• Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise

    June 16, 2021

    Mandiant observed DARKSIDE affiliate UNC2465 accessing at least one victim through a Trojanized software installer downloaded from a legitimate website. While this victim organization detected the intrusion, engaged Mandiant for incident response, and avoided ransomware, others may be at risk. As reported in the Mandiant post, “Shining a Light on DARKSIDE Ransomware Operations,” Mandiant Consulting has ...

  • Paradise Ransomware source code released on a hacking forum

    June 15, 2021

    The complete source code for the Paradise Ransomware has been released on a hacking forum allowing any would-be cyber criminal to develop their own customized ransomware operation. Released on the hacking forum XSS, the link to the source code is only accessible to active users on the site who have previously replied to or reacted to ...

  • Andariel evolves to target South Korea with ransomware

    June 15, 2021

    In April 2021, we observed a suspicious Word document with a Korean file name and decoy. It revealed a novel infection scheme and an unfamiliar payload. While we were doing our research into these findings, Malwarebytes published a nice report with technical details about the same series of attacks, which they attributed to the Lazarus ...

  • REvil ransomware hits US nuclear weapons contractor

    June 14, 2021

    US nuclear weapons contractor Sol Oriens has suffered a cyberattack allegedly at the hands of the REvil ransomware gang, which claims to be auctioning data stolen during the attack. Sol Oriens describes itself as helping the “Department of Defense and Department of Energy Organizations, Aerospace Contractors, and Technology Firms carry out complex programs.” However, job postings first ...

  • Microsoft: SEO poisoning used to backdoor targets with malware

    June 14, 2021

    Microsoft is tracking a series of attacks that use SEO poisoning to infect targets with a remote access trojan (RAT) capable of stealing the victims’ sensitive info and backdooring their systems. The malware delivered in this campaign is SolarMarker (aka Jupyter, Polazert, and Yellow Cockatoo), a .NET RAT that runs in memory and is used by ...

  • G7 leaders ask Russia to hunt down ransomware gangs within its borders

    June 14, 2021

    G7 (Group of 7) leaders have asked Russia to urgently disrupt ransomware gangs believed to be operating within its borders, following a stream of attacks targeting organizations from critical sectors worldwide. The G7 member states also expressed their commitment to work together to address the escalating and immediate ransomware threat as a global challenge. Read more… Source: Bleeping ...

  • Avaddon ransomware shuts down and releases decryption keys

    June 11, 2021

    The Avaddon ransomware gang has shut down operation and released the decryption keys for their victims to This morning, BleepingComputer received an anonymous tip pretending to be from the FBI that contained a password and a link to a password-protected ZIP file. Read more… Source: Bleeping Computer  

  • JBS Paid $11M to REvil Gang Even After Restoring Operations

    June 10, 2021

    JBS Foods paid the equivalent of $11 million in ransom after a cyber-attack that forced the company to shut down some operations in the United States and Australia over the Memorial Day weekend. The company made the payment to cybercriminals to ensure the protection of its data and mitigate any further damage to its customers, as ...

  • Slilpp, the largest stolen logins market, seized by law enforcement

    June 10, 2021

    The US Department of Justice (DOJ) has announced today that a multinational operation took down Slillpp, the largest online marketplace of stolen login credentials. Law enforcement agencies from the United States, Germany, the Netherlands, and Romania seized servers used to host Slilpp’s marketplace infrastructure and its domain names. Read more… Source: Bleeping Computer  

  • Prometheus Ransomware Gang: A Group of REvil?

    June 9, 2021

    Unit 42 has spent the past four months following the activities of Prometheus, a new player in the ransomware world that uses similar malware and tactics to ransomware veteran Thanos. Prometheus leverages double-extortion tactics and hosts a leak site, where it names new victims and posts stolen data available for purchase. It claims to have breached ...

