News


  • New Cyber Espionage Campaigns Targeting Palestinians: The Spark and Pierogi Campaigns

    February 13, 2020

    Over the last several months, the Cybereason Nocturnus team has been tracking recent espionage campaigns targeting the Middle East. These campaigns are specifically directed at entities and individuals in the Palestinian territories. This investigation shows multiple similarities to previous attacks attributed to a group called MoleRATs (aka The Gaza Cybergang), an Arabic-speaking, politically motivated group that has operated ...

  • Puerto Rico Government Hit By $2.6M Phishing Scam

    February 13, 2020

    A phishing scam has swindled a Puerto Rico government agency out of more than $2.6 million, according to reports. According to reports, the email-based phishing scam hit Puerto Rico’s Industrial Development Company, which is a government-owned corporation aimed at driving economic development to the island along with local and foreign investors. The agency reportedly received an email alleging ...

  • Knock, Knock – Who’s There?

    February 11, 2020

    Following our research from Evil Twins and Windows Linux Subsystem, interoperability between different WSL versions was something that caught our attention. The protocol and mechanism to do file management from/to WSL is a must for Blue and Red Teams whose research will provide new ways to execute known techniques to achieve tactics such as Persistence, Defense ...

  • Apple Mac malware detections overtake Windows for the first time

    February 11, 2020

    Cyber threats aimed at Macs have outpaced those targeted at Windows PCs for the first time, signalling that Apple’s computers are not as secure as they once might have been. For some time, it was a commonly held belief that Apple Mac computers, such as the iMac, were pretty much immune to malware. This was largely due to the ...

  • U.S. Charges Chinese Military Officers in 2017 Equifax Hacking

    February 10, 2020

    Four members of China’s military were charged on Monday with hacking into Equifax, one of the nation’s largest credit reporting agencies, and stealing trade secrets and the personal data of about 145 million Americans in 2017. The charges underscored China’s quest to obtain Americans’ data and its willingness to flout a 2015 agreement with the United States to refrain from ...

  • How Chinese Cybercriminals Use Business Playbook to Revamp Underground

    February 10, 2020

    Because of its longevity and technical sophistication, the Russian cybercriminal underground has long been the benchmark for threat researchers focused on studying cybercrime tactics and techniques; there is a plethora of publications dedicated to analyzing its economy and hacking forums. However, only a handful of studies have centered on the emerging threats and trends from ...

  • KBOT: sometimes they come back

    February 10, 2020

    Although by force of habit many still refer to any malware as a virus, this once extremely common class of threats is gradually becoming a thing of the past. However, there are some interesting exceptions to this trend: we recently discovered malware that spread through injecting malicious code into Windows executable files; in other words, ...

  • Update your security strategy at IFSEC International

    February 10, 2020

    19–21 May 2020, ExCeL London IFSEC International 2020 is Europe’s largest and most comprehensive event for the global integrated security industry. It connects over 34,000 visitors from 113 countries with 450+ exhibitors showcasing some of the most innovative products and solutions on the market, as well as a full seminar programme, legislation updates, guidance and best practice. The exhibition ...

  • Introducing Loda Malware

    February 10, 2020

    Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name ‘Loda’ is derived from a directory to which the malware author chose to write keylogger logs (Figure 14). It should be noted that some ...

  • Facebook’s Instagram and Twitter accounts hijacked

    February 8, 2020

    Facebook has had several of its Instagram and Twitter accounts hijacked by a group who previously took credit for hacking the social media profiles of more than a dozen NFL teams. OurMine published the same message via @Facebook and @Messenger on Twitter, saying it had taken control of the accounts to prove how easily their security ...

  • Leaked Code from Docker Registries

    February 7, 2020

    The Unit 42 Cloud Threat Report: Spring 2020 focused on the practices of DevOps to determine where misconfigurations are happening in the cloud. Our research found a large number of DevOps services (e.g., SSH, Database, Code Repository) inadvertently exposed to the internet due to misconfigured infrastructure. This blog offers a detailed analysis of leaked code from Docker ...

  • Happy New Fear! Gift-wrapped spam and phishing

    February 7, 2020

    In the run-up to Christmas and New Year, scam е-mails mentioning easy pickings, lottery winnings, and other cash surprises are especially popular. All the more so given how simple it is to adapt existing schemes simply by mentioning the holiday in the subject line. For example, one scam е-mail with the subject line “Xsmas gift” or ...

  • Researchers Use Smart Light Bulbs to Infiltrate Networks

    February 6, 2020

    Researchers successfully infiltrated networks through a vulnerability in Philips Hue light bulbs. The CVE-2020-6007 vulnerability, which involves the ZigBee communication protocol, can be abused to remotely install malicious firmware in smart light bulbs and spread malware to other internet-of-things (IoT) devices. To make the discovery, Check Point researchers built on earlier studies that showed how to control smart light bulbs. The new finding focused ...

  • Bouygues Construction falls victim to ransomware

    February 5, 2020

    Bouygues Construction has confirmed falling victim to ransomware that it detected across its network on January 30. “As a precautionary measure, information systems have been shut down to prevent any propagation,” the company said in a brief statement. “Our teams are currently fully focused on returning to normal as quickly as possible, with the support of experts. “Installations are ...

  • SORA and UNSTABLE: 2 Mirai Variants Target Video Surveillance Storage Systems

    February 5, 2020

    Trend Micro researchers encountered two variants of the notorious internet of things (IoT) malware, Mirai, employing a new propagation method. The two variants, namely SORA (detected as IoT.Linux.MIRAI.DLEU) and UNSTABLE (detected as IoT.Linux.MIRAI.DLEV), gain entry through Rasilient PixelStor5000 video surveillance storage systems by exploiting CVE-2020-6756. Mirai is a type of malware that actively searches for IoT devices with vulnerabilities, infects them, and turns ...

  • Gamaredon APT Improves Toolset to Target Ukraine Government, Military

    February 5, 2020

    The Gamaredon advanced persistent threat (APT) group has been supercharging its operations lately, improving its toolset and ramping up attacks on Ukrainian national security targets. Vitali Kremez, head of SentinelLabs, said in research released on Wednesday that he has been tracking an uptick in Gamaredon cyberattacks on Ukrainian military and security institutions that started in December. ...

  • Ransomware Attack Hinders Toll Group Operations

    February 4, 2020

    Australian transportation and logistics giant Toll Group said a ransomware attack is to blame for several key services being debilitated and delivery operations being delayed over the past week. Toll Group, a subsidiary of Japan Post Holdings, is a freight and delivery service company operating across more than 1,200 locations in 50 countries. The company is ...

  • Twitter API Abused to Uncover User Identities

    February 4, 2020

    Twitter said that malicious actors, with potential ties to state-sponsored groups, were abusing a legitimate function on its platform to unmask the identity of users. The social media giant said that on Dec. 24, 2019, it discovered a large network of fake accounts abusing a legitimate API (application programming interface) function on its platform that, when ...

  • U.S. Battleground County Website Security Survey

    February 3, 2020

    Today McAfee released the results of a survey of county websites and county election administration websites in the 13 states projected as battleground states in the 2020 U.S. presidential elections. We found that significant majorities of these websites lacked the official government .GOV website validation and HTTPS website security measures to prevent malicious actors from launching copycat web domains ...

  • Ethics of red team security testing questioned in new report

    February 3, 2020

    Workers in areas like HR and finance are more likely than IT or security professionals to object to internal security testing, a report has found, raising serious ethical questions around how far security teams should go in their work. The process of red team security testing on colleagues and fellow workers may lead an organisation to identify gaps or ...