- Venezuela is the Victim of a Cyber Coup
August 10, 2024
On Friday, Joaquin Perez, the Deputy Ambassador of Venezuela to the United Nations, participated in the United Nations Convention on Cybercrime meeting held in New York. The Bolivarian diplomat denounced that Venezuela is being subjected to a cyber coup d’état orchestrated by transnational far-right powerful actors who control major media outlets and social networks. “The meeting ...
- Greece leaves spy services unchecked on Predator hacks
August 7, 2024
Greece’s 2022 espionage scandal dubbed “Predatorgate” had everything: eavesdropping on politicians, journalists and judges, exports of shady software to dictatorial regimes and high-profile resignations. Fast-forward two years and everyone in government is off the hook. In a 300-page report seen by POLITICO, deputy prosecutor of the Supreme Court Achilles Zisis argued that a series of controversial ...
- Bloody Wolf strikes organizations in Kazakhstan with STRRAT commercial malware
July 31, 2024
Since late 2023, BI.ZONE Threat Intelligence experts have been tracking the activity of Bloody Wolf. The cluster attacks organizations in Kazakhstan with STRRAT, a commercial malware also known as Strigoi Master. The attackers send out phishing emails on behalf of the Ministry of Finance of the Republic of Kazakhstan and other agencies. The emails have PDF ...
- UK: Basic IT security failings left electoral register vulnerable
July 30, 2024
Basic IT security failings allowed Chinese state-linked hackers to access the election watchdog’s register containing the details of 40 million voters. The Information Commissioner’s Office (ICO) said the Electoral Commission had failed to keep its servers updated, allowing hackers to exploit the vulnerability. The National Cyber Security Centre (NCSC), part of GCHQ, has previously said it ...
- Pakistan to launch home-grown messaging app amid internet disruptions
July 30, 2024
The Pakistani government is set to roll out “Beep Pakistan”, a communication application designed for federal officials and employees. Shaza Fatima Khwaja, the state minister for information technology and telecommunication, said that the application was currently undergoing trial runs within her ministry and would be launched “soon” among other government departments. “We have developed an application ...
- New Attack Technique GrimResource Sweeps Through China with Fake Website
July 17, 2024
QiAnXin Threat Intelligence Center and Falcon Operations Team observed in their daily operations that in June 2024, several foreign counterparts reported in-the-wild attacks related to the new attack technique GrimResource. QiAnXin Threat Intelligence Center and Falcon Operations Team promptly conducted research on this technique and have been continuously monitoring it. In mid-July 2024, they discovered the ...
- CloudSorcerer – A new APT targeting Russian government entities
July 8, 2024
In May 2024, Kaspersky researchers discovered a new advanced persistent threat (APT) targeting Russian government entities that we dubbed CloudSorcerer. It’s a sophisticated cyberespionage tool used for stealth monitoring, data collection, and exfiltration via Microsoft Graph, Yandex Cloud, and Dropbox cloud infrastructure. The malware leverages cloud resources as its command and control (C2) servers, accessing them ...
- Airports, Student Aid Services Struck by Indonesian Cyber Attack
June 28, 2024
Indonesia’s parliament called the government to task over another cyber attack that led to airport and scholarship services being put out of service. The ransomware attack that affected hundreds of ministries and public institutions was “catastrophic,” said lawmaker Tubagus Hasanuddin in a Thursday evening hearing with the communications minister and the head of state cybersecurity agency. ...
- LockBit hackers claim to have cracked the US Federal Reserve
June 25, 2024
The LockBit cybercrime gang has claimed to have stolen an enormous database from the US Federal Reserve, which includes sensitive banking information about American citizens – but the claim is being met with suspicion. Earlier this week, the infamous ransomware operator added the Fed on its data leak site, saying it had acquired an archive containing ...
- Indonesian government says national data center was hit in ransomware attack – but it won’t pay up
June 25, 2024
The government of Indonesia has suffered a ransomware attack that crippled many of its organizations and caused quite a nuisance for its citizens – but says it won’t be held to ransom. Government officials confirmed its National Data Center (PDN) was struck on June 20, with the attack apparently organized by an affiliate of LockBit, with ...
