Trend Micro researchers recently identified a new ransomware family called Charon, deployed in a targeted attack observed in the Middle East’s public sector and aviation industry.
The threat actor employed a DLL sideloading technique notably similar to tactics previously documented in the Earth Baxia campaigns, which have historically targeted government sectors. The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload. Analysis of the msedge.dll component revealed it was designed to load a file named DumpStack.log, which was absent from the Trend Micro initial telemetry.
Read more…
Source:Trend Micro
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Sustainability Business Division of Schneider Electric Responds to Cybersecurity Incident
January 29, 2024
On January 17th, 2024, a ransomware incident affected Schneider Electric Sustainability Business division. The attack has impacted Resource Advisor and other division specific systems. Schneider Electric Global Incident Response team has been immediately mobilized to respond to the attack, contain the incident, and to reinforce existing security measures. Sustainability Business division has informed impacted customers. Read more… Source: ...
- Microsoft actions following attack by nation state actor Midnight Blizzard
January 19, 2024
The Microsoft security team detected a nation-state attack on our corporate systems on January 12, 2024, and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. Microsoft has identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as Nobelium. Beginning in ...
- New York: Refuah Health to spend over $1M on cyber security following ransomware attack
January 8, 2024
A Hudson Valley health care provider will spend more than $1 million on cybersecurity after a ransomware attack leaked patients’ information. An investigation by the state attorney general found Refuah Healthdid not have proper precautions set up to prevent the attack. Read more… Source: Bronx News 12
- ECB to conduct mock cyber attacks at 109 banks
January 3, 2024
The European Central Bank (ECB) will stress test 109 banks over the next twelve months to see if they are adequately prepared for cyber attacks. The banks’ response and recovery capabilities will be prioritized, not the potential to prevent incidents. The 109 banks in question are all under the direct supervision of the ECB. The stress ...
- Henry Schein Sales Hurt by Cyber Attack, Macro Woes
December 27, 2023
Henry Schein (HSIC) is currently entangled in a major cyber-attack incident. Headwinds like unfavorable currency movement and global economic uncertainties continue to affect the company. The stock carries a Zacks Rank #4 (Sell). In October 2023, Henry Schein stated that a portion of its manufacturing and distribution businesses experienced a cybersecurity incident. Henry Schein took precautionary ...
- Ubisoft apparently stopped a 900GB data breach
December 24, 2023
Just days after Insomniac suffered a horrible data breach, Ubisoft may have avoided the same fate. Security collective VX-Underground shared a report on X that, on Dec. 20, an “unknown Threat Actor” got access to Ubisoft’s internal tools, sharing screenshots online. They allegedly intended to get 900GB worth of data from the French game publisher behind ...