  • US brokerage firms warned of ongoing phishing with penalty threats

    June 8, 2021

    FINRA, the U.S. securities industry regulator, has warned brokerage firms of an ongoing phishing campaign threatening recipients with penalties unless they provide the information requested by the attackers. FINRA (Financial Industry Regulatory Authority) is an independent, non-governmental securities regulator supervised by the U.S. Securities and Exchange Commission (SEC) that regulates all securities firms and exchange markets ...

  • Modern Ransomware’s Double Extortion Tactics And How To Protect Enterprises Against Them

    June 8, 2021

    Ransomware actors have been a persistent threat for years, but they are still evolving. The wide adoption of advanced cybersecurity technologies and improved ransomware response processes has limited the success of traditional ransomware attacks. Upgraded security has forced these cybercriminals to evolve their strategies, and has paved the way for what we now call modern ...

  • How the FBI and AFP accessed encrypted messages in TrojanShield investigation

    June 8, 2021

    The US Department of Justice has unsealed a warrant detailing how law enforcement agencies accessed and used the encrypted communications of criminals as part of its TrojanShield investigation, a global online sting operation. The warrant reveals that the Federal Bureau of Investigation (FBI) in 2018 commenced the investigation after it recruited a confidential human source to ...

  • Gootkit: the cautious Trojan

    June 7, 2021

    Gootkit is complex multi-stage banking malware that was discovered for the first time by Doctor Web in 2014. Initially it was distributed via spam and exploits kits such as Spelevo and RIG. In conjunction with spam campaigns, the adversaries later switched to compromised websites where the visitors are tricked into downloading the malware. Gootkit is capable ...

  • US truck and military vehicle maker Navistar discloses data breach

    June 7, 2021

    Navistar International Corporation (Navistar), a US-based maker of trucks and military vehicles, says that unknown attackers have stolen data from its network following a cybersecurity incident discovered on May 20, 2021. The company disclosed the attack in an 8-K report filed with the Securities and Exchange Commission (SEC) on Monday. Read more… Source: Bleeping Computer  

  • FBI Claws Back Millions of DarkSide’s Ransom Profits

    June 7, 2021

    United States law enforcement has clawed back approximately $2.3 million of the ransom allegedly paid to DarkSide by Colonial Pipeline last month, the Department of Justice (DOJ) and FBI announced in a joint press conference on Monday. “Today we turned the tables on DarkSide,” FBI Deputy Director Paul Abbate said in live-streamed remarks. They seized the money ...

  • REvil Ransomware Gang Spill Details on US Attacks

    June 4, 2021

    Cybercriminals behind the JBS Foods ransomware attack claim they had no intent to target United States-based firms. The group, identified as the Sodinokibi REvil ransomware gang, also said it was not afraid of being labeled a cyber-terrorist group. A spokesperson for REvil shared its positions in an interview on a YouTube and Telegram channel called Russian ...

  • TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations

    June 4, 2021

    TeamTNT has been evolving their cloud-focused cryptojacking operations for some time now. TeamTNT operations have targeted and, after compromise, exfiltrated AWS credentials, targeted Kubernetes clusters and created new malware called Black-T that integrates open source cloud native tools to assist in their cryptojacking operations. TeamTNT operations are now using compromised AWS credentials to enumerate AWS cloud ...

  • Necro Python bot revamped with new VMWare, server exploits

    June 3, 2021

    A recent Necro Python bot campaign has shown that the developer behind the malware is hard at work ramping up its capabilities. On Thursday, researchers from Cisco Talos published a report on Necro Python, a bot that has been in development since 2015. The botnet’s development progress was documented in January 2021 by both Check Point ...

  • Chinese threat actors hacked NYC MTA using Pulse Secure zero-day

    June 3, 2021

    Chinese-backed threat actors breached New York City’s Metropolitan Transportation Authority (MTA) network in April using a Pulse Secure zero-day. Still, they failed to cause any data loss or gain access to systems controlling the transportation fleet. MTA mitigated the vulnerability on April 21, one day after Pulse Secure issued an advisory, and CISA published an alert ...