- Chinese hackers have stepped up attacks on Taiwanese organizations
June 24, 2024
A suspected Chinese state-sponsored hacking group has stepped up its targeting of Taiwanese organizations, particularly those in sectors such as government, education, technology and diplomacy, according to cybersecurity intelligence company Recorded Future. RedJuliett has targeted Taiwanese organizations in the past, but this is the first time that activity was seen at such a scale, a Recorded ...
- ExCobalt: GoRed, the hidden-tunnel technique
June 19, 2024
While responding to an incident at one of their clients, the PT ESC CSIRT team discovered a previously unknown backdoor written in Go, which they attributed to a cybercrime gang dubbed ExCobalt. ExCobalt focuses on cyberespionage and includes several members active since at least 2016 and presumably once part of the notorious Cobalt gang. Cobalt attacked ...
- Cleveland City Hall to remain closed after ransomware attack
June 15, 2024
City officials have confirmed the “cyber incident” that has hamstrung city operations for days to be a ransomware attack. In such attacks, malicious software effectively locks up a computer or network system, preventing access until users pay a ransom, according to the FBI. Read more… Source: MSN News Sign up for our Newsletter Related:
- DISGOMOJI Malware Used to Target Indian Government
June 13, 2024
In 2024, Volexity identified a cyber-espionage campaign undertaken by a suspected Pakistan-based threat actor that Volexity currently tracks under the alias UTA0137. The malware used in these recent campaigns, which Volexity tracks as DISGOMOJI, is written in Golang and compiled for Linux systems. Volexity assesses with high confidence that UTA0137 has espionage-related objectives and a remit ...
- Major data breach at Philippines Agricultural Credit Policy Council (ACPC) exposes sensitive information
June 9, 2024
The Agricultural Credit Policy Council (ACPC) has been hacked, exposing sensitive data and raising concerns about government agency security. Ph1ns, a hacker who gained unauthorized access to the ACPC’s internal systems, revealed the breach. The hacker was also responsible for several hack attacks on government agencies, including the DOST and the PNP. Read more… Source: Manila Bulletin Sign up ...
- Canada does not have the tools to fight cyber crime, says watchdog
June 5, 2024
Canada’s federal government does not have the capacity and tools to effectively fight cyber crime in part because of excessive bureaucracy and staff shortages, the country’s top watchdog said on Tuesday. In an official report, Auditor General Karen Hogan said she found breakdowns in response, coordination, tracking, and information sharing between and across the organizations responsible ...
- Ukrainian intelligence’ hackers attack Russian government agencies and large companies
June 5, 2024
Hackers from the Main Intelligence Directorate (DIU) of Ukraine’s Ministry of Defense have attacked the electronic services of several Russian ministries and banking institutions, according to RBC-Ukraine source in the special services. According to Roskomnadzor (Federal Service for Supervision of Communications, Information Technology and Mass Media) , the disruption is allegedly linked to an accident in ...
- Inside The Box: Malware’s New Playground
June 3, 2024
Over the past few months, we have been monitoring the increasing abuse of BoxedApp products in the wild. BoxedApp products are commercial packers that provide advanced features such as Virtual Storage (Virtual File System, Virtual Registry), Virtual Processes, and a universal instrumentation system (WIN/NT API hooking). Even though BoxedApp has been commercially available for a while, ...
- Massive cyber attack against Eritrea’s Internet System
May 26, 2024
A massive cyber attack was unleashed against Eritrea’s Internet System on Independence Day, Friday, 24 May 2024, at 12:32’:47 in the afternoon hours. The attempt was foiled by the defensive countermeasures deployed promptly, and the network continued its functions without interruptions. The identity of the originators, architects, and implementers of the attempted cyber attack is not ...
- Optus sued by regulator over 2022 cyber-attack
May 23, 2024
Australia’s Communications and Media Authority (ACMA) has begun legal action against Optus, the country’s second largest telco, over a data breach it suffered in 2022. The watchdog has filed legal proceedings to the Federal Court, alleging that Optus “failed to protect the confidentiality of its customers’ personal information from unauthorised interference or unauthorised access,” and was ...