Trend Micro researchers recently identified a new ransomware family called Charon, deployed in a targeted attack observed in the Middle East’s public sector and aviation industry.
The threat actor employed a DLL sideloading technique notably similar to tactics previously documented in the Earth Baxia campaigns, which have historically targeted government sectors. The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload. Analysis of the msedge.dll component revealed it was designed to load a file named DumpStack.log, which was absent from the Trend Micro initial telemetry.
Read more…
Source:Trend Micro
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Kyivstar explains network failure by hacker attack, subscriber data not compromised
December 12, 2023
A failure in the network of Ukraine’s largest telecoms operator Kyivstar, which occurred on Tuesday morning, was caused by a hacker attack, but subscriber data was not compromised, the company involved law enforcement agencies and special government services in eliminating the failure, and promises compensation to customers. “On the morning of December 12, the Kyivstar communications ...
- You versus adversaries: How to become unbeatable in 20 cybersecurity moves
December 8, 2023
In today’s landscape, every business is inherently based on technology, increasing its susceptibility to significant and frequent threats that can hinder operations, success, and sustainability. At times, it can cause damage that is hard to bounce back from. Securing your organization, therefore, requires a deliberate, proactive, and holistic approach — you must keep constant tabs on ...
- Royal Mail’s recovery from ransomware attack will cost business at least $12M
November 16, 2023
Royal Mail’s parent International Distributions Services has revealed for the first time the infrastructure costs associated with its January ransomware attack.… LockBit’s attack has driven costs up across various areas of the Brit business, but improvements to the corporation’s Heathrow Worldwide Distribution Centre – the target of the attack – will cost the biz £10 million ...
- Identifying Group Policy attacks
November 8, 2023
In this post Sophos researchers will be discussing Group Policy attacks, basing the threat hunt on a ransomware investigation undertaken by the Sophos X-Ops Incident Response team earlier this year. They will cover malicious behaviors associated with Active Directory and Group Policy attacks, showing you how to investigate and remediate some of these threats. Read more… Source: ...
- UK: Cyber attack hits island council computer systems
November 8, 2023
A suspected ransomware attack has caused significant disruption to IT systems at Western Isles local authority, Comhairle nan Eilean Siar. The council said access to its systems had been affected. The Scottish government and computer company Dell have been helping Comhairle nan Eilean Siar deal with the situation. Read more… Source: MSN News
- UK: Government has never paid a ransomware demand, minister says
November 7, 2023
The government has announced that it has never paid a ransom demanded by cybercriminals – and pledged that it never will. The announcement – made to tie in with last week’s meeting of members of the international Counter Ransomware Initiative – rubber-stamps what the government said “has been a long-standing policy but … the first ...