenko said he would welcome any further assistance with Ukraine’s defence against Russia, adding it would provide Australia with a good opportunity to stress test its own resources. Read more… Source: MSN News
- Chinese Alloy Taurus Updates PingPull Malware
April 26, 2023
Unit 42 researchers recently identified a new variant of PingPull malware used by Alloy Taurus actors designed to target Linux systems. While following the infrastructure leveraged by the actor for this PingPull variant, we also identified their use of another backdoor we track as Sword2033. The first samples of PingPull malware date back to September 2021. ...
- Tomiris called, they want their Turla malware back
April 24, 2023
Kaspersky introduced Tomiris to the world in September 2021, following their investigation of a DNS-hijack against a government organization in the Commonwealth of Independent States (CIS). Kaspersky researchers initial report described links between a Tomiris Golang implant and SUNSHUTTLE (which has been associated to NOBELIUM/APT29/TheDukes) as well as Kazuar (which has been associated to Turla); ...
- Growth of ‘hackers for hire’ will lead to more attacks and unpredictable threats, UK cyber security agency warns
April 19, 2023
The number of “hackers for hire” is set to grow over the next five years, leading to more cyber attacks and increasingly unpredictable threats, the UK’s cyber security agency has warned. A rise in spyware is also anticipated and other hacking tools, according to a new report by the National Cyber Security Centre (NCSC), which is ...
- Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets
April 18, 2023
Over the past several months, Microsoft has observed a mature subgroup of Mint Sandstorm, an Iranian nation-state actor previously tracked as PHOSPHORUS, refining its tactics, techniques, and procedures (TTPs). Specifically, this subset has rapidly weaponized N-day vulnerabilities in common enterprise applications and conducted highly-targeted phishing campaigns to quickly and successfully access environments of interest. This Mint ...
- State-sponsored campaigns target global network infrastructure
April 18, 2023
Recently, the UK’s National Cyber Security Center (NCSC) released a report on a sustained campaign by a Russian intelligence agency targeting a vulnerability in routers that Cisco had published a patch for in 2017. This campaign, dubbed “Jaguar Tooth,” is an example of a much broader trend of sophisticated adversaries targeting networking infrastructure to advance ...
- Hackers abuse Google Command and Control red team tool in attacks
April 17, 2023
The Chinese state-sponsored hacking group APT41 was found abusing the GC2 (Google Command and Control) red teaming tool in data theft attacks against a Taiwanese media and an Italian job search company. APT 41, also known as HOODOO, is a Chinese state-sponsored hacking group known to target a wide range of industries in the USA, Asia, ...
- Following the Lazarus group by tracking DeathNote campaign
April 12, 2023
The Lazarus group is a high-profile Korean-speaking threat actor with multiple sub-campaigns. Kaspersky researchers have previously published information about the connections of each cluster of this group. In this blog, Kaspersky focus on an active cluster that they dubbed DeathNote because the malware responsible for downloading additional payloads is named Dn.dll or Dn64.dll. This threat is ...