FortiGuard Labs has recently identified a sophisticated cyberattack involving an Excel file embedded with a VBA macro designed to deploy a DLL file.
The attacker uses a multi-stage malware strategy to deliver the notorious “Cobalt Strike” payload and establish communication with a command and control (C2) server. This attack employs various evasion techniques to ensure successful payload delivery. Over the past few years, Ukraine has been a significant target due to its geopolitical situation. The history of these attacks reveals a pattern of increasing complexity and frequency, particularly during periods of geopolitical tension.
Read more…
Source: Fortinet
Related:
- Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT
December 2, 2024
Recent months have seen a surge in mailings with lookalike email attachments in the form of a ZIP archive containing JScript scripts. The script files – disguised as requests and bids from potential customers or partners – bear names such as “Запрос цены и предложения от Индивидуального предпринимателя <ФИО> на август 2024. According to Kaspersky telemetry, ...
- Retail outages drag into second week after Blue Yonder ransomware attack
December 2, 2024
A ransomware attack on supply chain software giant Blue Yonder continues to cause disruption to the company’s customers, almost two weeks after the outage first began. In a brief update to its cybersecurity incident page on Sunday, Arizona-based Blue Yonder said it is making “good progress” in its recovery from the attack, which hit its manage ...
- RansomHub claims to net data hat-trick against Bologna FC
November 30, 2024
Italian professional football club Bologna FC is allegedly a recent victim of the RansomHub cybercrime gang, according to the group’s dark web postings. The ransomware crims responsible for attacks on organizations including Planned Parenthood and Christie’s – the same crew thought to have picked up LockBit’s top talent post-disruption – posted an extensive collection of data ...
- Some London commuters may never be refunded after TfL cyber attack
November 30, 2024
Sadiq Khan has admitted victims of a Transport for London (TfL) cyber attack may never get their money back. Tens of thousands of Londoners are feared to have been left out of pocket after hackers gained access to the travel authority’s systems in September. The aftermath of the hack meant over-60s, children and students were unable to ...
- Pakistan: Severe Cyber Attack at Dewan Farooque Motors Corrupts Data and Crashes Servers
November 30, 2024
A cyber-attack crippled Dewan Farooque Motors Limited (DFML), corrupting key corporate data and crashing servers. The Pakistan Stock Exchange (PSX) received notice of the incident on Friday. DFML told stakeholders that restoring its information systems and financial data, including information from the first quarter ending September 30, 2024, will be a lengthy process. Read more… Source: ProPakistan News Sign ...
- Ransomware attack on Blue Yonder disrupts Starbucks, Sainsbury’s, Morrisons
November 27, 2024
Starbucks has confirmed that a ransomware attack on software supplier Blue Yonder has disrupted its internal systems for managing employee schedules and tracking work hours. The incident has primarily affected Starbucks’ North American operations, including approximately 11,000 stores across the United States and Canada. Starbucks says the cyberattack has compromised its ability to track baristas’ hours ...