Trend Micro researchers have been continuously monitoring the MOONSHINE exploit kit’s activity since 2019. During our research, they discovered a MOONSHINE exploit kit server with improper operational security: Its server exposed MOONSHINE’s toolkits and operation logs, which revealed the information of possible victims and the attack tactics of a threat actor we have named Earth Minotaur.
MOONSHINE was first discovered as part of malicious activities against the Tibetan community, and is believed to also be associated with previous malicious activities against Uyghurs. It’s designed to implant a backdoor by exploiting the vulnerabilities of instant messaging apps on Android mobile devices.
Read more…
Source: Trend Micro
Related:
- PSA: Anyone can tell if you are using WhatsApp on your computer
January 17, 2024
Anyone who knows your WhatsApp number can figure out if you are only using the mobile app, or its companion web or desktop apps, a security researcher found. Tal Be’ery, the co-founder and CTO of crypto wallet maker ZenGo, found that it’s possible to determine whether a user on WhatsApp is using more than just the ...
- New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs
January 17, 2024
Since November 2023, Microsoft has observed a distinct subset of Mint Sandstorm (PHOSPHORUS) targeting high-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the United Kingdom, and the United States. In this campaign, Mint Sandstorm used bespoke phishing lures in an attempt to socially engineer targets into downloading ...
- Majorca: Calvià City Council hit by €10million ransom demand
January 17, 2024
Saturday witnessed a cyberattack on the Spanish city of Calvià in Majorca, with hackers now demanding 10 million euros to be paid to restore functionality to integral systems. The Calvià City Council website has been offering updates on the situation, saying the local authority is “working to recover normality as soon as possible, after having been ...
- Binge & Dan Murphys Among Major Brands Hit By Cyber Attack
January 17, 2024
Thousands of retail customers have fallen victim to a hacking scheme where scammers access their online accounts to make fraudulent transactions. Local scammers, having bought online login details from overseas cybercriminals, bragged in a chat online about purchasing iPhones, clothing and alcohol (almost $800 worth) with strangers’ money. The Iconic, an online retailer, said last week ...
- Known Indicators of Compromise Associated with Androxgh0st Malware
January 16, 2024
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory (CSA) to disseminate known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with threat actors deploying Androxgh0st malware. Multiple, ongoing investigations and trusted third party reporting yielded the IOCs and TTPs, and provided ...
- Data breach hits Navy contractor Fincantieri Marine Group
January 15, 2024
Italian shipbuilding firm Fincantieri’s U.S. arm Fincantieri Marine Group, which is a contractor for the U.S. Navy, disclosed that it had 16,769 individuals’ data compromised following an April ransomware attack that resulted in significant production disruptions. In breach notification letters sent to impacted individuals earlier this month, FMG said that some of its systems had been ...