Trend Micro researchers recently identified a new ransomware family called Charon, deployed in a targeted attack observed in the Middle East’s public sector and aviation industry.
The threat actor employed a DLL sideloading technique notably similar to tactics previously documented in the Earth Baxia campaigns, which have historically targeted government sectors. The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload. Analysis of the msedge.dll component revealed it was designed to load a file named DumpStack.log, which was absent from the Trend Micro initial telemetry.
Read more…
Source:Trend Micro
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- New Report On Suffolk County Cyber Attack Raises Questions
November 6, 2023
The former IT commissioner for the Suffolk County Clerk’s department did not alert county officials that the computer network in the clerk’s office was responding to a “radical malware attack” until eight hours after he was alerted, the Press has learned. The Center for Internet Security (CIS) sent an email at 3 a.m. on Sept. 8, ...
- Mortgage and loan giant Mr. Cooper blames cyberattack for ongoing outage
November 2, 2023
Mortgage and loan giant Mr. Cooper says a “cybersecurity incident” earlier this week was the cause of an ongoing outage, adding that the company is “working to resolve the issue.” The Texas-based company said in a statement on its website that on October 31, Mr. Cooper “became the target of a cyber security incident and took ...
- Forty Countries Agree Not to Pay Cybercrime Ransoms
November 1, 2023
Dozens of US allies have signed an agreement never to pay digital extortionists, in a sign of the growing impact ransomware is having on their national security and economies. The pledge was made at the second annual meeting of the International Counter Ransomware Initiative and reported by attendant media, although there is no official word yet ...
- Automatic disruption of human-operated attacks through containment of compromised user accounts
October 11, 2023
Based on incidents analyzed by Microsoft, it can take only a single hop from the attacker’s initial access vector to compromise domain admin-level accounts. For instance, an attacker can target an over-privileged service account configured in an outdated and vulnerable internet-facing server. Highly privileged user accounts are arguably the most important assets for attackers. Compromised domain ...
- Cyber attack hits electronics firm Volex
October 9, 2023
A cyber attack has hit electronic manufacturer Volex, opening the door to unauthorised access to some of its IT systems. The AIM-listed British company said it is not expecting any “material” financial impact from the incident but shares dropped over four per cent on Monday morning. After discovering the breach of certain IT systems and data ...
- Ransomware site claims to have stolen Auckland Transport data
September 19, 2023
A dark web ransomware site is claiming to have data stolen from Auckland Transport, a cyber threat analyst says. The transport agency was the victim of a cyber attack last week, which brought down the city’s ticket payment system. AT said no customer data has been compromised in the attack. A dark web ransomware site is ...